fix(security): contain private session artifacts

[sethkarten]

Summary

• validate session identifiers and keep all session-derived paths inside the configured session directory
• write session, auth, snapshot, debug, refinement, export, editor, and harness artifacts with private modes and atomic/no-follow protections
• reject symlink and non-regular-file sinks where sensitive data could otherwise escape or be exposed

This is the private-storage portion extracted from #1159 and proposed directly against current main.

Risk

Medium. The change intentionally rejects unsafe pre-existing paths and symlinks. Existing regular files remain supported and are repaired to private modes where appropriate. User-selected HTML export directories are not chmodded; the emitted file itself remains private.

Provenance

The two commits preserve cherry picked from trailers for original commits b0ce5adf20ec8c891dd44e8b39bdb0ab453a5eba and 4ede067b97f803957af36aefe16487e15851c363 from #1159. No MCP/provider changes are included.

Validation

• npm run check
• npx vitest --run test/suite/regressions/1105-session-storage-security.test.ts test/suite/regressions/1105-named-sinks-security.test.ts test/kernel-state-snapshot.test.ts test/interactive-mode-debug-command.test.ts — 31 passed
• PYTHONPATH=prime-agent-runtime/src python3 -m unittest prime-agent-runtime/test/test_harness.py — 36 passed
• focused Biome check on all changed TypeScript files
• git diff --check origin/main...HEAD

Review focus

Please focus on path containment, symlink/non-regular-file rejection, POSIX mode repair, Windows fallbacks, and the intentionally different parent-directory policy for user-selected HTML exports.

---

Note

Medium Risk
Touches core persistence and intentionally rejects unsafe existing paths/symlinks; behavior changes on Windows and environments without O_NOFOLLOW, though regular files are repaired where possible.

Overview
This PR hardens session, auth, harness, refinement, snapshot, export, and temp-file paths so sensitive data cannot escape via traversal IDs, symlinks, or permissive modes.

It introduces utils/private-files.ts and replaces scattered fs usage with helpers that enforce 0o700/0o600, atomic writes, and O_NOFOLLOW (no insecure fallback). SessionManager now validates session IDs, confines artifact dirs under session-artifacts, rejects symlink/non-regular transcripts, and uses ownsSessionDir so user-selected transcript parents are not chmodded. Auth, refinement/harness, IPython snapshots, HTML export, and editor/share temps go through the same layer; Windows gets in-memory harness state and /refine fails early. README documents POSIX requirements and residual race limits.

^{Reviewed by Cursor Bugbot for commit c498fb9. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Harden session and artifact storage against symlink attacks, path traversal, and permissive file modes

• Introduces utils/private-files.ts with O_NOFOLLOW-based helpers (ensurePrivateFile, readPrivateFile, writePrivateFileAtomic, appendPrivateFile, createPrivateTempFile, etc.) that enforce 0o700/0o600 permissions and reject symlinks at every step.
• Replaces direct fs calls throughout session, auth, harness, refinement, and interactive-mode code paths with these privacy-aware helpers, making all sensitive file reads and writes atomic and symlink-safe.
• Adds session ID validation (SESSION_ID_PATTERN) to reject traversal IDs, and validates artifact directory paths against path-escape and symlink attacks in SessionManager.
• Disables persistent harness storage and /refine on Windows, returning in-memory state with a clear error instead of attempting filesystem access.
• Hardens the Python kernel snapshot/restore helpers in state-snapshot.ts to require O_NOFOLLOW, use atomic temp-file writes with 0o600, and reject symlinked or non-regular destinations.
• Risk: Systems without O_NOFOLLOW (and Windows for harness persistence) now fail closed rather than falling back to unsafe operations.

Changes since #1249 opened

• Added conditional parent directory permission enforcement to private file utilities [c498fb9]
• Integrated ownsSessionDir flag into SessionManager to control directory permission enforcement [c498fb9]
• Removed exports for SESSION_ID_PATTERN constant and assertValidSessionId function [c498fb9]
• Added test coverage verifying parent directory permissions are preserved when opening user-selected transcripts [c498fb9]

^{Macroscope summarized cf9e3ae.}

[Apocrathia]

@codex review

[Apocrathia]

Do a pass to make sure we're actually using this new utility in the places that actually matter.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6006f3d407

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cf9e3ae. Configure here.}

[sethkarten]

@Apocrathia Ready for re-review. The private-file utility now covers JSONL export and RLM artifact-directory boundaries, all five automated security findings are fixed with behavioral/race coverage, current main is merged, CI is green, and all review threads are resolved.