fix: Resource.Search root traversal + Telegram media path allowlist

Finding #12 — Resource.Search root traversal:
- Add validateSearchQuery to reject queries containing .., path separators,
  or absolute paths.
- Migrate walkAndMatch from filepath.Walk to filepath.WalkDir.
- Skip symlinked directories/files during traversal.
- Verify every match is withinRoot before returning it.
- Add regression tests for traversal and symlink skipping.

Finding #13 — Telegram media upload path traversal:
- Add internal/telegram/media_path.go with ResolveMediaPath, which restricts
  outbound media to cwd, ~/.odek/media, and os.TempDir().
- Reject symlinks and paths outside the allowlist.
- Apply ResolveMediaPath in internal/telegram/handler.go sendMedia,
  cmd/odek/telegram.go sendTelegramMedia, and internal/tool/send_message.go.
- send_message file argument must be absolute and pass allowlist checks.
- Add regression tests for allowed/rejected/symlink paths.
- Update docs/TELEGRAM.md, docs/SECURITY.md, and AGENTS.md.

Author: jkyberneees

AGENTS.md

@@ -116,7 +116,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **@-resource / --ctx prompt wrapping** (`cmd/odek/refs.go`, `cmd/odek/serve.go`) — content resolved from `@file` references and `--ctx` files is wrapped as untrusted before being inserted into the prompt.
 - **Config file size cap** (`internal/config/loader.go`) — `~/.odek/config.json` and `./odek.json` are rejected if larger than 5 MiB to prevent OOM from a malicious or broken config at startup.
 - **Resource resolver size cap** (`internal/resource/resource.go`) — `@-resource` file loads are capped at 1 MiB to prevent OOM from `@hugefile` references.
-- **Resource resolver symlink hardening** (`internal/resource/resource.go`) — `FileResolver.Search` uses `os.Lstat` (not `os.Stat`) for search-result metadata, so symlinks cannot leak the size of arbitrary targets outside the workspace.
+- **Resource resolver search hardening** (`internal/resource/resource.go`) — `FileResolver.Search` rejects queries containing `..`, path separators, or absolute components before joining them with the workspace root, and uses `filepath.WalkDir` so directory symlinks are not followed during recursive autocomplete. `os.Lstat` (not `os.Stat`) is used for search-result metadata, so symlinks cannot leak the size of arbitrary targets outside the workspace.
 - **Sub-agent summary cap + wrapping** (`cmd/odek/subagent_tool.go`) — each sub-agent result included in the `delegate_tasks` summary is truncated to 100 KiB to prevent memory DoS, and the final aggregated summary is wrapped as untrusted content so a compromised sub-agent cannot inject instructions into the parent context.
 - **Tree path wrapping** (`cmd/odek/perf_tools.go`) — the `tree` tool wraps every filesystem-derived path as untrusted content.
 - **head_tail output cap** (`cmd/odek/perf_tools.go`) — `head_tail` truncates returned lines so total content stays within 1 MiB, preventing multi-file/multi-line memory DoS.
@@ -138,6 +138,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **Telegram singleton flock lock** (`cmd/odek/telegram.go` + `internal/flock`) — the Telegram bot now uses an advisory `flock` on `~/.odek/telegram.lock` instead of a PID file probed with signals. This removes the non-Linux path where a planted PID could cause odek to kill an arbitrary process.
 - **Telegram photo caption wrapping** (`cmd/odek/telegram.go`) — photo captions cross the Telegram trust boundary, so they are wrapped as untrusted content both when passed to the local vision model and when injected into the main agent's user message.
 - **`send_message` callback prefix restriction** (`internal/tool/send_message.go` + `cmd/odek/telegram.go`) — the `send_message` tool rejects any button whose `callback_data` starts with a reserved internal prefix (`apr:`, `den:`, `trs:`, `clarify:`, `skill_save:`, `skill_skip:`); only user-facing `cb:` callbacks are allowed. The Telegram sender closure validates again as defense-in-depth, preventing a forged approval or skill button.
+- **Telegram outbound media path allowlist** (`internal/telegram/media_path.go` + `internal/telegram/handler.go` + `internal/tool/send_message.go` + `cmd/odek/telegram.go`) — paths supplied to `MEDIA:...` prefixes or `send_message(file=...)` are resolved to an absolute path and verified against an allowlist (cwd, `~/.odek/media/`, system temp dir). `os.Lstat` rejects symlink final components and `filepath.EvalSymlinks` ensures the resolved path does not escape the allowlist, preventing prompt-injection-driven exfiltration of arbitrary files.
 - **Session ID entropy + session-scoped auth tokens** (`internal/session/session.go`, `cmd/odek/serve.go`) — session IDs now carry 128 bits of randomness (16 bytes / 32 hex chars); each session stores a 256-bit `AuthToken` required by `GET/DELETE/POST /api/sessions/<id>` and WebSocket session-resume messages via `X-Session-Token` header, `session_token` cookie, or `auth_token` WS field. Per-IP rate limiting (60/min) on session lookups adds a brute-force backstop.
 - **Skill/episode untrusted wrapper** (`internal/loop/loop.go` + `odek.go`) — skill context and retrieved session-episode context are passed through the caller-provided untrusted wrapper (the same nonce'd `<untrusted_content_*>` boundary used for tool output) before being injected into the model's system context. This prevents a compromised or tainted skill/episode from being treated as trusted system instructions.
 - **Secret redaction** (`internal/redact/redact.go`) — 20+ patterns: OpenAI, Anthropic, GitHub PAT, AWS, PEM, JWT, Vault, Google OAuth, SendGrid, Discord, DB URLs, etc.

cmd/odek/telegram.go

@@ -1477,12 +1477,12 @@ func handleChatMessage(
 		SystemMessage:    systemMessage,
 		UntrustedWrapper: wrapUntrusted,
 		RuntimeContext:   odek.BuildRuntimeContext("telegram"),
-		InteractionMode: resolved.InteractionMode,
-		NoProjectFile:   resolved.NoAgents,
-		Skills:          skillsCfg,
-		Thinking:        resolved.Thinking,
-		Tools:           agentTools,
-		Renderer:        rend,
+		InteractionMode:  resolved.InteractionMode,
+		NoProjectFile:    resolved.NoAgents,
+		Skills:           skillsCfg,
+		Thinking:         resolved.Thinking,
+		Tools:            agentTools,
+		Renderer:         rend,
 		ToolEventHandler: func(event string, name string, data string) {
 			// Enhance mode: send new messages with narrated descriptions.
 			if isEnhance {
@@ -2130,6 +2130,12 @@ func mediaTypeFromExt(path string) string {
 // sendTelegramMedia sends a file as a Telegram media message with caption
 // and optional inline keyboard. Detects the media type from file extension.
 func sendTelegramMedia(bot *telegram.Bot, chatID int64, mediaType, path, caption string, buttons [][]map[string]string) error {
+	// Defense-in-depth: validate the path against the media allowlist.
+	resolved, err := telegram.ResolveMediaPath(path)
+	if err != nil {
+		return fmt.Errorf("telegram media: %w", err)
+	}
+
 	var replyMarkup *telegram.InlineKeyboardMarkup
 	if len(buttons) > 0 {
 		replyMarkup = buttonsToMarkup(buttons)
@@ -2140,13 +2146,13 @@ func sendTelegramMedia(bot *telegram.Bot, chatID int64, mediaType, path, caption
 	}
 	switch mediaType {
 	case "photo":
-		_, err := bot.SendPhoto(chatID, path, caption, opts)
+		_, err := bot.SendPhoto(chatID, resolved, caption, opts)
 		return err
 	case "voice":
-		_, err := bot.SendVoice(chatID, path, caption, opts)
+		_, err := bot.SendVoice(chatID, resolved, caption, opts)
 		return err
 	default:
-		_, err := bot.SendDocument(chatID, path, caption, opts)
+		_, err := bot.SendDocument(chatID, resolved, caption, opts)
 		return err
 	}
 }

docs/SECURITY.md

@@ -74,7 +74,7 @@ The MCP wrapper guards a tool's **output**. The server-supplied tool **descripti
 
 The model is instructed (via the default system prompt) to treat the wrapped region as data, not instructions. A model trained on prompt-injection resistance (Claude Sonnet 4.6+ does this well) honours the boundary. Older models or aggressively fine-tuned ones may not.
 
-Two additional boundaries keep filesystem-derived metadata from leaking as "trusted" context. First, the `base64` tool wraps encoded output when reading from a file path, so even transformed filesystem bytes stay inside an untrusted boundary. Second, the `@`-resource resolver (`FileResolver.Search`) uses `os.Lstat` when building search-result metadata, which prevents a symlink inside the workspace from leaking the size (or other `stat` metadata) of an arbitrary target outside it.
+Two additional boundaries keep filesystem-derived metadata from leaking as "trusted" context. First, the `base64` tool wraps encoded output when reading from a file path, so even transformed filesystem bytes stay inside an untrusted boundary. Second, the `@`-resource resolver (`FileResolver.Search`) rejects queries containing `..`, path separators, or absolute components before joining them with the workspace root, and uses `filepath.WalkDir` (which does not follow symlinks) for recursive autocomplete; `os.Lstat` is used when building search-result metadata, which prevents a symlink inside the workspace from leaking the size (or other `stat` metadata) of an arbitrary target outside it.
 
 ### 3. Danger classifier (shell)
 
@@ -324,7 +324,17 @@ The Telegram bot previously used a PID file at `~/.odek/telegram.pid` to enforce
 
 The `send_message` tool lets the agent send inline keyboard buttons. Each button's `callback_data` is validated by the tool and again by the Telegram sender closure: any value that starts with a reserved internal prefix (`apr:`, `den:`, `trs:`, `clarify:`, `skill_save:`, `skill_skip:`) is rejected. Only user-facing `cb:` callbacks are allowed. This prevents a compromised or prompt-injected agent from presenting a button that, when clicked, would forge an approval decision or trigger a skill action.
 
-### 23. Session ID entropy + session-scoped auth tokens
+### 23. Telegram outbound media path allowlist
+
+When the agent emits `MEDIA:photo:/path`, `MEDIA:voice:/path`, `MEDIA:document:/path`, or `send_message` with a `file`, the path is validated by `internal/telegram.ResolveMediaPath` before upload. Only paths inside an allowed base directory are permitted:
+
+- the current working directory,
+- `~/.odek/media/`, and
+- the system temporary directory.
+
+The path is resolved to an absolute, cleaned form with `filepath.Abs`, symlinks are resolved with `filepath.EvalSymlinks`, and the final component is checked with `os.Lstat`. If the final component is a symlink, or if the resolved path escapes the allowlist, the upload is rejected. This closes the arbitrary-file-read/exfiltration vector where a prompt-injected agent asks the bot to send files such as `/home/user/.ssh/id_rsa`.
+
+### 24. Session ID entropy + session-scoped auth tokens
 
 `odek serve` session endpoints were previously protected only by localhost binding and a short, predictable session ID (`YYYYMMDD-` + 3 random bytes ≈ 16.7 M possibilities). A local attacker who obtained IDs from `GET /api/sessions` could brute-force `GET /api/sessions/<id>` to read transcripts.
 
@@ -336,7 +346,7 @@ The defense has three layers:
 
 Legacy sessions created before this defense have no `AuthToken`; the first access bootstraps one and returns it to the client, preserving backward compatibility without weakening protection for newly created sessions.
 
-### 24. Skill and episode context wrapped as untrusted
+### 25. Skill and episode context wrapped as untrusted
 
 Skill content and retrieved session episodes are externally-sourced data that cross the trust boundary. Before injecting them as `system` messages, the loop passes them through the same nonce'd `<untrusted_content_*>` wrapper used for tool output. The skill manager already gates `NeedsReview`/tainted skills, and the memory manager filters tainted episodes from search, but the wrapper provides defense-in-depth so a compromised skill or episode cannot pose as trusted system instructions.
 
@@ -389,6 +399,7 @@ Defaults: `FrictionThreshold=3`, `FrictionWindow=60s`. To opt out (TTYApprover o
 | Local process brute-forces session IDs to read transcripts | 128-bit IDs + session-scoped auth tokens + per-IP rate limiting |
 | Telegram bot scanned by random user | Allowlist enforced before any tool call |
 | Agent sends fake approval/skill button via `send_message` | Reserved internal callback prefixes rejected; only `cb:` allowed |
+| Agent exfiltrates arbitrary file via Telegram media | Outbound paths restricted to cwd, `~/.odek/media/`, and temp dir; symlinks rejected |
 | Auto-saved skill auto-activates on next session | Provenance gate pins NeedsReview skills to Lazy |
 | Memory replays a previously-injected episode forever | Tainted episodes filtered from `Search` |
 | User reflex-approves a destructive class after many benign ones | Friction mode requires typed `approve` + 1.5 s pause |

docs/TELEGRAM.md

@@ -206,6 +206,15 @@ All callbacks return a response string (may be empty) and an error. The `Handle`
 
 The handler uses `sync.Map` for `TelegramApprover` instances, keyed by `chatID`. This allows the agent to send inline keyboard approval requests (yes/no) and receive responses via callback queries. The handler intercepts callback queries matching pending approval requests before dispatching to `OnCallbackQuery`.
 
+### Outbound Media
+
+The agent can send files back to the chat either by emitting a `MEDIA:` prefix in its final answer (`MEDIA:photo:/path`, `MEDIA:voice:/path`, `MEDIA:document:/path`) or by calling `send_message` with the `file` parameter. Before any upload, the path is validated by `internal/telegram.ResolveMediaPath`:
+
+- Allowed directories: current working directory, `~/.odek/media/`, and the system temporary directory.
+- The path is resolved to an absolute, cleaned form and checked against the allowlist.
+- Symlinks are rejected: the final component is verified with `os.Lstat` and the resolved path must not escape the allowlist.
+- Files outside the allowlist (e.g. `/home/user/.ssh/id_rsa`) are refused, closing prompt-injection-driven exfiltration.
+
 ## Slash Commands (`commands.go`)
 
 ### Built-in Commands

internal/resource/resource.go

@@ -211,6 +211,12 @@ func (f *FileResolver) Search(ctx context.Context, query string, limit int) ([]R
 		return nil, nil
 	}
 
+	// Reject traversal attempts before touching the filesystem. A query is a
+	// bare filename/prefix for autocomplete, not a path expression.
+	if err := validateSearchQuery(query); err != nil {
+		return nil, err
+	}
+
 	// Try exact match first
 	pattern := filepath.Join(f.root, query)
 	matches, err := filepath.Glob(pattern + "*")
@@ -223,11 +229,7 @@ func (f *FileResolver) Search(ctx context.Context, query string, limit int) ([]R
 		matches = f.walkAndMatch(query)
 	}
 
-	// Resolve the root once so every match can be confined to it. A query
-	// such as "../../etc/passwd" makes filepath.Join above clean to a path
-	// outside root, and filepath.Glob would then match files the workspace
-	// must not expose. Skip any match that escapes root before touching the
-	// filesystem (closes CodeQL "uncontrolled data in path expression").
+	// Resolve the root once so every match can be confined to it.
 	absRoot, err := filepath.Abs(f.root)
 	if err != nil {
 		return nil, nil
@@ -261,6 +263,21 @@ func (f *FileResolver) Search(ctx context.Context, query string, limit int) ([]R
 	return resources, nil
 }
 
+// validateSearchQuery rejects queries that could escape the configured root.
+// Search queries are autocomplete prefixes, not filesystem paths.
+func validateSearchQuery(query string) error {
+	if filepath.IsAbs(query) {
+		return fmt.Errorf("resource: search query must not be an absolute path")
+	}
+	if strings.Contains(query, "..") {
+		return fmt.Errorf("resource: search query must not contain parent references")
+	}
+	if strings.ContainsAny(query, "/\\") {
+		return fmt.Errorf("resource: search query must not contain path separators")
+	}
+	return nil
+}
+
 func (f *FileResolver) Load(ctx context.Context, id string) (string, error) {
 	// id is the path after @ (e.g. "src/main.go")
 	target := filepath.Join(f.root, id)
@@ -312,17 +329,21 @@ func (f *FileResolver) walkAndMatch(searchTerm string) []string {
 	base := f.root
 
 	var results []string
-	filepath.Walk(base, func(path string, info os.FileInfo, err error) error {
+	filepath.WalkDir(base, func(path string, d os.DirEntry, err error) error {
 		if err != nil {
 			return nil
 		}
 		// Skip symlinks — resource resolver uses O_NOFOLLOW on Load,
-		// so symlinks are unreadable anyway.
-		if info.Mode()&os.ModeSymlink != 0 {
+		// so symlinks are unreadable anyway. Skip symlinked directories
+		// entirely so traversal cannot follow them.
+		if d.Type()&os.ModeSymlink != 0 {
+			if d.IsDir() {
+				return filepath.SkipDir
+			}
 			return nil
 		}
-		if info.IsDir() {
-			if skipDir(info.Name()) {
+		if d.IsDir() {
+			if skipDir(d.Name()) {
 				return filepath.SkipDir
 			}
 			return nil

internal/resource/resource_test.go

@@ -224,7 +224,8 @@ func TestFileResolver_SearchRecursive(t *testing.T) {
 
 func TestFileResolver_SearchOutsideRoot(t *testing.T) {
 	// Parent holds a sentinel file; root is a subdirectory of it. A traversal
-	// query must not surface metadata for files outside root.
+	// query must be rejected outright rather than surface metadata for files
+	// outside root.
 	parent := t.TempDir()
 	if err := os.WriteFile(filepath.Join(parent, "secret.txt"), []byte("top secret"), 0644); err != nil {
 		t.Fatal(err)
@@ -235,13 +236,51 @@ func TestFileResolver_SearchOutsideRoot(t *testing.T) {
 	}
 	res := NewFileResolver(root)
 
-	results, err := res.Search(context.Background(), "../secret", 10)
+	_, err := res.Search(context.Background(), "../secret", 10)
+	if err == nil {
+		t.Fatal("expected Search() to reject traversal query")
+	}
+}
+
+func TestFileResolver_Search_AbsoluteQueryRejected(t *testing.T) {
+	dir := newTestDir(t)
+	res := NewFileResolver(dir)
+
+	_, err := res.Search(context.Background(), "/etc/passwd", 10)
+	if err == nil {
+		t.Fatal("expected Search() to reject absolute query")
+	}
+}
+
+func TestFileResolver_Search_PathSeparatorQueryRejected(t *testing.T) {
+	dir := newTestDir(t)
+	res := NewFileResolver(dir)
+
+	_, err := res.Search(context.Background(), "subdir/deep", 10)
+	if err == nil {
+		t.Fatal("expected Search() to reject query containing path separators")
+	}
+}
+
+func TestFileResolver_Search_SymlinkedDirectoryNotFollowed(t *testing.T) {
+	workspace := t.TempDir()
+	outside := t.TempDir()
+	if err := os.WriteFile(filepath.Join(outside, "secret.txt"), []byte("secret"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(workspace, "link")
+	if err := os.Symlink(outside, link); err != nil {
+		t.Fatal(err)
+	}
+
+	resolver := NewFileResolver(workspace)
+	results, err := resolver.Search(context.Background(), "secret", 10)
 	if err != nil {
-		t.Fatalf("Search() error: %v", err)
+		t.Fatalf("Search failed: %v", err)
 	}
 	for _, r := range results {
-		if strings.Contains(r.Label, "secret") || strings.Contains(r.ID, "secret") {
-			t.Fatalf("traversal query leaked file outside root: %+v", r)
+		if strings.Contains(r.Label, "secret") {
+			t.Fatalf("search followed symlinked directory: %+v", r)
 		}
 	}
 }