Description

loadSessionStore() parses sessions.json using JSON.parse into a plain object and then normalizes it by iterating keys and writing back into the same object (store[key] = normalized). If an attacker can influence sessions.json, they can include a "__proto__" (or similar) key. Assigning to store["__proto__"] will mutate the prototype of store (and potentially other objects), causing prototype pollution.

Why this is a security issue:

• Input: attacker-controlled JSON keys from sessions.json
• Mutation sink: store[key] = normalized where key can be "__proto__", "constructor", etc.
• Impact: prototype pollution can lead to unexpected behavior, authorization bypasses, crashes/DoS, or (depending on downstream usage patterns) code execution.

Vulnerable code:

for (const [key, entry] of Object.entries(store)) {
  ...
  store[key] = normalized;
}

Recommendation

Harden session store parsing/normalization against special keys.

Options:

1. Use a null-prototype object when storing parsed data and ignore dangerous keys:

const parsed = JSON.parse(raw);
const store: Record<string, SessionEntry> = Object.create(null);

for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {
  if (k === "__proto__" || k === "prototype" || k === "constructor") continue;
  (store as any)[k] = v;
}

2. Never assign back into an object using untrusted keys; instead, build a new sanitized object:

export function normalizeSessionStore(input: Record<string, SessionEntry>): Record<string, SessionEntry> {
  const out: Record<string, SessionEntry> = Object.create(null);
  for (const [key, entry] of Object.entries(input)) {
    if (key === "__proto__" || key === "prototype" || key === "constructor") continue;
    if (!entry) continue;
    out[key] = normalizeSessionEntryDelivery(normalizeSessionRuntimeModelFields(entry));
  }
  return out;
}

Also consider validating that session keys match an expected format (e.g., strict regex) before accepting them.

Description

buildSessionEntry() now treats a transcript as generatedByDreamingNarrative based on untrusted data from the sibling sessions.json session store. When this flag is true, the parser skips all message lines, resulting in empty content/lineMap and preventing downstream ingestion/indexing (validated by new tests).

Impact:

• If an attacker (or untrusted plugin/tenant) can write/modify agents/<id>/sessions/sessions.json, they can add a key that matches the dreaming-narrative prefix and point sessionFile / sessionId at any transcript.
• The targeted transcript will be treated as internal “dreaming narrative” output and its contents will be skipped, enabling activity hiding / retention & audit bypass.

Vulnerable behavior:

• Input: sessions.json entries (sessionKey + sessionFile/sessionId)
• Logic: isDreamingNarrativeTranscriptFromSessionStore() → generatedByDreamingNarrative
• Sink: if (generatedByDreamingNarrative) { continue; } inside transcript parsing loop (drops all message content)

Vulnerable code:

let generatedByDreamingNarrative =
  opts.generatedByDreamingNarrative ?? isDreamingNarrativeTranscriptFromSessionStore(absPath);
...
if (generatedByDreamingNarrative) {
  continue;
}

Recommendation

Treat sessions.json as untrusted for security decisions, or ensure it is protected by strong integrity controls.

Practical fixes (pick one or combine):

1. Derive dreaming classification from the transcript itself (e.g., only via bootstrap/custom records), not from sessions.json.
2. If sessions.json must be used, require both:
   • transcript evidence (bootstrap/runId markers), and
   • a session-store match that is constrained to the agent’s sessions directory.
3. Add integrity/permission checks for sessions.json (owner/perms), and in multi-tenant/plugin contexts ensure untrusted parties cannot modify it.

Example (require transcript evidence before skipping ingestion):

let generatedByDreamingNarrative = false;
​// First pass: detect from transcript markers only
for (...) {
  ...
  if (isDreamingNarrativeGeneratedRecord(record)) {
    generatedByDreamingNarrative = true;
  }
  ...
}
​// Optional: use session store only as a hint, not an authority
if (!generatedByDreamingNarrative && opts.generatedByDreamingNarrative) {
  ​// do NOT skip ingestion based solely on store
}

Description

buildSessionEntry() now implicitly classifies transcripts by calling isDreamingNarrativeTranscriptFromSessionStore(absPath), which loads ${dirname(absPath)}/sessions.json via loadSessionStore().

Security impact (DoS):

• loadSessionStore() performs a synchronous fs.readFileSync() + JSON.parse() on sessions.json.
• buildSessionEntry() is called in batch/concurrent loops (e.g., session indexing/export). With the new default, this can cause N synchronous reads/parses of the same sessions.json, blocking the Node.js event loop and dramatically increasing CPU and disk I/O.
• A large sessions.json (or many session files) can therefore degrade responsiveness or cause timeouts (denial of service) during indexing/sync operations.

Vulnerable code:

let generatedByDreamingNarrative =
  opts.generatedByDreamingNarrative ?? isDreamingNarrativeTranscriptFromSessionStore(absPath);

which calls into:

const raw = fs.readFileSync(storePath, "utf-8");
const parsed = JSON.parse(raw);

Note: extensions/memory-core/src/dreaming-phases.ts was updated to precompute and pass generatedByDreamingNarrative, but other call sites (e.g. sync/export paths) still call buildSessionEntry(absPath) without opts, triggering the expensive sync load repeatedly.

Recommendation

Avoid implicit synchronous store loads inside buildSessionEntry().

Options:

1. Require callers to pass generatedByDreamingNarrative (or a preloaded path set) and remove the default store lookup.
2. Cache/preload the dreaming transcript path set once per sessionsDir and reuse it across calls.
3. Make store loading async and/or ensure it happens outside tight loops.

Example (caller-side preload, similar to dreaming-phases):

const dreamingPaths = loadDreamingNarrativeTranscriptPathSetForSessionsDir(sessionsDir);
for (const absPath of files) {
  const entry = await buildSessionEntry(absPath, {
    generatedByDreamingNarrative: dreamingPaths.has(normalizeSessionTranscriptPathForComparison(absPath)),
  });
}

This prevents per-file synchronous disk reads/parses and avoids event-loop blocking.