fix: residuals of the 2026-10-13 bug hunt (classifier runners, redaction, telegram media, CLI)

[jkyberneees]

Fixes the known gaps left after the 2026-10-13 bug hunt (#322), together with the hunters' unproven notes once each was confirmed with a failing test. Each fix is RED → GREEN with a TestRED_ regression test in redres_2026_10_14_<area>_test.go.

Command classifier (internal/danger)

• Runner unwrapping: project and package runners are now classified as the command they run, even when global options come before the verb. This covers poetry, pipenv, bundle, pdm, hatch, uv, npm, yarn, pnpm, bun, fnm, tox, uvx and mise.
  • The verb is found with each tool's own option grammar. Option values (bun --cwd app exec …, npm --prefix app test) no longer hide it.
  • npm verbs are resolved the way npm does it (aliases, unambiguous prefixes, camelCase), so npm exe, npm explo and npm run-s count.
  • A -- before the verb no longer hides it.
  • npx -c, npm exec -c, pnpm exec -c, npm explore … -- and bun exec STRING command lines are classified.
  • bun --cwd app exec 'rm -rf ~' was allowed with no prompt on main; it is now denied.
• Implicit package.json scripts: yarn build, pnpm build, bun dev and pnpm --filter web build are now code_execution, like npm run build. Built-in subcommands are unchanged.
• Registry publish detection: a publish verb behind option values is detected (npm --prefix app --registry r publish).
• Unread-script gate:
  • uv|poetry|pipenv|pdm run script.py now gates the script, including paths with /.
  • Runner directory options set the directory the script is resolved against: uv --directory, poetry -C, pnpm -C|--dir, yarn --cwd, bun --cwd and mise -C. Workspace and filter selectors that can't be resolved are unknown.
• Read-licence voiding:
  • More writers void a script's read licence: decompressors, ditto, scripted vim/nvim, emacs Lisp runs (with long-option abbreviations), emacsclient -e|-a, gawk -i inplace, curl -J|-K, wget -r|-i|…, scp downloads, git merge-file/mv -f, and svn/hg verbs.
  • Fetchers void it too: aws s3, gsutil, docker|kubectl cp, rclone, gh release download, sftp, lftp, aria2c, ftp|tftp|fetch -o.
  • So do writes to globs, substitutions or unresolved variables.
  • An interactive editor run voids only the files it names.
• Package-manager settings: keys that load code (yarnPath, plugins, init-module, browser, python, globalconfig, userconfig) are persistence when set and code_execution when passed as an option on a run.
  • They count only as the package manager's own options, so yarn playwright test --browser=… is unaffected.
  • yarn plugin import and yarn set version <url|path> are persistence.
• Credentials: a nameref is judged by its own target, not by secret-shaped words elsewhere on the line.
  • Maven/Gradle credential files (~/.m2/settings*.xml, ~/.gradle/gradle.properties) are system_write.
  • npm|pnpm|yarn config get of an auth token is system_write.
• An old/new probe over about 20k test strings shows verdicts lowered only where intended: nameref lookalikes with safe targets, and runner scripts that are now gated.

Redaction (internal/redact)

• Cookie headers:
  • In Cookie and Set-Cookie headers, cookie values of 8 or more characters are redacted, except for names that mark a preference (theme, language, …).
  • Quoted values are handled.
  • Headers inside JSON or escaped text are handled.
  • Comma-folded Set-Cookie values are handled.
  • So are Set-Cookie JSON arrays, including pretty-printed and escaped ones.
  • So are setHeader|set|append('Set-Cookie'|'Cookie', …) calls and curl -b/--cookie.
  • Max-Age and other attribute variants are left as they are.
• Passwords in JSON-encoded text: a password containing an escaped quote is redacted in full. A keyed value ends at a JSON escape or at the end of its string, so the following text is no longer over-redacted.
• Escaped keys: JSON-in-JSON escaped keys are covered.
• Output form: a quoted JSON key keeps valid JSON: {"password":"[REDACTED]"}.

Telegram

• Media read scope: the native path tools refuse other chats' media under ~/.odek/media. These are read_file, vision, transcribe, head_tail, base64, checksum, diff, json_query, file_info, patch, write_file, search_files, glob and tree. Listings skip such entries, including through symlinked roots. docs/TELEGRAM.md says that shell and sub-agents are not scoped.
• Media handling:
  • Downloads and transcription now run off the update loop, on the chat's ordered gate.
  • Text, commands and scheduled turns wait for pending media.
  • /stop and /new cancel queued or running media jobs.
• /resume: the return-after-break summary now reaches the next principal turn, and /resume extracts a memory episode for the conversation it replaces.

Serve and tools

• Clarify questions are display-sanitized.
• A per-prompt model or thinking switch is applied only after the prompt is accepted.
• requires_confirmation reflects the REST friction setting that is enforced.
• tree skips dependency directories and caps total entries.
• artifact_read errors are built with encoding/json, and its open is non-blocking.
• checksum has a per-invocation context.

Memory

• Anaphora resolution strips untrusted wrapper blocks first.
• odek memory promote binds the promotion to the reviewed text and accepts --sha256.
• associations.json persists under a cross-process lock with merge.
• Follow-up delivery is ordered.

Runtime and ops

• index and vectors_meta are reserved session IDs, matched case-insensitively.
• The sub-agent key FD number is parsed strictly.
• Sandbox image names that docker would parse as options are rejected.
• odek upgrade bounds downloads by idle time instead of a 60s whole-request timeout. The 5-minute cap and size caps remain.
• -h/--help prints the command's own usage and exits 0 everywhere in a command's flags.
• REPL history is redacted before it is written.
• A sub-agent's engine-registered tools obey the parent's stamped tool filter.
• The janitor sweeps orphaned schedule-host-*.json heartbeats, and odek cleanup --dry-run lists them.
• docs/CLI.md now says budgets apply to continue.

Loop

• argv0 in tool_call_started ends at the first unquoted operator and never reports an assignment-shaped word.
• The verifier wraps tool-call arguments as untrusted data.
• An empty Anthropic finish reason (pause_turn, model_context_window_exceeded) is reported as partial, not complete. docs/CONFIG.md says Anthropic-format endpoints must return stop_reason.

Testing

• go vet and gofmt are clean. golangci-lint v2 reports 0 issues.
• go test ./..., go test -race -short ./... and the full internal/danger suite pass with HOME=/home/user.
• The four classifier monotonicity fuzz targets ran 20s each.
• Four cmd/odek search tests fail locally on macOS on main as well and pass on Linux.
• Reviews: per-area adversarial reviews, a full-branch review and two follow-up delta reviews. All findings are fixed.

Coverage (main → branch)

Package	Before	After
internal/danger	93.0%	93.4%
internal/redact	97.5%	98.5%
cmd/odek	77.7%	78.1%
internal/sandbox	93.7%	93.9%
internal/llmclient	87.1%	87.2%
internal/loop	93.7%	93.7%
internal/maintenance	96.0%	96.0%
internal/memory/extended	91.0%	91.0%
internal/session	90.1%	90.1%
internal/telegram	91.1%	91.1%

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	odek	24747a6	Commit Preview URL Branch Preview URL	Oct 14 2026, 01:11 PM