fix: cap write_file content, harden file_info, bound WebSocket/session/skill sizes

Author: jkyberneees

AGENTS.md

@@ -91,7 +91,7 @@ System prompt is loaded by priority: `--system` flag > `~/.odek/IDENTITY.md` > c
 ### Security Architecture
 Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECURITY.md](docs/SECURITY.md).
 
-- **Untrusted-content wrapper** (`cmd/odek/untrusted.go`) — every tool whose output sources from outside the trust boundary (`browser`, `read_file`, `shell`, `search_files`, `multi_grep`, `transcribe`, `head_tail`, `diff`, `tr`, `sort`, `json_query`, `batch_patch`, `glob`, `session_search`, `@-resources`, `--ctx` files, any MCP tool) wraps results in `<untrusted_content_<nonce> source="...">…</untrusted_content_<nonce>>`. Per-call nonce defeats wrapper-escape via literal close tag.
+- **Untrusted-content wrapper** (`cmd/odek/untrusted.go`) — every tool whose output sources from outside the trust boundary (`browser`, `read_file`, `shell`, `search_files`, `multi_grep`, `transcribe`, `head_tail`, `diff`, `tr`, `sort`, `json_query`, `batch_patch`, `glob`, `file_info`, `session_search`, `@-resources`, `--ctx` files, any MCP tool) wraps results in `<untrusted_content_<nonce> source="...">…</untrusted_content_<nonce>>`. Per-call nonce defeats wrapper-escape via literal close tag.
 - **Audit log** (`cmd/odek/audit.go` + `internal/session/audit.go`) — every `wrapUntrusted` call records source + content-hash + turn into `<sessions>/audit/<id>.json`. After each turn a divergence heuristic flags `suspicious_divergence=true` when the agent ingested untrusted content AND its tool calls referenced resources the user did not mention. Inspect with `odek audit <session-id>` / `odek audit --list`.
 - **Memory taint** (`internal/memory/provenance.go`) — `EpisodeProvenance` tracks Untrusted/Sources/UserApproved. Tainted episodes are stored but `Search()` filters them out, so a one-shot injection cannot persist via the episode pipeline. User must explicitly promote.
 - **Skill provenance gate** (`internal/skills/loader.go` + `cache.go`) — `Skill.Provenance{Untrusted, Sources, NeedsReview}`. NeedsReview skills pin to Lazy regardless of `auto_load`. `odek skill promote <name>` clears the flag after user review.
@@ -116,6 +116,11 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **Resource resolver size cap** (`internal/resource/resource.go`) — `@-resource` file loads are capped at 1 MiB to prevent OOM from `@hugefile` references.
 - **Sub-agent summary cap** (`cmd/odek/subagent_tool.go`) — each sub-agent result included in the `delegate_tasks` summary is truncated to 100 KiB to prevent memory DoS.
 - **patch / batch_patch output expansion cap** (`cmd/odek/file_tool.go`, `cmd/odek/perf_tools.go`) — the post-replacement result is capped at 10 MiB so `ReplaceAll` cannot explode memory.
+- **write_file content cap** (`cmd/odek/file_tool.go`) — the `content` argument is capped at 1 MiB to prevent disk exhaustion and memory pressure from a single enormous tool call.
+- **file_info confinement + wrapping** (`cmd/odek/file_tool.go`) — `file_info` respects the same `restrictToCWD` path confinement as `write_file`/`patch`, and the returned path is wrapped as untrusted content.
+- **WebSocket message-size cap** (`cmd/odek/serve.go`) — `odek serve` sets `MaxPayloadBytes` on every WebSocket connection so a local client cannot OOM the server with a huge frame.
+- **Session file size cap** (`internal/session/session.go`) — session files larger than 32 MiB are rejected by `Load()` to prevent OOM from tampered or corrupted transcripts.
+- **Skill file size cap** (`internal/skills/loader.go`) — `SKILL.md` files larger than 1 MiB are skipped so a malicious project cannot OOM the process at startup or bloat the system prompt.
 - **Serve sandbox default-on** — `odek serve` enables `--sandbox` automatically unless `--no-sandbox` is passed.
 - **Secret redaction** (`internal/redact/redact.go`) — 20+ patterns: OpenAI, Anthropic, GitHub PAT, AWS, PEM, JWT, Vault, Google OAuth, SendGrid, Discord, DB URLs, etc.
 

cmd/odek/file_tool.go

@@ -25,6 +25,10 @@ const maxLines = 2000
 // memory exhaustion from huge files.
 const maxReadBytes = 1 << 20 // 1 MiB
 
+// maxWriteFileContentBytes caps the content argument of write_file to prevent
+// disk exhaustion and memory pressure from a single enormous tool call.
+const maxWriteFileContentBytes = maxReadBytes // 1 MiB
+
 // maxSearchLimit caps the number of matches returned by search_files to
 // prevent unbounded result JSON from exhausting memory.
 const maxSearchLimit = 500
@@ -215,6 +219,9 @@ func (t *writeFileTool) Call(argsJSON string) (string, error) {
 	if args.Path == "" {
 		return jsonError("path is required")
 	}
+	if len(args.Content) > maxWriteFileContentBytes {
+		return jsonError(fmt.Sprintf("content too large (%d bytes, max %d)", len(args.Content), maxWriteFileContentBytes))
+	}
 
 	// Path confinement: when restrictToCWD is enabled, reject paths that
 	// escape the working directory via ".." traversal or absolute paths.
@@ -1314,6 +1321,7 @@ func (t *globTool) Call(argsJSON string) (result string, err error) {
 
 type fileInfoTool struct {
 	dangerousConfig danger.DangerousConfig
+	restrictToCWD   bool // when true, reject paths escaping the working directory
 }
 
 func (t *fileInfoTool) Name() string { return "file_info" }
@@ -1368,6 +1376,16 @@ func (t *fileInfoTool) Call(argsJSON string) (result string, err error) {
 		return jsonError("path is required")
 	}
 
+	// Path confinement: when restrictToCWD is enabled, reject paths that
+	// escape the working directory via ".." traversal or absolute paths.
+	if t.restrictToCWD {
+		resolved, err := confineToCWD(args.Path)
+		if err != nil {
+			return jsonError(err.Error())
+		}
+		args.Path = resolved
+	}
+
 	// Security: classify path
 	risk := danger.ClassifyPath(args.Path)
 	if err := t.dangerousConfig.CheckOperation(danger.ToolOperation{
@@ -1401,6 +1419,10 @@ func (t *fileInfoTool) Call(argsJSON string) (result string, err error) {
 		IsRegular: lInfo.Mode().IsRegular(),
 	}
 
+	// file_info output originates from the filesystem trust boundary, so
+	// mark the returned path as untrusted.
+	fi.Path = wrapUntrusted("file_info:"+args.Path, fi.Path)
+
 	return jsonResult(fi)
 }
 

cmd/odek/main.go

@@ -1140,7 +1140,7 @@ func builtinTools(dc danger.DangerousConfig, sm *skills.SkillManager, approver d
 		&patchTool{dangerousConfig: dc, restrictToCWD: true},
 		&batchReadTool{dangerousConfig: dc},
 		&globTool{dangerousConfig: dc},
-		&fileInfoTool{dangerousConfig: dc},
+		&fileInfoTool{dangerousConfig: dc, restrictToCWD: true},
 		&batchPatchTool{dangerousConfig: dc, restrictToCWD: true},
 		&parallelShellTool{dangerousConfig: dc, approver: approver},
 		newHTTPBatchTool(dc),

cmd/odek/next_security_vulnerabilities_test.go

@@ -16,6 +16,7 @@ import (
 	"github.com/BackendStack21/odek/internal/llm"
 	"github.com/BackendStack21/odek/internal/resource"
 	"github.com/BackendStack21/odek/internal/session"
+	"github.com/BackendStack21/odek/internal/skills"
 )
 
 // ── 1. Browser history must be capped to avoid memory DoS ────────────────
@@ -801,3 +802,101 @@ func TestBatchPatch_RejectsOutputExpansion(t *testing.T) {
 		t.Fatalf("expected size error, got: %q", r.Results[0].Error)
 	}
 }
+
+// ── 21. write_file must cap content size to prevent DoS / disk exhaustion ─
+
+func TestWriteFile_CapsContentSize(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "out.txt")
+	huge := strings.Repeat("x", maxWriteFileContentBytes+1)
+
+	tool := &writeFileTool{}
+	result := callJSON(t, tool, fmt.Sprintf(`{"path":%q,"content":%q}`, path, huge))
+	var r struct {
+		Success bool   `json:"success"`
+		Error   string `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Success {
+		t.Fatal("write_file should reject content above maxWriteFileContentBytes")
+	}
+	if !strings.Contains(r.Error, "too large") {
+		t.Fatalf("expected size error, got: %q", r.Error)
+	}
+}
+
+// ── 22. file_info must respect restrictToCWD and wrap its output ──────────
+
+func TestFileInfo_RestrictToCWD(t *testing.T) {
+	tool := &fileInfoTool{restrictToCWD: true}
+	result := callJSON(t, tool, `{"path":"/etc/passwd"}`)
+	var r struct {
+		Error string `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Error == "" {
+		t.Fatal("file_info with restrictToCWD=true should reject paths outside CWD")
+	}
+}
+
+func TestFileInfo_WrapsPath(t *testing.T) {
+	t.Chdir(t.TempDir())
+	os.WriteFile("target.txt", []byte("hello"), 0644)
+
+	tool := &fileInfoTool{restrictToCWD: true}
+	result := callJSON(t, tool, `{"path":"target.txt"}`)
+	var r struct {
+		Path  string `json:"path"`
+		Error string `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Error != "" {
+		t.Fatalf("unexpected error: %s", r.Error)
+	}
+	if !strings.HasPrefix(r.Path, "<untrusted_content_") {
+		t.Fatalf("file_info path should be wrapped in untrusted_content, got: %q", r.Path)
+	}
+}
+
+// ── 23. session store Load must reject huge session files ─────────────────
+
+func TestSessionLoad_CapsFileSize(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	store, err := session.NewStore()
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+
+	sessID := "20260613-abc123"
+	sessPath := store.Path(sessID)
+	if err := os.MkdirAll(filepath.Dir(sessPath), 0755); err != nil {
+		t.Fatal(err)
+	}
+	// Write a session file that exceeds the cap.
+	os.WriteFile(sessPath, []byte(strings.Repeat("x", session.MaxSessionFileBytes+1)), 0600)
+
+	_, err = store.Load(sessID)
+	if err == nil {
+		t.Fatal("session Load should reject a huge session file")
+	}
+	if !strings.Contains(err.Error(), "too large") {
+		t.Fatalf("expected size error, got: %v", err)
+	}
+}
+
+// ── 24. skill loader must reject huge SKILL.md files ──────────────────────
+
+func TestSkillLoader_CapsFileSize(t *testing.T) {
+	projectDir := filepath.Join(t.TempDir(), ".odek", "skills")
+	skillDir := filepath.Join(projectDir, "bigskill")
+	if err := os.MkdirAll(skillDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	// Write a SKILL.md larger than the cap (no valid frontmatter needed).
+	os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(strings.Repeat("x", skills.MaxSkillFileBytes+1)), 0644)
+
+	result := skills.ScanDirs(projectDir, "", nil)
+	if len(result.AutoLoad)+len(result.Lazy) != 0 {
+		t.Fatalf("skill loader should reject a huge SKILL.md, got %d skills", len(result.AutoLoad)+len(result.Lazy))
+	}
+}

cmd/odek/serve.go

@@ -32,6 +32,11 @@ import (
 //go:embed ui
 var uiFS embed.FS
 
+// maxWSMessageBytes caps the size of an incoming WebSocket text message.
+// This prevents a local client from exhausting server memory by sending a
+// multi-gigabyte frame.
+const maxWSMessageBytes = 8 * 1024 * 1024 // 8 MiB
+
 // currentPromptCancel holds the cancel function for the currently executing
 // prompt. Used by the POST /api/cancel endpoint to abort a running agent.
 var currentPromptCancel atomic.Value
@@ -457,6 +462,10 @@ func handleWS(store *session.Store, resources *resource.Registry, resolved confi
 	}()
 	defer conn.Close()
 
+	// Cap incoming message size to prevent a local client from exhausting
+	// server memory with a single huge frame.
+	conn.MaxPayloadBytes = maxWSMessageBytes
+
 	// Create ONE agent per WebSocket connection — provides buffer
 	// continuity across turns within the same session.
 	agent, sandboxCleanup, mcpCleanup, approver, err := newServeAgent(resolved, system, func(v any) error {

cmd/odek/serve_test.go

@@ -113,6 +113,7 @@ func (s *testServer) handleResourceSearch() http.HandlerFunc {
 }
 
 func (s *testServer) handleWebSocket(conn *golangws.Conn) {
+	conn.MaxPayloadBytes = maxWSMessageBytes
 	defer conn.Close()
 
 	for {
@@ -1717,3 +1718,41 @@ func TestServe_E2E_CancelWithMockLLM(t *testing.T) {
 		t.Log("No terminal event (connection may have been closed by cancel)")
 	}
 }
+
+// TestServe_WebSocketMaxPayload verifies that the WebSocket endpoint rejects
+// incoming messages larger than maxWSMessageBytes to prevent memory DoS.
+func TestServe_WebSocketMaxPayload(t *testing.T) {
+	s := startTestServer(t)
+	defer s.Close()
+
+	conn, err := golangws.Dial(s.wsURL+"/ws", "", "http://localhost")
+	if err != nil {
+		t.Fatalf("Dial(): %v", err)
+	}
+	defer conn.Close()
+
+	// First confirm a normal message works.
+	if err := golangws.Message.Send(conn, `{"type":"prompt","content":"hi"}`); err != nil {
+		t.Fatalf("Send small message: %v", err)
+	}
+	var small map[string]any
+	if err := readJSON(conn, &small); err != nil {
+		t.Fatalf("Receive small message response: %v", err)
+	}
+	if small["type"] != "session" {
+		t.Fatalf("expected session event, got %v", small["type"])
+	}
+
+	// Send a message that exceeds the payload cap.
+	huge := `{"type":"prompt","content":"` + strings.Repeat("x", int(maxWSMessageBytes)+1024) + `"}`
+	if err := golangws.Message.Send(conn, huge); err != nil {
+		// Some transports close the connection on send; that also satisfies the test.
+		return
+	}
+
+	// The next receive must fail because the server closed the connection.
+	var data []byte
+	if err := golangws.Message.Receive(conn, &data); err == nil {
+		t.Fatalf("expected connection to be closed after oversized message, but received: %s", string(data))
+	}
+}

docs/SECURITY.md

@@ -61,6 +61,7 @@ Tools that wrap:
 | `vision` | `vision:<file path>` (full description) |
 | `web_search` | `web_search:<query>` (results + answers from SearXNG) |
 | `session_search` | `session_search` (whole result — past sessions may be tainted) |
+| `file_info` | `file_info:<path>` (metadata about an external file) |
 | any MCP tool | `mcp:<server>:<tool>` |
 
 `session_search` is wrapped because it can surface content from arbitrary past sessions — including sessions that ingested untrusted content. Wrapping its whole output keeps that content from re-entering as trusted instructions and records the retrieval in the audit log, closing a path that otherwise bypassed the memory taint gate (defense 5).

internal/session/session.go

@@ -32,6 +32,11 @@ import (
 	"github.com/BackendStack21/odek/internal/redact"
 )
 
+// MaxSessionFileBytes caps the on-disk size of a session file that Load will
+// read into memory. This prevents a tampered or corrupted multi-gigabyte
+// session file from causing an OOM when any caller loads it.
+const MaxSessionFileBytes = 32 * 1024 * 1024 // 32 MiB
+
 // ── Types ──────────────────────────────────────────────────────────────
 
 // Session represents a single multi-turn conversation with the agent.
@@ -319,6 +324,13 @@ func (s *Store) Load(id string) (*Session, error) {
 	if err := ValidateSessionID(id); err != nil {
 		return nil, err
 	}
+	info, err := os.Stat(s.path(id))
+	if err != nil {
+		return nil, fmt.Errorf("session: load %q: %w", id, err)
+	}
+	if info.Size() > MaxSessionFileBytes {
+		return nil, fmt.Errorf("session: load %q: file too large (%d bytes, max %d)", id, info.Size(), MaxSessionFileBytes)
+	}
 	data, err := os.ReadFile(s.path(id))
 	if err != nil {
 		return nil, fmt.Errorf("session: load %q: %w", id, err)

internal/skills/loader.go

@@ -8,6 +8,11 @@ import (
 	"strings"
 )
 
+// MaxSkillFileBytes caps the size of a single SKILL.md file that the loader
+// will read into memory. A maliciously huge skill file could otherwise OOM
+// the process at startup or bloat the system prompt.
+const MaxSkillFileBytes = 1 * 1024 * 1024 // 1 MiB
+
 // ── Frontmatter Parsing ───────────────────────────────────────────────
 //
 // Manual YAML frontmatter parser for the SKILL.md subset:
@@ -20,6 +25,13 @@ import (
 // parseSkillFile reads and parses a single SKILL.md file.
 // Returns nil if the file doesn't exist or can't be parsed.
 func parseSkillFile(path string) *Skill {
+	info, err := os.Stat(path)
+	if err != nil {
+		return nil
+	}
+	if info.Size() > MaxSkillFileBytes {
+		return nil
+	}
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return nil