security: memory package hardening (v0.27.1)

Fix #1 (🔴): Path traversal — wire session.ValidateSessionID into
  episodes.go Write/Read, memory.go OnSessionEnd, tool.go handleView.
  Prevents arbitrary file read/write via crafted session IDs.

Fix #2 (🔴): TOCTOU in FactStore — add sync.Mutex to Add/Replace/Remove,
  atomic temp+rename for writeEntries. Prevents lost writes and data
  corruption from concurrent sessions sharing the same memory dir.

Fix #3 (🔴): addToIndex TOCTOU — add sync.Mutex to EpisodeStore index
  operations, temp file cleanup on rename failure. Prevents lost
  episode index entries (orphaned .md files).

Fix #4 (🟠): Thread safety — add sync.RWMutex for promptDirty/promptCache,
  consolidate into markPromptDirty() helper. Eliminates data race.

Fix #5 (🟡): Consolidate bypass ScanContent — scan LLM output before
  persisting to fact files, invalidate prompt cache, re-fit merge detector.
  Also: episode dir 0755→0700 (world-readable→owner-only).

All 16 packages pass with -race. Zero new warnings.

Author: molty3000

internal/memory/episodes.go

@@ -9,9 +9,11 @@ import (
 	"path/filepath"
 	"sort"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/BackendStack21/go-vector/pkg/vector"
+	"github.com/BackendStack21/kode/internal/session"
 )
 
 // maxEpisodeSummaryBytes caps how much summary text we store per episode.
@@ -35,7 +37,10 @@ type RankStrategy func(query string, episodes []EpisodeMeta) ([]EpisodeMeta, err
 
 // EpisodeStore manages on-disk episode summaries (Tier 3 memory).
 // Written after sessions with sufficient turns, searchable via SimpleCall.
+// Index operations are protected by a mutex to prevent TOCTOU races
+// between concurrent sessions sharing the same memory directory.
 type EpisodeStore struct {
+	mu     sync.Mutex
 	dir    string
 	rankFn RankStrategy
 }
@@ -54,8 +59,12 @@ func NewEpisodeStore(dir string, rankFn RankStrategy) *EpisodeStore {
 
 // Write stores an episode summary for a session. Creates the episodes
 // directory and updates the index.
+// sessionID is validated for path traversal before use.
 func (e *EpisodeStore) Write(sessionID, summary string, turns int) error {
-	if err := os.MkdirAll(e.dir, 0755); err != nil {
+	if err := session.ValidateSessionID(sessionID); err != nil {
+		return fmt.Errorf("memory: episodes write: %w", err)
+	}
+	if err := os.MkdirAll(e.dir, 0700); err != nil {
 		return fmt.Errorf("memory: episodes mkdir: %w", err)
 	}
 
@@ -90,7 +99,11 @@ func (e *EpisodeStore) WriteIfEnough(sessionID, summary string, turns int) error
 }
 
 // Read returns the full summary content for a session.
+// sessionID is validated for path traversal before use.
 func (e *EpisodeStore) Read(sessionID string) (string, error) {
+	if err := session.ValidateSessionID(sessionID); err != nil {
+		return "", fmt.Errorf("memory: episodes read: %w", err)
+	}
 	path := filepath.Join(e.dir, sessionID+".md")
 	data, err := os.ReadFile(path)
 	if err != nil {
@@ -146,7 +159,11 @@ func (e *EpisodeStore) Search(query string, limit int) ([]EpisodeMeta, error) {
 // ── Index helpers ─────────────────────────────────────────────────────
 
 // addToIndex appends an entry to the index and writes it.
+// Caller must hold e.mu (acquired by Write).
 func (e *EpisodeStore) addToIndex(meta EpisodeMeta) error {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
 	idx, err := e.ReadIndex()
 	if err != nil {
 		// Index error means we start fresh
@@ -156,7 +173,8 @@ func (e *EpisodeStore) addToIndex(meta EpisodeMeta) error {
 	return e.writeIndex(idx)
 }
 
-// writeIndex serializes the index to disk.
+// writeIndex serializes the index to disk atomically (temp + rename).
+// Caller must hold e.mu.
 func (e *EpisodeStore) writeIndex(idx []EpisodeMeta) error {
 	// Write to temp + rename for atomicity
 	idxPath := filepath.Join(e.dir, episodeIndexFile)
@@ -169,7 +187,11 @@ func (e *EpisodeStore) writeIndex(idx []EpisodeMeta) error {
 	if err := os.WriteFile(tmpPath, data, 0600); err != nil {
 		return err
 	}
-	return os.Rename(tmpPath, idxPath)
+	if err := os.Rename(tmpPath, idxPath); err != nil {
+		os.Remove(tmpPath) // best-effort cleanup
+		return err
+	}
+	return nil
 }
 
 // truncateForIndex shortens the summary for the index entry (first 120 chars).

internal/memory/facts.go

@@ -26,6 +26,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 )
 
 // File names for fact targets.
@@ -45,10 +46,13 @@ const entrySep = "\n§\n"
 
 // FactStore manages typed fact files (user.md and env.md) with character caps,
 // duplicate prevention, and entry-level CRUD via substring matching.
+// All write operations are protected by a mutex to prevent TOCTOU races
+// between concurrent sessions sharing the same memory directory.
 type FactStore struct {
-	dir       string
-	capUser   int
-	capEnv    int
+	mu      sync.Mutex
+	dir     string
+	capUser int
+	capEnv  int
 }
 
 // NewFactStore creates a FactStore rooted at dir. Fact files are stored as
@@ -124,6 +128,9 @@ func (f *FactStore) Add(target, content string) error {
 		return fmt.Errorf("memory: empty content")
 	}
 
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
 	content = strings.TrimSpace(content)
 
 	// Read existing content
@@ -161,7 +168,7 @@ func (f *FactStore) Add(target, content string) error {
 		newContent = existing + entrySep + content
 	}
 
-	return os.WriteFile(f.path(target), []byte(newContent), 0600)
+	return f.writeEntries(target, parseEntries(newContent))
 }
 
 // Replace finds an entry by substring match and replaces it with new content.
@@ -177,6 +184,9 @@ func (f *FactStore) Replace(target, oldText, content string) error {
 		return fmt.Errorf("memory: empty old_text")
 	}
 
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
 	content = strings.TrimSpace(content)
 	oldText = strings.TrimSpace(oldText)
 
@@ -236,6 +246,9 @@ func (f *FactStore) Remove(target, oldText string) error {
 		return fmt.Errorf("memory: empty old_text")
 	}
 
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
 	oldText = strings.TrimSpace(oldText)
 
 	existing, err := f.Read(target)
@@ -280,10 +293,17 @@ func (f *FactStore) Entries(target string) ([]string, error) {
 	return parseEntries(existing), nil
 }
 
-// writeEntries joins entries and writes to disk.
+// writeEntries joins entries and writes to disk atomically (temp + rename).
+// Caller must hold f.mu.
 func (f *FactStore) writeEntries(target string, entries []string) error {
 	content := strings.Join(entries, entrySep)
-	return os.WriteFile(f.path(target), []byte(content), 0600)
+	path := f.path(target)
+	tmpPath := path + ".tmp"
+
+	if err := os.WriteFile(tmpPath, []byte(content), 0600); err != nil {
+		return err
+	}
+	return os.Rename(tmpPath, path)
 }
 
 // parseEntries splits file content into individual entries.

internal/memory/memory.go

@@ -4,6 +4,9 @@ import (
 	"context"
 	"fmt"
 	"strings"
+	"sync"
+
+	"github.com/BackendStack21/kode/internal/session"
 )
 
 // Default memory dir relative to ~/.odek/
@@ -79,6 +82,7 @@ type MemoryManager struct {
 	// prompt caching avoids rebuilding the system prompt block on every
 	// iteration when memory hasn't changed. The cache is invalidated
 	// whenever facts or buffer are modified.
+	promptMu    sync.RWMutex
 	promptCache string
 	promptDirty bool
 }
@@ -231,7 +235,7 @@ func (m *MemoryManager) AddFact(target, content string) error {
 	if err := m.facts.Add(target, content); err != nil {
 		return err
 	}
-	m.promptDirty = true
+	m.markPromptDirty()
 
 	// Incrementally update merge detector instead of re-reading + re-embedding all.
 	// Check dedup: if content already existed in the entries we read at the top,
@@ -270,7 +274,7 @@ func (m *MemoryManager) ReplaceFact(target, oldText, content string) error {
 	if err := m.facts.Replace(target, oldText, content); err != nil {
 		return err
 	}
-	m.promptDirty = true
+	m.markPromptDirty()
 	// Re-fit merge detector
 	if m.cfg.MergeOnWrite != nil && *m.cfg.MergeOnWrite {
 		entries, _ := m.facts.Entries(target)
@@ -287,7 +291,7 @@ func (m *MemoryManager) RemoveFact(target, oldText string) error {
 	if err := m.facts.Remove(target, oldText); err != nil {
 		return err
 	}
-	m.promptDirty = true
+	m.markPromptDirty()
 	// Re-fit merge detector
 	if m.cfg.MergeOnWrite != nil && *m.cfg.MergeOnWrite {
 		entries, _ := m.facts.Entries(target)
@@ -349,8 +353,28 @@ Entries for %s:
 		return nil // LLM returned nothing useful
 	}
 
+	// Security: scan LLM output before persisting
+	for _, entry := range newEntries {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+		if err := ScanContent(entry); err != nil {
+			return fmt.Errorf("memory: consolidated entry rejected: %w", err)
+		}
+	}
+
 	// Write back
-	return m.facts.writeEntries(target, newEntries)
+	if err := m.facts.writeEntries(target, newEntries); err != nil {
+		return err
+	}
+	m.markPromptDirty()
+	// Re-fit merge detector
+	if m.cfg.MergeOnWrite != nil && *m.cfg.MergeOnWrite {
+		entries, _ := m.facts.Entries(target)
+		m.merge.Fit(entries)
+	}
+	return nil
 }
 
 // ── Buffer Operations ────────────────────────────────────────────────
@@ -362,7 +386,7 @@ func (m *MemoryManager) AppendBuffer(role, message string) {
 	}
 	line := FormatBufferLine(role, message)
 	m.buffer.Append(line)
-	m.promptDirty = true
+	m.markPromptDirty()
 }
 
 // GetBuffer returns the current buffer lines (for system prompt injection).
@@ -382,20 +406,32 @@ func (m *MemoryManager) RestoreBuffer(lines []string) {
 	for _, line := range lines {
 		m.buffer.Append(line)
 	}
-	m.promptDirty = true
+	m.markPromptDirty()
 }
 
 // ClearBuffer resets the buffer for a new session.
 func (m *MemoryManager) ClearBuffer() {
 	m.buffer.Clear()
+	m.markPromptDirty()
+}
+
+// markPromptDirty invalidates the cached system prompt so the next
+// BuildSystemPrompt() call rebuilds from current facts/buffer state.
+func (m *MemoryManager) markPromptDirty() {
+	m.promptMu.Lock()
 	m.promptDirty = true
+	m.promptMu.Unlock()
 }
 
 // ── Episode Operations ───────────────────────────────────────────────
 
 // OnSessionEnd is called when a session ends. If turns >= threshold,
 // extracts durable facts using the LLM and stores them as an episode.
+// sessionID is validated for path traversal before any file I/O.
 func (m *MemoryManager) OnSessionEnd(sessionID string, turns int, messages []string) {
+	if err := session.ValidateSessionID(sessionID); err != nil {
+		return
+	}
 	minTurns := m.cfg.MinTurnsForExtraction
 	if minTurns <= 0 {
 		minTurns = defaultMinTurnsForExtraction
@@ -468,9 +504,13 @@ func (m *MemoryManager) BuildSystemPrompt() string {
 	}
 
 	// Return cached prompt if memory hasn't changed since last build.
+	m.promptMu.RLock()
 	if !m.promptDirty && m.promptCache != "" {
-		return m.promptCache
+		cached := m.promptCache
+		m.promptMu.RUnlock()
+		return cached
 	}
+	m.promptMu.RUnlock()
 
 	userFact, _ := m.facts.Read("user")
 	envFact, _ := m.facts.Read("env")
@@ -542,8 +582,10 @@ func (m *MemoryManager) BuildSystemPrompt() string {
 	}
 
 	b.WriteString("───────────────────────────────\n")
+	m.promptMu.Lock()
 	m.promptCache = b.String()
 	m.promptDirty = false
+	m.promptMu.Unlock()
 	return m.promptCache
 }
 

internal/memory/tool.go

@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"strings"
+
+	"github.com/BackendStack21/kode/internal/session"
 )
 
 // memoryToolSchema is the JSON schema for the `memory` tool.
@@ -179,6 +181,9 @@ func (t *MemoryTool) handleView(target, query string) (string, error) {
 	if query == "" {
 		return errorJSON("query (session_id) is required for view"), nil
 	}
+	if err := session.ValidateSessionID(query); err != nil {
+		return errorJSON("invalid session_id: " + err.Error()), nil
+	}
 	content, err := t.manager.episodes.Read(query)
 	if err != nil {
 		return errorJSON(err.Error()), nil