fix: 81 validated findings from the 2026-10-11 bug hunt

[jkyberneees]

Summary

Fixes the 2026-10-11 bug hunt at 3e3ee53: eight area hunters each wrote a failing TestRED_* test per finding, and an independent Haiku agent replayed and adversarially validated every one. 82 findings → 69 confirmed, 12 plausible, 1 rejected (a leading / in Telegram is the documented command convention). All 81 remaining findings are fixed, one commit per finding, each with its RED test kept as the regression test.

Every area then got an adversarial Sonnet review of its fix branch; every real issue those reviews found is fixed in follow-up commits on this branch (listed below).

High severity

• Danger classifier: git grep -O, git send-email --smtp-server=<prog>/--sendmail-cmd, sqlite3 pipe dot-commands / edit() / .shell on stdin, zip -m / 7z -sdel, and alias (now tracked by use: a later command that names an alias is classified as its expansion) were all under-classified.
• Telegram: the daily token budget stopped being enforced once one run overshot it.
• Serve: MCP server processes leaked on every reconnect when sandbox setup failed.
• Redaction: AWS SecretAccessKey/SessionToken were not redacted.

By area

Area	Findings	Highlights
danger	13	git credential/gpg secret exports → system_write; sqlite writefile()/VACUUM INTO/write dot-commands are write targets; recursive chmod/compress and mv of $HOME → system_write; git apply --unsafe-paths, format-patch -o
loop	8	tool defs sorted for a stable prompt-cache prefix; batch denial / budget-skipped calls no longer corrupt plan checks; check_replace can no longer write a plan the resume parser drops; quote-aware argv0
memory/session	10	audit log redacted; corrupt index.json rebuilt from session files; symlink-escape episode taint; stale episode index; unsafe merged facts; rerank actually applied; embedder refit race; quarantine listing sanitized
telegram/schedule	10	budget overshoot recorded (and failed/cancelled turns billed); bg exit posted once; MarkdownV2 escaping of \, lone */backtick; commands split on any whitespace; re-enable no longer fires a catch-up run
serve	9	approval expiry clears REST runs; shutdown cancels REST runs and refuses late admissions; serve honours trusted sandbox opt-outs; post-cancel approvals deny immediately; /api/jobs and bg_job redact before truncating
tools	10	config_view accepts real argument JSON; http_request with mutating methods/credential headers → network_upload; patch diff/CRLF; symlinked search roots; ** char classes; json_query chained indices; diff trailing newline; bgproc 143/137 after stop
config/skills/MCP	10	planning.remind merged; secrets.env tab comments; MCP Mcp-Session-Id (dropped on cross-host redirect), notifications/initialized on stdio, ping replies on a separate bounded queue; REPL escape sequences; project skill promote requires --force; unknown trust_level fails closed; file:// refs percent-encoded
ops	11	redaction of Basic auth, JSON Bearer headers, refresh_token, X-Amz-Security-Token, deterministic longest-first known-value replacement (with a bounded Basic-auth pass); PKCS#8 key detection; cleanup dry-run shares the real sweep's rules; audit source match on path boundaries; quarantined audit copies age out

Behaviour changes worth noting

• odek serve --no-sandbox with ODEK_REQUIRE_SANDBOX=1 now refuses to start (matches run).
• sqlite3 db < schema.sql and … | sqlite3 db now prompt (stdin content cannot be scanned at classification time).
• An alias definition followed by a use is classified by the expansion (e.g. alias dc="docker compose"; dc up prompts).
• Existing tests that pinned buggy behaviour were updated (noted in each commit body): subagent trust fail-open case, a vacuous REPL editor test, TestRecallRerank, three browser URL tests, TestEscapeMarkdown_AllReservedChars, TestWithHTTPClientInjectsTransport.

Review follow-ups (adversarial Sonnet review per area)

• loop, tools: no issues.
• serve: shutdown admission race closed (late runs refused with 503).
• ops: Basic-auth pass bounded back to main's throughput; X-Amz-Security-Token added.
• config: short-keyword plural matching restored; session id stripped on cross-host redirect; ping flood can't starve requests.
• telegram: lone-backtick regression, overshoot warning delivery, billing of failed runs.
• memory: unsafe merge stores the new fact separately instead of dropping it.
• danger: two review rounds — alias tracking redesigned from definition-time to use-time, gpg --export-secret-ssh-key, sqlite literal-only write paths and SQL comment/newline normalisation, piped sqlite write dot-commands, then time prefixes, nested-guard scoping, .o/.trace, writefile newline and quoted schema names.

Coverage (before → after, per touched package)

Package	Before	After
cmd/odek	73.1%	74.0%+ (each area raised it)
internal/danger	92.20%	92.39%
internal/loop	93.6%	93.8%
internal/redact	92.7%	94.8%
internal/mcpclient	94.6%	95.9%
internal/telegram	90.2%	91.0%
internal/schedule	97.0%	97.2%
internal/guard	83.9%	84.3%
internal/maintenance	95.7%	95.9%
internal/runtimelog	88.7%	89.0%
internal/config	85.9%	86.1%
internal/memory	84.9%	85.0%
internal/memory/extended	90.8%	90.9%
internal/session	90.3%	90.4%
internal/artifact	91.0%	91.1%
internal/skills	91.2%	91.2%
internal/bgproc	88.5%	88.5%

Test plan

• go build ./..., go vet ./..., gofmt -l clean
• go test -count=1 on every package; internal/danger with HOME=/home/user
• go test -race on every changed package
• danger fuzz targets (20s each) per fix round
• ODEK_E2E=true … -run TestMCPClientE2E_
• CI (test, lint, vuln, ui-js, CodeQL)
• Opus full-branch adversarial review — one low issue (audit source match after the cross-area merge collapsed distinct token URLs via redaction); fixed in two commits with regression tests, each re-reviewed (second re-review: no issues)

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	odek	ee63ac2	Commit Preview URL Branch Preview URL	Oct 11 2026, 10:55 AM