fix(security): contain private session artifacts

[sethkarten]

Summary

• validate session identifiers and keep all session-derived paths inside the configured session directory
• write session, auth, snapshot, debug, refinement, export, editor, and harness artifacts with private modes and atomic/no-follow protections
• reject symlink and non-regular-file sinks where sensitive data could otherwise escape or be exposed

This is the private-storage portion extracted from #1159 and proposed directly against current main.

Risk

Medium. The change intentionally rejects unsafe pre-existing paths and symlinks. Existing regular files remain supported and are repaired to private modes where appropriate. User-selected HTML export directories are not chmodded; the emitted file itself remains private.

Provenance

The two commits preserve cherry picked from trailers for original commits b0ce5adf20ec8c891dd44e8b39bdb0ab453a5eba and 4ede067b97f803957af36aefe16487e15851c363 from #1159. No MCP/provider changes are included.

Validation

• npm run check
• npx vitest --run test/suite/regressions/1105-session-storage-security.test.ts test/suite/regressions/1105-named-sinks-security.test.ts test/kernel-state-snapshot.test.ts test/interactive-mode-debug-command.test.ts — 31 passed
• PYTHONPATH=prime-agent-runtime/src python3 -m unittest prime-agent-runtime/test/test_harness.py — 36 passed
• focused Biome check on all changed TypeScript files
• git diff --check origin/main...HEAD

Review focus

Please focus on path containment, symlink/non-regular-file rejection, POSIX mode repair, Windows fallbacks, and the intentionally different parent-directory policy for user-selected HTML exports.

---

Note

High Risk
Touches auth credential storage and session/artifact persistence with fail-closed symlink and permission checks. Existing permissive or symlinked paths will hard-error, and Windows loses persistent /refine harness storage.

Overview
Hardens private persistence so session, auth, harness, snapshot, export, editor, and debug sinks reject traversal IDs, symlinks, and non-regular files, and write with atomic O_NOFOLLOW opens plus 0o600/0o700 modes.

Adds a shared private-files helper and routes sensitive writers through it. Session IDs are validated and artifact paths are confined to their root; unsafe existing sinks fail closed rather than being followed or repaired into attacker-controlled targets.

Windows fails closed for persistent harness storage and /refine (in-memory sessions remain). Kernel snapshot save/restore and the Python harness get matching no-follow/atomic private writes.

^{Reviewed by Cursor Bugbot for commit 6006f3d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Harden session and artifact storage against symlink attacks and unsafe file permissions

• Introduces a new private-files utility module with helpers for atomic, permission-hardened (0600/0700) file and directory operations that reject symlinks and non-regular files via O_NOFOLLOW.
• Applies these helpers across session storage, auth storage, refinement/harness state, log files, HTML exports, and external editor temp files in both the Node and Python runtimes.
• Adds session ID validation (1–128 alphanumeric/dot/underscore/hyphen characters) across creation, header parsing, and path construction to prevent path traversal via malformed IDs.
• Disables persistent harness storage on Windows in both the TypeScript agent and the Python runtime (prime-agent-runtime), returning in-memory state with explicit errors on mutation attempts.
• Risk: Existing files or directories with permissive modes or symlinked paths that were previously accepted will now cause errors; symlinked session files, artifact directories, and harness state paths are rejected outright rather than silently followed.

^{Macroscope summarized 6006f3d.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7f86590. Configure here.}