Skip to content

OKF Agent Memory v0.1.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Sep 08:02
· 5 commits to main since this release
v0.1.3
9cf990a

Release v0.1.3 — Security Hardening Release

OKF Agent Memory v0.1.3 is a critical security hardening release. It introduces robust defense-in-depth boundaries against path traversal, symlink escapes, YAML metadata injection, and unconfined MCP bundle operations, while establishing a continuous adversarial security audit framework.

Special Thanks & Credits

We want to extend our heartfelt gratitude and special recognition to Martin (@djmaze) for responsibly discovering, investigating, and reporting the path traversal vulnerability in SaveConcept. His thorough report and collaborative patch review directly prompted this comprehensive security overhaul. Thank you, Martin, for helping make autonomous AI agent memory safe and resilient!

Key Security Fixes & Improvements

1. Path Traversal Prevention (CWE-22)

  • Central Choke-Point Boundary Enforcement: All concept persistence endpoints (SaveConcept, UpdateParentIndex, AppendLogEntry) now strictly enforce canonical bundle containment via filepath.Abs and filepath.Rel.
  • Validation: Any concept ID containing .. path segments, absolute paths, or escaping the designated bundle root is denied immediately.
  • Reserved File Protection: Prevents overwriting bundle root navigation and convention files (index.md, log.md, AGENTS.md) as arbitrary concept documents.
  • Co-authored-by: @djmaze

2. Symlink Containment & LFI / Overwrite Prevention (CWE-59)

  • Canonical Ancestor Resolution (ensureWithinRoot): Canonicalizes root and target directories, dereferencing symlinks across existing directory hierarchies (with full cross-platform support, including macOS /var $\rightarrow$ /private/var).
  • LoadBundle LFI Protection: LoadBundle now inspects symlinks to ensure they resolve strictly within the canonical bundle root, preventing Local File Inclusion (LFI) of arbitrary system files. Symlinks to directories or non-markdown files are rejected.
  • Arbitrary File Overwrite Defense: Mutation operations refuse to write through existing symlinks pointing outside the bundle.

3. YAML Frontmatter & Log Injection Defense

  • Single-Line Metadata Constraints: sanitizeConceptMetadata enforces that type, title, description, and actor cannot contain newline characters (\r, \n), completely blocking YAML attribute smuggling or forged human verification states (verified: { by: "human:attacker" }).
  • Delimiter Smuggling Protection: Rejects frontmatter document delimiters (---) in metadata fields.
  • Safe YAML Scalar Quoting: SerializeConcept safely quotes scalars containing YAML special characters without HTML entity escaping (\u0026).

4. MCP Server Root Confinement

  • Workspace Confinement: The stdio Model Context Protocol (MCP) server initializes with a canonical rootDir (derived from the project workspace or OKF_MCP_ROOT).
  • Dynamic Bundle Validation: While multi-bundle projects can dynamically select sub-bundles within the repository (e.g. bundle="examples/software"), any tool call attempting to escape the server root (e.g. bundle="/etc" or bundle="../../outside") is denied with a clear JSON-RPC tool error.

5. Validator Trust-Ordering & Stale Gating

  • Trust Integrity: Validates that verified.at cannot chronologically precede generated.at (preventing AI agents from self-authorizing verified status).
  • Opt-in Stale Gate: Added --stale flag to okf validate for gated CI pipelines requiring refreshed memory.

6. Continuous Adversarial Security Framework

  • docs/SECURITY_AUDIT.md: Standardized system prompt and 4-area checklist (Filesystem/CWE-22, MCP/Agent Interfaces, DoS/Bounds, Data Integrity) for dedicated Security Reviewer Agents.
  • Release Playbook Gate: Added mandatory Step 2 (Security & Adversarial Audit Gate) to docs/RELEASE_PLAYBOOK.md.
  • make audit-security: Added automated security target running gosec and govulncheck.
  • Google Jules Integration: Prompt template for continuous, autonomous daily repository security audits.

Persistent Knowledge Updates

In accordance with OKF Dogfooding principles, this security architecture is permanently recorded in the project's own persistent memory:

Installation & Upgrade

Via Go Install

go install github.com/okf-memory/okf-agent-memory/cmd/okf@v0.1.3

Pre-built Binaries

Pre-built standalone binaries and starter packs for macOS, Linux, and Windows (ARM64 and x86_64) are attached below.

Full Changelog: v0.1.2...v0.1.3

Contributors

djmaze
Assets 12
Loading