[jkyberneees]

Bug-hunt round across every package: functional and security defects found by parallel audits, each fixed with a regression test, then put through several rounds of adversarial review and an end-to-end run against a real odek serve.

Security

• Terminal escape injection: remaining raw sinks now sanitized (panel status line quoting HTTP bodies, sub-agent result status, plan step status, session/run ids). sanitize() no longer lets invalid UTF-8 (raw 0x9b/0x9d 8-bit CSI/OSC) through its fast path and strips more invisibles (U+061C, U+180E, U+2061–2064, U+FFF9–FFFB, tag block).
• Path traversal: export filenames map wire session ids to [A-Za-z0-9._-].
• Token leak on redirect: authenticated REST clients refuse redirects (Go copies X-Odek-Ws-Token / X-Session-Token across hosts).
• Unbounded reads: every REST JSON decode and the release-metadata decode are size-capped; /attach rejects FIFOs and devices (/dev/zero froze the UI and blocked quit) and vets the opened descriptor.
• Symlink exfiltration: persisted attachments are stored resolved and never silently re-attached once a symlink appears along the path.
• Permissions / PID reuse: ~/.bodek is 0700; leader signalling goes through Process.Signal; the watchdog identifies the parent by start time.

Process lifecycle

• A failing log sink no longer kills odek serve via SIGPIPE; WaitDelay bounds Stop when a grandchild holds stderr; stderr partial lines are capped.
• A second Ctrl+C / SIGTERM can abort a slow shutdown, and the orphan watchdog stays armed until odek exits.

State / data integrity

• Tokens whose save failed survive the next merge; a settings file broken mid-run is not overwritten; workspace saves persist under the lock.
• update.Newer: a release now outranks its own pseudo-version / -next builds (the existing test asserting the opposite is deliberately flipped).

TUI correctness

• Armed actions and selections stay on their target across refreshes (runs tab, /queue drain, memory facts incl. duplicate text, sessions list/search/delete, palette).
• Session resume is refused while a turn runs (documented in README/AGENTS.md); --resume with a persisted queue no longer loses the resume — sends wait until it lands, and /new / explicit ^R supersede it.
• One approval-expiry tick chain at a time; jobs/plan replies for a session already left are dropped; key sentinels and Alt chords are never typed into hidden inputs; expired poll timeout clamped; tool arguments shown without HTML escaping; /attach outcome notes paint immediately.

Behaviour changes to note

• Redirects on authenticated REST calls now fail with a status error instead of being followed (e.g. an http→https proxy hop).
• WebSocket frame writes have a 60s deadline (very large attachment prompts on very slow links could hit it; reconnect recovers).
• Commit-installed builds now see the upgrade hint for the release they predate.
• Subdivision flag emoji (tag characters) render as a plain black flag.
• Attachment names are the real file's basename; legacy persisted paths under a symlinked directory (e.g. macOS /tmp) are skipped once with a note.

Verification

• make fmt, make vet (darwin, linux, windows), make lint (0 issues), make test (race) all green; every commit vets on its own.
• New regression tests fail on the pre-fix code (the FIFO one hangs it).
• E2E against odek v2.34.2 in an isolated HOME via a pty driver: streaming, queueing, cancel, resume refusal mid-turn, --resume with a persisted queue, /attach guards, clean quit/SIGTERM with no orphaned odek serve, and hostile escape bytes delivered through a real tool result rendered inert.

Not addressed (need a decision)

• Release checksums are unsigned (corruption check only).
• Concurrent bodek instances share one fixed server-log path.
• ^U under an approval scrolls instead of clearing the draft (contradicts AGENTS.md).
• A bare a/d/t can answer an approval that arrived in the same frame, before it was painted.
• Transient notes are not shown on the empty first-run home screen (pre-existing).

🤖 Generated with Claude Code