H10: harden Telegram outbound-media allowlist and add approval gate#57
Merged
Conversation
- ResolveMediaPath now rejects well-known secret subtrees and .env* files even when they sit inside an otherwise allowed base directory. - Added BroadBaseWarning to warn when the bot is launched from /Users/kyberneees or /. - Added TelegramApprover.PromptMedia for explicit user approval of outbound media uploads, with the broad-base warning surfaced in the prompt. - Wired the gate into Handler.sendMedia (MEDIA: prefix) and the send_message tool sender closure. - Updated affected tests and added regression tests for secret-subtree rejection, .env rejection, broad-base warning, and PromptMedia behavior. - Updated AGENTS.md and docs/SECURITY.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes H-10.
Changes
internal/telegram/media_path.go:system_writeor higher bydanger.ClassifyPath(e.g.~/.ssh,~/.aws,~/.gnupg,~/.odektrust anchors)..env(case-insensitive), even inside an allowed project directory.BroadBaseWarning()to warn when the bot is launched from$HOMEor/.internal/telegram/approver.go:PromptMedia(path), which prompts for thenetwork_egressrisk class, shows the full file path, and includes the broad-base warning when applicable.internal/telegram/handler.go:sendMedianow requires an explicit approval via the per-chat `TelegramApprover\ before resolving/uploading the file. Fails closed if no approver is registered.cmd/odek/telegram.go:send_messagetool sender closure now callsPromptMediabefore uploading any file.Tests:
.envrejection, broad-base warning, andPromptMediaapprove/deny/warning behavior.Docs:
AGENTS.mdanddocs/SECURITY.mdto describe the new gate and restrictions.Verification
go test ./... -count=1✅go test -race ./cmd/odek/ ./internal/telegram/ -count=1✅