fix: validate session ID in Pi captureTranscript before writing

Pi's ParseHookEvent calls captureTranscript on agent_end, which builds
the destination path from the hook-supplied session ID and writes the
transcript — all before the lifecycle dispatcher validates the ID in
DispatchLifecycleEvent. A "../"-laden ID could thus write outside the
.entire/tmp/pi cache directory.

Validate the session ID at the top of captureTranscript (the choke point
where it becomes a path, covering both call sites); an unsafe ID returns
"" — the function's existing "no capture" signal — so dispatch behavior
is unchanged. Also corrects the gosec comment on the write that wrongly
claimed the ID was already validated.

Taint is the local Pi hook payload (same-privilege), so severity is low;
this is defense-in-depth consistent with the other hook hardening in this
branch. The sibling cacheSessionID writes a fixed filename, not an
ID-derived path, so it needs no guard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: ddfd40f73b22

Author: Soph

cmd/entire/cli/agent/pi/lifecycle.go

@@ -15,6 +15,7 @@ import (
 	"github.com/entireio/cli/cmd/entire/cli/agent"
 	"github.com/entireio/cli/cmd/entire/cli/logging"
 	"github.com/entireio/cli/cmd/entire/cli/paths"
+	"github.com/entireio/cli/cmd/entire/cli/validation"
 )
 
 // Hook names — these match Pi's native event names exactly (snake_case),
@@ -286,6 +287,15 @@ func captureTranscript(ctx context.Context, sessionID, piSessionFile string) str
 	if sessionID == "" || piSessionFile == "" {
 		return ""
 	}
+	// sessionID comes from the hook payload (or the locally cached active
+	// session) and is used to build dst below, before the lifecycle dispatcher
+	// validates it. Validate here at the choke point so an unsafe ID cannot
+	// write the transcript outside the cache directory; "" signals no capture.
+	if err := validation.ValidateSessionID(sessionID); err != nil {
+		logging.Warn(ctx, "pi: refusing to capture transcript for unsafe session ID",
+			slog.String("session_id", sessionID), slog.String("err", err.Error()))
+		return ""
+	}
 	dir := resolveSessionDir(ctx)
 	if err := os.MkdirAll(dir, 0o750); err != nil {
 		logging.Warn(ctx, "pi: capture transcript mkdir failed",
@@ -300,7 +310,7 @@ func captureTranscript(ctx context.Context, sessionID, piSessionFile string) str
 			slog.String("src", piSessionFile), slog.String("err", err.Error()))
 		return ""
 	}
-	//nolint:gosec // G703: dst constructed from validated session ID inside .entire/tmp
+	//nolint:gosec // G703: dst is sessionID (validated above) under .entire/tmp/pi
 	if err := os.WriteFile(dst, data, 0o600); err != nil {
 		logging.Warn(ctx, "pi: capture transcript write failed",
 			slog.String("dst", dst), slog.String("err", err.Error()))

cmd/entire/cli/agent/pi/lifecycle_test.go

@@ -211,6 +211,41 @@ func TestCaptureTranscript_MissingInputs(t *testing.T) {
 	}
 }
 
+// TestCaptureTranscript_RejectsTraversalSessionID verifies that captureTranscript
+// refuses an unsafe session ID. captureTranscript runs inside ParseHookEvent,
+// before the lifecycle dispatcher validates the ID, so it must guard the
+// transcript write itself — otherwise a "../"-laden ID escapes the cache dir.
+func TestCaptureTranscript_RejectsTraversalSessionID(t *testing.T) {
+	// Cannot use t.Parallel — t.Chdir.
+	dir := t.TempDir()
+	t.Chdir(dir)
+
+	src := filepath.Join(dir, "src.jsonl")
+	if err := os.WriteFile(src, []byte("payload\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	// A sentinel outside the cache dir that the traversal would target.
+	victim := filepath.Join(dir, "victim.json")
+	if err := os.WriteFile(victim, []byte("SAFE"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, bad := range []string{"../victim", "/etc/passwd", "..", "a/b"} {
+		if got := captureTranscript(context.Background(), bad, src); got != "" {
+			t.Errorf("captureTranscript(%q) = %q, want \"\" (unsafe ID must be refused)", bad, got)
+		}
+	}
+
+	got, err := os.ReadFile(victim)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != "SAFE" {
+		t.Errorf("sentinel was overwritten via traversal: %q", string(got))
+	}
+}
+
 func TestGetSupportedHooks(t *testing.T) {
 	t.Parallel()
 	got := (&PiAgent{}).GetSupportedHooks()