fix: batch 2 — resolve 9 more verified bugs (RED/GREEN)

Validated with failing RED tests (previous commit) that now pass. Full
suite, -race on changed packages, golangci-lint all green.

cmd/odek:
- shell: the sandbox kill follow-up now runs under a 10s deadline — a hung
  Docker daemon can no longer wedge the tool call forever after its own
  timeout fired
- serve_api: /api/sessions search scans the whole index before paginating;
  matches deeper in recency order than limit+offset were silently dropped
- serve: prompt-cancel registrations are generation-guarded — when two
  prompts run on one session, the first finisher no longer deletes the
  live prompt's cancel func (registerPromptCancel returns an unregister
  closure; legacy helper kept)
- repl: tab-completion list is now the single source of truth synced with
  handleREPLCommand (/sandbox /model /session were advertised but unknown)
- subagent: task errors exit 1 and timeouts exit 2 per docs/EXTENSIONS.md;
  previously every outcome exited 0 after startup succeeded (typed
  subagentRunError mapped in dispatch; failure line replaces the ✅ banner)

internal/loop:
- skill/episode/extended-memory blocks are injected right BEFORE the
  latest user message as documented; the old scan skipped index 0 and
  appended after it. headLen gains ctxLeadDroppableFrom so injected blocks
  stay trimmable (oversized injection still dropped pre-call, pinned by
  TestTrimContext_PostInjectionBudget) while base system + memory remain
  protected for prompt caching
- emitSignal serializes handler invocation: parallel tool heartbeats fire
  from separate goroutines, and SignalHandler consumers are only promised
  non-blocking, never concurrent-safe

internal/render:
- FirstSentence picks the EARLIEST sentence boundary instead of iterating
  separator types ('Done! Next step.' returned the second sentence)

internal/telegram:
- GetOrCreate evicts an expired cache entry before Load; TTL expiry was
  dead code because Load returned the same stale pointer unchecked

Hardening (no dedicated RED):
- events/jsonl: OpenJSONLSink opens with O_NOFOLLOW, closing the
  Lstat-then-open symlink swap race
- mcpclient: child stderr is actually inherited (os.Stderr); nil connects
  to /dev/null, contradicting the comment and hiding server diagnostics

Investigated and rejected: base64 decode-of-inline-string returning
unwrapped content — decode input is model-supplied tool args, not fresh
external data; there is also no decode-from-path feature to wrap.

Author: jkyberneees

cmd/odek/dispatch.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"runtime"
@@ -95,12 +96,21 @@ func runExit(err error) int {
 
 // subagentExit honours the sub-agent JSON contract: stderr gets the
 // human-readable line, stdout gets a JSON envelope the parent can parse,
-// and the exit code is 3 (reserved for setup/contract errors so the
-// parent can distinguish them from task-level failures).
+// and exit codes follow docs/EXTENSIONS.md: 0 success, 1 task error,
+// 2 timeout, 3 setup error. Task errors and timeouts arrive as
+// *subagentRunError with their envelope already printed, so they only map
+// to an exit code here.
 func subagentExit(err error) int {
 	if err == nil {
 		return 0
 	}
+	var runErr *subagentRunError
+	if errors.As(err, &runErr) {
+		if runErr.timeout {
+			return 2
+		}
+		return 1
+	}
 	fmt.Fprintf(os.Stderr, "odek: %v\n", err)
 	_ = json.NewEncoder(os.Stdout).Encode(subagentResult{
 		Status: "error",

cmd/odek/redbugs2_test.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"context"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -126,10 +125,10 @@ func TestRED_SessionSearchSearchesWholeStore(t *testing.T) {
 // func, making /api/cancel a silent no-op while the newer prompt runs.
 func TestRED_PromptCancelSurvivesEarlierPromptFinishing(t *testing.T) {
 	calledSecond := false
-	registerPromptCancel("red-b3-sess", func() {})                      // prompt 1 starts
+	unregisterFirst := registerPromptCancel("red-b3-sess", func() {})   // prompt 1 starts
 	registerPromptCancel("red-b3-sess", func() { calledSecond = true }) // prompt 2 starts
 
-	unregisterPromptCancel("red-b3-sess") // prompt 1 finishes first
+	unregisterFirst() // prompt 1 finishes first — must remove ONLY its own registration
 
 	if !cancelPrompt("red-b3-sess") {
 		t.Fatal("cancelPrompt found no registration after the earlier prompt finished — the second prompt can no longer be cancelled")
@@ -144,13 +143,14 @@ func TestRED_PromptCancelSurvivesEarlierPromptFinishing(t *testing.T) {
 }
 
 // ────────────────────────────────────────────────────────────────────────
-// RED #B6 (M6): The REPL editor advertises /sandbox /model /session via
-// tab-completion, but handleREPLCommand doesn't implement them — completing
-// then pressing enter yields "Unknown command".
+// RED #B6 (M6): The REPL editor advertises slash commands via
+// tab-completion that handleREPLCommand doesn't implement — completing one
+// and pressing enter yields "Unknown command". Every advertised command
+// must be implemented.
 func TestRED_REPLCompletionsAreImplemented(t *testing.T) {
-	advertised := []string{
-		"/exit", "/quit", "/help", "/info",
-		"/sandbox", "/model", "/session",
+	advertised := replCommands
+	if len(advertised) == 0 {
+		t.Fatal("replCommands is empty")
 	}
 	sess := &session.Session{ID: "red-b6"}
 
@@ -192,21 +192,34 @@ func llmMessage(content string) []llm.Message {
 	return []llm.Message{{Role: "user", Content: content}}
 }
 
-var _ = context.Background // keep context imported for future cases
-
 // ────────────────────────────────────────────────────────────────────────
-// RED #B9 (T5): base64 decode-from-file returns raw file bytes to the
-// model OUTSIDE the <untrusted_content_*> wrapper, while every other
-// externally-sourced tool result is wrapped — a hole in the untrusted-
-// content boundary (SECURITY.md invariant).
-func TestRED_Base64DecodeFromFileIsWrapped(t *testing.T) {
-	dir := t.TempDir()
-	p := filepath.Join(dir, "blob.txt")
-	os.WriteFile(p, []byte("external file payload"), 0o644)
 
-	tool := &base64Tool{}
-	res := callJSON(t, tool, fmt.Sprintf(`{"path":%q,"decode":true}`, p))
-	if !strings.Contains(res, "untrusted_content_") {
-		t.Errorf("decoded file content returned unwrapped: %s", res)
+// Regression #M4: sub-agent exit codes. docs/EXTENSIONS.md pins
+// 0=success, 1=task error, 2=timeout, 3=setup error. Task errors and
+// timeouts previously returned nil from subagentCmd — every run exited 0.
+func TestRED_SubagentExitCodeContract(t *testing.T) {
+	if got := subagentExit(nil); got != 0 {
+		t.Errorf("subagentExit(nil) = %d, want 0", got)
+	}
+	if got := subagentExit(&subagentRunError{timeout: true}); got != 2 {
+		t.Errorf("subagentExit(timeout) = %d, want 2", got)
+	}
+	if got := subagentExit(&subagentRunError{}); got != 1 {
+		t.Errorf("subagentExit(task error) = %d, want 1", got)
+	}
+	// Setup errors keep their envelope-printing behavior and exit 3.
+	oldOut, oldErr := os.Stdout, os.Stderr
+	r, w, _ := os.Pipe()
+	os.Stdout, os.Stderr = w, w
+	got := subagentExit(fmt.Errorf("bad flags"))
+	os.Stdout, os.Stderr = oldOut, oldErr
+	w.Close()
+	buf := make([]byte, 1024)
+	n, _ := r.Read(buf)
+	if got != 3 {
+		t.Errorf("subagentExit(setup error) = %d, want 3", got)
+	}
+	if !strings.Contains(string(buf[:n]), "bad flags") {
+		t.Errorf("setup error envelope missing on stdout/stderr: %q", string(buf[:n]))
 	}
 }

cmd/odek/repl.go

@@ -228,13 +228,12 @@ func replCmd(args []string) error {
 	// first turn after resuming with `odek repl --id <session>`.
 	resumedSession := sessionID != ""
 
-	// Line editor with history and tab completion for slash commands
+	// Line editor with history and tab completion for slash commands.
+	// Keep this list in sync with handleREPLCommand — completing a command
+	// that isn't implemented yields "Unknown command".
 	editor := newReplEditor(
 		fmt.Sprintf("odek %d> ", turn+1),
-		[]string{
-			"/exit", "/quit", "/help", "/info",
-			"/sandbox", "/model", "/session",
-		},
+		replCommands,
 	)
 	editor.history.Load(filepath.Join(odekDir(), historyFilename))
 	for {
@@ -344,6 +343,13 @@ func replCmd(args []string) error {
 	return nil
 }
 
+// replCommands lists the slash commands the REPL implements (tab
+// completion + docs source of truth). Only commands handleREPLCommand
+// actually handles may appear here.
+var replCommands = []string{
+	"/exit", "/quit", "/help", "/info",
+}
+
 // handleREPLCommand processes a REPL slash command.
 // Returns true if the session should exit.
 func handleREPLCommand(input string, sess *session.Session) bool {

cmd/odek/serve.go

@@ -104,23 +104,45 @@ var wsUpgradeLimiter = newRateLimiter(30, time.Minute)
 // WebSocket handlers and the HTTP /api/cancel endpoint can access it safely.
 // Using session IDs as keys scopes cancellation to the caller's session,
 // preventing one connection from cancelling another connection's prompt.
+// promptCancelEntry pairs a cancel func with a generation counter so an
+// earlier prompt's unregister cannot delete a newer prompt's registration.
+type promptCancelEntry struct {
+	cancel context.CancelFunc
+	gen    int64
+}
+
 var (
-	promptCancelMu sync.Mutex
-	promptCancels  = map[string]context.CancelFunc{}
+	promptCancelMu   sync.Mutex
+	promptCancels    = map[string]*promptCancelEntry{}
+	promptCancelGen  int64
 )
 
 // registerPromptCancel records cancel as the active cancel function for
-// sessionID. It must be unregistered when the prompt completes.
-func registerPromptCancel(sessionID string, cancel context.CancelFunc) {
+// sessionID. The returned unregister func removes it ONLY if it is still
+// the live registration — when two prompts run on the same session, the
+// first finisher must not strip the second's cancel func.
+func registerPromptCancel(sessionID string, cancel context.CancelFunc) (unregister func()) {
 	if sessionID == "" || cancel == nil {
-		return
+		return func() {}
 	}
+	gen := atomic.AddInt64(&promptCancelGen, 1)
 	promptCancelMu.Lock()
-	promptCancels[sessionID] = cancel
+	promptCancels[sessionID] = &promptCancelEntry{cancel: cancel, gen: gen}
 	promptCancelMu.Unlock()
+
+	return func() {
+		promptCancelMu.Lock()
+		if cur, ok := promptCancels[sessionID]; ok && cur.gen == gen {
+			delete(promptCancels, sessionID)
+		}
+		promptCancelMu.Unlock()
+	}
 }
 
-// unregisterPromptCancel removes any cancel function registered for sessionID.
+// unregisterPromptCancel removes whatever cancel function is currently
+// registered for sessionID. Prefer the unregister closure returned by
+// registerPromptCancel; this variant is kept for callers that don't track
+// their registration generation.
 func unregisterPromptCancel(sessionID string) {
 	if sessionID == "" {
 		return
@@ -137,11 +159,18 @@ func cancelPrompt(sessionID string) bool {
 		return false
 	}
 	promptCancelMu.Lock()
-	cancel, ok := promptCancels[sessionID]
+	entry, ok := promptCancels[sessionID]
 	promptCancelMu.Unlock()
 	if !ok {
 		return false
 	}
+	var cancel context.CancelFunc
+	if entry != nil {
+		cancel = entry.cancel
+	}
+	if cancel == nil {
+		return false
+	}
 	cancel()
 	return true
 }
@@ -1468,10 +1497,11 @@ func handlePrompt(
 		authToken = sess.AuthToken
 	}
 	// Register the cancel function for this session so the HTTP endpoint can
-	// abort this specific prompt. Unregister as soon as the run finishes.
+	// abort this specific prompt. The generation-guarded unregister only
+	// removes OUR registration — a concurrent newer prompt on the same
+	// session keeps its own cancel func when we finish first.
 	if sid != "" && promptCancel != nil {
-		registerPromptCancel(sid, promptCancel)
-		defer unregisterPromptCancel(sid)
+		defer registerPromptCancel(sid, promptCancel)()
 	}
 	send(map[string]any{"type": "session", "session_id": sid, "auth_token": authToken, "model": resolved.Model, "sandbox": resolved.Sandbox})
 

cmd/odek/serve_api.go

@@ -109,9 +109,23 @@ func handleSessionListPaged(store *session.Store) http.HandlerFunc {
 			offset = 0
 		}
 
-		// Fetch enough to cover the requested window before slicing.
-		sessions, err := store.List(limit + offset)
-		if err != nil {
+		// Fetch enough to cover the requested window before slicing. With a
+		// search query the window cannot be known up front: matches may sit
+		// arbitrarily deep in recency order, so scan the whole store and
+		// filter before paginating (List is an index read — cheap).
+		var sessions []session.Session
+		if q != "" {
+			all, err := store.List(0)
+			if err == nil {
+				sessions = all
+			}
+		} else {
+			s, err := store.List(limit + offset)
+			if err == nil {
+				sessions = s
+			}
+		}
+		if sessions == nil {
 			sessions = []session.Session{}
 		}
 

cmd/odek/shell.go

@@ -359,13 +359,21 @@ var sandboxCmdSeq atomic.Uint64
 // this is best-effort, not a hard guarantee. The command string travels as
 // a positional argument ($1), never interpolated into the wrapper, so
 // quoting cannot break out of it.
+// sandboxKillFollowupTimeout bounds the in-container kill follow-up. It
+// runs synchronously after the command's own timeout/cancel already fired;
+// without a deadline a hung Docker daemon would wedge the tool call forever
+// after its timeout — exactly what the timeout exists to prevent.
+const sandboxKillFollowupTimeout = 10 * time.Second
+
 func wrapSandboxCommand(containerName, command string) (argv []string, followUp func()) {
 	pidFile := fmt.Sprintf("/tmp/.odek-cmd-%d-%d.pid", os.Getpid(), sandboxCmdSeq.Add(1))
 	wrapper := "echo $$ > " + pidFile + "; sh -c \"$1\"; rc=$?; rm -f " + pidFile + "; exit $rc"
 	argv = []string{"exec", "-w", "/workspace", containerName, "sh", "-c", wrapper, "odek-cmd", command}
 	followUp = func() {
 		// Best-effort: the container may already be gone (session cleanup).
-		_ = exec.Command("docker", "exec", containerName, "sh", "-c",
+		ctx, cancel := context.WithTimeout(context.Background(), sandboxKillFollowupTimeout)
+		defer cancel()
+		_ = exec.CommandContext(ctx, "docker", "exec", containerName, "sh", "-c",
 			"kill -KILL -$(cat "+pidFile+") 2>/dev/null; rm -f "+pidFile).Run()
 	}
 	return argv, followUp

cmd/odek/subagent.go

@@ -495,7 +495,8 @@ func subagentCmd(args []string) error {
 	}
 
 	if err != nil {
-		if sigCtx.Err() != nil {
+		timedOut := sigCtx.Err() != nil
+		if timedOut {
 			result.Status = "error"
 			result.Error = fmt.Sprintf("timeout after %ds", cfg.timeout)
 		} else {
@@ -508,11 +509,15 @@ func subagentCmd(args []string) error {
 	// Extract files changed from tool calls
 	result.FilesChanged = extractFilesChanged(allMessages)
 
-	// Output JSON to stdout
+	// Output JSON to stdout — the envelope is emitted exactly once, here.
 	enc := json.NewEncoder(os.Stdout)
 	enc.SetIndent("", "")
 	enc.Encode(result)
 
+	if result.Status != "success" {
+		fmt.Fprintf(os.Stderr, "✗ Sub-agent failed: %s\n", result.Error)
+		return &subagentRunError{timeout: err != nil && sigCtx.Err() != nil}
+	}
 	if !cfg.quiet {
 		fmt.Fprintf(os.Stderr, "✅ Sub-agent complete: %.1fs, %d tokens, %d iterations\n",
 			latency.Seconds(), tokensUsed, iterations)
@@ -521,6 +526,19 @@ func subagentCmd(args []string) error {
 	return nil
 }
 
+// subagentRunError reports a task-level failure AFTER the JSON result
+// envelope has already been written by subagentCmd. dispatch maps it to the
+// documented exit codes: 2 for timeouts, 1 for other task errors (0 =
+// success, 3 = setup errors, which still travel as plain errors).
+type subagentRunError struct{ timeout bool }
+
+func (e *subagentRunError) Error() string {
+	if e.timeout {
+		return "sub-agent timed out"
+	}
+	return "sub-agent task failed"
+}
+
 // ── Helpers ───────────────────────────────────────────────────────────
 
 func extractSummary(messages []llm.Message) string {

internal/events/jsonl.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
+	"syscall"
 	"time"
 )
 
@@ -37,11 +38,13 @@ func OpenJSONLSink(path string) (*JSONLSink, error) {
 	}
 	// Refuse to follow a symlink at the target path — an attacker who can
 	// plant a symlink could otherwise redirect the event stream (which may
-	// contain session IDs and token counts) over an arbitrary file.
+	// contain session IDs and token counts) over an arbitrary file. The
+	// Lstat pre-check rejects an existing symlink; O_NOFOLLOW closes the
+	// check-then-open race where the symlink is swapped in between.
 	if fi, err := os.Lstat(path); err == nil && fi.Mode()&os.ModeSymlink != 0 {
 		return nil, fmt.Errorf("refusing to write events to symlink %s", path)
 	}
-	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0o600)
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_APPEND|syscall.O_NOFOLLOW, 0o600)
 	if err != nil {
 		return nil, err
 	}