fix(security): validate session IDs and enforce private file modes

[avion23]

Summary

• Validated session header IDs and enforced canonical artifact-root containment, rejecting symlinked artifact directories. This closes the critical path traversal: a ../../.. session ID could escape session-artifacts, and agent-session prewarm could dill.load() attacker-controlled content for arbitrary code execution.
• Hardened private data writes: harness state, OAuth auth, HTML exports, kernel snapshots, imported sessions, TUI logs/debug output, and editor/share temporary files now use private directories, 0600 files, exclusive no-follow temporary files, and atomic replacement where applicable.
• Hardened auth storage reads by requiring a regular file and repairing its mode to 0600.

Evidence

Before the fix, the upstream implementation failed the new security probe:

npx tsx ../../node_modules/vitest/dist/cli.js --run test/session-manager/session-security.test.ts
# exit 1: 2 tests failed (traversal header accepted; symlinked artifact directory accepted)

After the fix:

npx tsx ../../node_modules/vitest/dist/cli.js --run test/session-manager/ test/kernel-state-snapshot.test.ts test/auth-storage.test.ts
# exit 0: 14 files, 196 tests passed
PYTHONPATH=prime-agent-runtime/src python3 -m pytest prime-agent-runtime/test/
# exit 0: 65 passed
npm run check
# exit 0

Related fork commits

• b6e4dc53
• 5095cd8b
• a5ec2444
• 2a19dd15
• 246ec844

Note

Validate session IDs and enforce private file modes across auth, session, and log paths

• Introduces SESSION_ID_PATTERN validation in session-manager.ts to reject path-traversal and malformed session IDs at all entry points (getSessionFilePath, newSession, setSessionFile, finalizeLoadedEntries).
• Adds symlink rejection and path-containment checks in getSessionArtifactPath to prevent artifact directory escapes.
• Rewrites auth file persistence in cli.ts and auth-storage.ts to use atomic writes (O_CREAT|O_EXCL|O_NOFOLLOW) with 0600 file modes and symlink rejection.
• Enforces 0700 on all session and debug directories and 0600 on all written files (JSONL, HTML exports, snapshots, debug/crash logs, TUI logs, harness state) across TypeScript and generated Python code.
• Risk: Sessions or auth files with previously permissive modes or symlinked paths will now raise errors rather than silently proceeding.

^{Macroscope summarized a923f00.}

[sethkarten]

Thank you for the report and proposed work. This root cause is now covered by maintainer-owned stacked PR #1159, authored independently from upstream/main.

We did not inspect or reuse this PR's diff, branch, commits, implementation code, or tests; its public description/comments were used only as a bug report. To keep one review surface, this PR is superseded by #1159 and is being closed.

The complete review stack is #1158–#1165. It is being left unmerged for human review after CI and review-bot findings are cleared.