docs+test(telegram): expand docs and coverage for #62, #75, #76

- docs/TELEGRAM.md: document plan size cap, O_NOFOLLOW media verification,
  and 0600 log file permissions
- internal/telegram/plan_test.go: add at-cap, MostRecentPlan oversize,
  and ListPlans preview tests
- internal/telegram/media_path_test.go: add tilde expansion and symlink-to-
  allowed-file rejection tests
- internal/telegram/log_test.go: add existing-file permission hardening test
- full suite and race detector pass

Author: jkyberneees

docs/TELEGRAM.md

@@ -166,6 +166,8 @@ for {
 }
 ```
 
+> **Log file permissions.** `telegram.NewFileLogger` creates log files with `0600` permissions (owner read/write only). Existing files created by earlier versions are also hardened to `0600` on open, so chat IDs and task snippets are not world-readable.
+
 ## Message Handler (`handler.go`)
 
 The `Handler` struct routes incoming updates to the appropriate callback based on message type. It is the bridge between raw Telegram updates and the agent.
@@ -212,7 +214,7 @@ The agent can send files back to the chat either by emitting a `MEDIA:` prefix i
 
 - Allowed directories: current working directory, `~/.odek/media/`, and the system temporary directory.
 - The path is resolved to an absolute, cleaned form and checked against the allowlist.
-- Symlinks are rejected: the final component is verified with `os.Lstat` and the resolved path must not escape the allowlist.
+- Symlinks are rejected: on Unix the final component is opened with `O_NOFOLLOW` and verified with `fstat` to close a TOCTOU race; on other platforms it is checked with `os.Lstat`. The resolved path must not escape the allowlist.
 - Files outside the allowlist (e.g. `/home/user/.ssh/id_rsa`) are refused, closing prompt-injection-driven exfiltration.
 
 ## Slash Commands (`commands.go`)
@@ -278,6 +280,13 @@ The `clarifyChannels` sync.Map provides per-chat channels for the agent to ask t
 
 Plans are stored as markdown files in `~/.odek/plans/<slug>.md`. Each plan is created from a natural language description and persisted for later review.
 
+### Size Cap
+
+To prevent a prompt-injected agent from causing an out-of-memory condition, plan files are subject to a **1 MiB** size cap:
+
+- `ReadPlan` and `MostRecentPlan` reject files larger than 1 MiB.
+- `ListPlans` only reads the first 8 KiB of each plan to generate the preview, so listing plans never loads multi-megabyte files.
+
 ### Key Functions
 
 | Function | Purpose |

internal/telegram/log_test.go

@@ -61,6 +61,28 @@ func TestNewFileLogger_filePath(t *testing.T) {
 	}
 }
 
+func TestNewFileLogger_hardensExistingFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "existing.log")
+
+	// Simulate an existing world-readable log file from an earlier version.
+	if err := os.WriteFile(path, []byte("old log\n"), 0644); err != nil {
+		t.Fatalf("create existing file: %v", err)
+	}
+
+	l := NewFileLogger(LogInfo, path)
+	fl := l.(*fileLogger)
+	fl.file.Close()
+
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("stat log file: %v", err)
+	}
+	if info.Mode().Perm()&0077 != 0 {
+		t.Errorf("existing log file permissions = %04o, want no group/other bits", info.Mode().Perm())
+	}
+}
+
 func TestNewFileLogger_invalidPath(t *testing.T) {
 	// An invalid path should fall back to stderr without panicking.
 	l := NewFileLogger(LogDebug, "/nonexistent/dir/log.log")

internal/telegram/media_path_test.go

@@ -257,3 +257,61 @@ func TestResolveMediaPath_RelativeInCWD(t *testing.T) {
 		t.Errorf("expected absolute resolved path, got %q", resolved)
 	}
 }
+
+// TestResolveMediaPath_TildeExpansion verifies that a leading ~ is expanded to
+// the home directory and resolved inside the odek media dir.
+func TestResolveMediaPath_TildeExpansion(t *testing.T) {
+	setupMediaPathTest(t)
+
+	dir, err := MediaDir()
+	if err != nil {
+		t.Fatal(err)
+	}
+	f := filepath.Join(dir, "tilde-media.txt")
+	if err := os.WriteFile(f, []byte("x"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	resolved, err := ResolveMediaPath("~/.odek/media/tilde-media.txt")
+	if err != nil {
+		t.Fatalf("ResolveMediaPath with tilde: %v", err)
+	}
+	if !filepath.IsAbs(resolved) {
+		t.Errorf("expected absolute resolved path, got %q", resolved)
+	}
+}
+
+// TestResolveMediaPath_RejectsSymlinkToAllowedFile verifies that the final
+// component being a symlink is rejected even when the symlink target is inside
+// the allowlist. This exercises the O_NOFOLLOW / lstat check.
+func TestResolveMediaPath_RejectsSymlinkToAllowedFile(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("symlink tests skipped on windows")
+	}
+
+	setupMediaPathTest(t)
+
+	cwd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Both target and link are inside the allowed cwd.
+	target := filepath.Join(cwd, "allowed-target.txt")
+	if err := os.WriteFile(target, []byte("x"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(cwd, "allowed-link.txt")
+	if err := os.Symlink(target, link); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.Remove(link) })
+
+	_, err = ResolveMediaPath(link)
+	if err == nil {
+		t.Fatal("expected rejection for symlink final component")
+	}
+	if !strings.Contains(err.Error(), "symlinks are not allowed") {
+		t.Errorf("expected 'symlinks are not allowed' in error, got: %v", err)
+	}
+}

internal/telegram/plan_test.go

@@ -199,6 +199,70 @@ func TestReadPlan_OversizeRejected(t *testing.T) {
 	}
 }
 
+func TestReadPlan_AtSizeCapAllowed(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+
+	dir := filepath.Join(tmp, ".odek", "plans")
+	os.MkdirAll(dir, 0755)
+	path := filepath.Join(dir, "max-plan.md")
+	content := strings.Repeat("x", maxPlanBytes)
+	os.WriteFile(path, []byte(content), 0644)
+
+	slug, got, err := ReadPlan("max-plan")
+	if err != nil {
+		t.Fatalf("ReadPlan at size cap: %v", err)
+	}
+	if slug != "max-plan" {
+		t.Errorf("slug = %q, want max-plan", slug)
+	}
+	if got != content {
+		t.Errorf("content length = %d, want %d", len(got), len(content))
+	}
+}
+
+func TestMostRecentPlan_OversizeRejected(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+
+	dir := filepath.Join(tmp, ".odek", "plans")
+	os.MkdirAll(dir, 0755)
+	path := filepath.Join(dir, "huge-plan.md")
+	os.WriteFile(path, []byte(strings.Repeat("x", maxPlanBytes+1)), 0644)
+
+	_, _, err := MostRecentPlan()
+	if err == nil {
+		t.Fatal("expected error for oversized most-recent plan")
+	}
+	if !strings.Contains(err.Error(), "too large") {
+		t.Errorf("error = %q, want 'too large'", err)
+	}
+}
+
+func TestListPlans_OversizePreview(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+
+	dir := filepath.Join(tmp, ".odek", "plans")
+	os.MkdirAll(dir, 0755)
+	path := filepath.Join(dir, "huge-plan.md")
+	os.WriteFile(path, []byte(strings.Repeat("x", maxPlanBytes+1)), 0644)
+
+	infos, err := ListPlans(0)
+	if err != nil {
+		t.Fatalf("ListPlans: %v", err)
+	}
+	if len(infos) != 1 {
+		t.Fatalf("len(infos) = %d, want 1", len(infos))
+	}
+	if infos[0].Slug != "huge-plan" {
+		t.Errorf("slug = %q, want huge-plan", infos[0].Slug)
+	}
+	if len(infos[0].Preview) > 100 {
+		t.Errorf("preview length = %d, expected short preview", len(infos[0].Preview))
+	}
+}
+
 func TestDeletePlan(t *testing.T) {
 	tmp := t.TempDir()
 	t.Setenv("HOME", tmp)