session-flow/running-retro: observer's persisted preview content widens local-read and injection exposure without owner-only permissions or extra redaction

[kyle-sexton]

Context

Filed from PR #1497 (fix for #1485 — grouping key + call/result previews in the detached observer's
distilled observations). Two independent automated reviews on that PR flagged a related but distinct
concern from #1485's own scope: the content now being persisted, not the schema shape.

Before #1497, a tool result appeared in the observations NDJSON only as an integer count
(tool_results: N); a tool call appeared only as a bare name. #1497 adds calls[].in (a bounded,
80-char preview of each tool call's input) and results[].out (an 80-char preview of each tool
result's output content), keyed by call id, so the headless analysis prompt can compute a
sequencing/batching/dependency finding instead of only ever dropping it.

Finding A (claude[bot] security review of PR #1497, IMPORTANT / PLAUSIBLE): results[].out can
now carry up to 80 characters of raw tool result content into the observations file — content that
can originate from external, third-party-controlled sources (files read via Read, WebFetch
responses, Bash output). That's more than enough for a prompt-injection payload. The observations
file is the untrusted data corpus fed to the headless claude -p analysis run; existing mitigations
(explicit trust-boundary language in the prompt, --tools Read restriction, shape-based _redact()
at the ledger write) are not new to this PR and don't fully close the gap — none of them prevent a
crafted injection from influencing what text the analysis returns, and that returned text is
written verbatim to the durable, persistent ledger. The say/human fields (160 chars) already
carried a version of this risk pre-PR, so the vector category isn't new, but this PR widens it: more
structured, more likely-verbatim external content, at a per-tool-result granularity that scales with
session length.

Finding B (chatgpt-codex-connector[bot] inline review of PR #1497, P2): when CLAUDE_PLUGIN_DATA
is unavailable on a multi-user Unix host, the documented launcher falls back to
/tmp/session-flow-observer; mkdir()/open("a") create that directory/file at the normal umask
(0755/0644). The new calls[].in previews can carry command/tool arguments — plausibly including
credentials passed as arguments — and collect-only or failed-analysis runs retain the observations
file, so another local user on that host could read data that, before this PR, was never copied into
the observations file at all.

Both findings were judged genuine but non-blocking for #1485/#1497 (that PR's own acceptance criteria
were about the grouping-key/dependency-preview capability, not the observer's file-permission or
injection-hardening posture) — deferred here per the post-green review pass's VALID-but-deferred rule.

Proposed work

• Create the observer's work directory and observations/status/lock/log files with owner-only
  permissions (e.g. 0700/0600) rather than the current default-umask permissions, closing Finding
  B regardless of CLAUDE_PLUGIN_DATA availability.
• Evaluate Finding A's suggested hardenings: a normalized/structural preview (e.g. only a first
  path-like token) instead of raw content, and/or a redaction pass applied to calls[].in /
  results[].out before they're written to the observations file (the same shape-based defense
  already applied at the ledger write, moved one hop earlier) — note this only mitigates
  secret/PII-shaped leakage, not free-text injection, so weigh whether it's worth doing alongside a
  genuine assessment of whether the existing trust-boundary prompt language is sufficient on its own.
• Decide whether either change needs a summarize_record() schema note (comment/docstring) so a
  future reader understands why the preview is bounded/redacted the way it is.

Acceptance criteria

• The observer's work-dir files (observations, status, lock, log) are created with owner-only
  permissions on every supported platform, not just the CLAUDE_PLUGIN_DATA-available path.
• A documented decision (implemented or explicitly deferred with rationale) on Finding A's
  preview-content hardening options.

References

• session-flow/running-retro: detached observer's distilled observations never preserve enough structure to compute sequencing/batching/delegation/dependency claims #1485 (this PR's parent item — the grouping-key/dependency-preview capability)
• PR fix(session-flow): preserve grouping key + call/result previews in observer distillation #1497 (introduced calls[].in / results[].out; both findings are review comments on that PR)
• plugins/session-flow/skills/running-retro/scripts/observer.py: summarize_record() (previews),
  Observer.__init__ (work-dir/file creation)

Metadata

Field	Value
Category	session-flow / running-retro
Area	session-flow
Ecosystem	python

---

This was generated by AI during work-loop execution.

[kyle-sexton]

This was generated by AI during triage.

Triage

Verification: Finding B confirmed live on main now; Finding A confirmed present only on the
still-open PR #1497 branch — an execution-sequencing note, not a reason to reject.

• Finding B (owner-only permissions) is real today, independent of fix(session-flow): preserve grouping key + call/result previews in observer distillation #1497:
  Observer.__init__ in plugins/session-flow/skills/running-retro/scripts/observer.py creates
  work_dir with mkdir(parents=True, exist_ok=True) (no mode=) and opens obs_path/log_path
  with plain .open("a", ...) — all at the process umask. Only lock_path is already owner-only
  (os.open(..., 0o600)). This predates fix(session-flow): preserve grouping key + call/result previews in observer distillation #1497 and can be fixed on main right now.
• Finding A (preview-content redaction): summarize_record() on current main still only emits
  tools (name list) and tool_results (a count) — the bounded calls[].in/results[].out
  previews do not exist on main. I fetched PR fix(session-flow): preserve grouping key + call/result previews in observer distillation #1497's branch
  (fix/1485-observer-grouping-key-dependency-preview, still OPEN, not merged) and confirmed the
  preview code is there ("in": _preview(c.get("input")), "out": _preview(c.get("content"))), with
  no redaction pass applied before the write. So Finding A's exposure doesn't exist on main yet —
  it will land when/if fix(session-flow): preserve grouping key + call/result previews in observer distillation #1497 merges. This is a sequencing note for whoever executes the brief, not a
  reason to hold triage: the permissions fix (Finding B) is actionable now, and the preview-hardening
  work (Finding A) should be verified against main at execution time in case fix(session-flow): preserve grouping key + call/result previews in observer distillation #1497 has since merged
  or changed shape.

Classification

• Type: Bug
• Priority: medium — both source reviews (claude[bot] IMPORTANT/PLAUSIBLE, chatgpt-codex-connector[bot]
  P2) judged these genuine but explicitly non-blocking for session-flow/running-retro: detached observer's distilled observations never preserve enough structure to compute sequencing/batching/delegation/dependency claims #1485/fix(session-flow): preserve grouping key + call/result previews in observer distillation #1497, and the exposure is bounded
  (multi-user host + CLAUDE_PLUGIN_DATA unavailable for Finding B; an already-existing, not new,
  vector category for Finding A, per the issue's own text).
• Work class: work-class: scoped — bounded to file-creation mode bits plus a preview/redaction
  tweak in one script; not a structural change.
• Routing: human-gated (needs-human). The acceptance criteria explicitly ask for "a documented
  decision (implemented or explicitly deferred with rationale)" on Finding A's hardening options, and
  the issue itself frames the tradeoff as open — a normalized/structural preview or a redaction pass
  "only mitigates secret/PII-shaped leakage, not free-text injection," weighed against whether the
  existing trust-boundary prompt language is already sufficient. That is a genuine security-posture
  judgment call, not a mechanically resolvable fix, so it doesn't qualify for decision-defaulted
  routing. The owner-only-permissions half (Finding B) has no open decision and could be split out as
  a quick scoped fix if a maintainer wants to unblock it ahead of the Finding A decision.

[kyle-sexton]

Frontier disposition (drain session)

Ruling: Close as not planned for this drain wave.

Observer preview content widening local-read/injection exposure was flagged during #1497 review and is recorded. Redaction/owner-only policy is a scoped session-flow hardening choice deferred until running-retro permissions model is revisited — not drain-blocking backlog.

Re-open trigger: A brief requiring owner-only observer writes or additional redaction tiers with acceptance tests.