Merge commit from fork

* fix(sandbox): prevent session resource collisions

Sandbox IDs previously replaced unsupported session-key characters with dashes, allowing distinct caller-controlled keys to select the same container and persisted home. Derive a versioned SHA-256 identity from the scope and complete raw key so identical sessions remain stable while distinct keys cannot alias through normalization.\n\nPin the identity format and cover the reported channel-key collision across Docker, Apple Container, and session home paths. Document the intentional legacy-home break and shared-home trust boundary.

* docs(security): credit sandbox advisory reporter

Add the sandbox isolation fix to the Unreleased security notes and thank @DavidCarliez for the responsible disclosure.

Author: penso

CHANGELOG.md

@@ -19,6 +19,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+- [sandbox] Prevent session keys from sharing sandbox containers and persisted
+  homes. Thanks to [@DavidCarliez](https://github.com/DavidCarliez) for
+  responsibly reporting this issue.
+
 ## [20260902.02] - 2026-09-02
 
 ### Security

crates/tools/src/sandbox/router.rs

@@ -8,6 +8,7 @@ use std::{
 use {
     async_trait::async_trait,
     secrecy::ExposeSecret,
+    sha2::{Digest, Sha256},
     tokio::sync::RwLock,
     tracing::{debug, info, warn},
 };
@@ -907,22 +908,21 @@ impl SandboxRouter {
         self.agent_overrides.write().await.remove(session_key);
     }
 
-    /// Derive a SandboxId for a given session key.
-    /// The key is sanitized for use as a container name (only alphanumeric, dash, underscore, dot).
+    /// Derive a collision-resistant SandboxId for a given session key.
     pub fn sandbox_id_for(&self, session_key: &str) -> SandboxId {
-        let sanitized: String = session_key
-            .chars()
-            .map(|c| {
-                if c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.' {
-                    c
-                } else {
-                    '-'
-                }
-            })
-            .collect();
+        let scope: &[u8] = match &self.config.scope {
+            super::types::SandboxScope::Session => b"session",
+            super::types::SandboxScope::Agent => b"agent",
+            super::types::SandboxScope::Shared => b"shared",
+        };
+        let mut hasher = Sha256::new();
+        hasher.update(b"moltis-sandbox-id-v2\0");
+        hasher.update(scope);
+        hasher.update(b"\0");
+        hasher.update(session_key.as_bytes());
         SandboxId {
             scope: self.config.scope.clone(),
-            key: sanitized,
+            key: format!("v2-{:x}", hasher.finalize()),
         }
     }
 

crates/tools/src/sandbox/tests/docker_router.rs

@@ -499,10 +499,109 @@ fn test_sandbox_router_sandbox_id_for() {
     };
     let router = SandboxRouter::new(config);
     let id = router.sandbox_id_for("session:abc");
-    assert_eq!(id.key, "session-abc");
-    // Plain alphanumeric keys pass through unchanged.
-    let id2 = router.sandbox_id_for("main");
-    assert_eq!(id2.key, "main");
+    let repeated = router.sandbox_id_for("session:abc");
+
+    assert_eq!(id.key, repeated.key);
+    assert_eq!(
+        id.key,
+        "v2-20562047619de23f04775e9dc09eb3070a7bb944d80c2e336b71e2b603dd95d7"
+    );
+    assert!(id.key.starts_with("v2-"));
+    assert_eq!(id.key.len(), 67);
+    assert!(
+        id.key
+            .strip_prefix("v2-")
+            .is_some_and(|digest| digest.chars().all(|ch| ch.is_ascii_hexdigit()))
+    );
+}
+
+#[test]
+fn test_sandbox_router_session_keys_cannot_collide() {
+    let config = SandboxConfig {
+        scope: SandboxScope::Session,
+        home_persistence: HomePersistence::Session,
+        container_prefix: Some("moltis-test-sandbox".into()),
+        ..Default::default()
+    };
+    let router = SandboxRouter::new(config.clone());
+    let victim =
+        router.sandbox_id_for("agent:default:channel:telegram:account:acct1:peer:user:12345");
+    let attacker =
+        router.sandbox_id_for("agent-default-channel-telegram-account-acct1-peer-user-12345");
+
+    assert_ne!(victim.key, attacker.key);
+
+    let docker = DockerSandbox::new(config.clone());
+    assert_ne!(
+        docker.container_name(&victim),
+        docker.container_name(&attacker)
+    );
+
+    assert_ne!(
+        apple_container_name("moltis-test-sandbox", &victim.key, 0),
+        apple_container_name("moltis-test-sandbox", &attacker.key, 0)
+    );
+
+    let victim_home = sandbox_home_persistence_host_dir(&config, None, &victim).unwrap();
+    let attacker_home = sandbox_home_persistence_host_dir(&config, None, &attacker).unwrap();
+    assert_ne!(victim_home, attacker_home);
+    assert_eq!(
+        victim_home.parent(),
+        Some(
+            moltis_config::data_dir()
+                .join("sandbox/home/session")
+                .as_path()
+        )
+    );
+}
+
+#[test]
+fn test_sandbox_router_reserved_path_keys_are_safe() {
+    let router = SandboxRouter::new(SandboxConfig {
+        scope: SandboxScope::Session,
+        ..Default::default()
+    });
+
+    for session_key in ["", ".", "..", "/", "session:abc", "session-abc"] {
+        let id = router.sandbox_id_for(session_key);
+        assert_ne!(id.key, ".");
+        assert_ne!(id.key, "..");
+        assert!(!id.key.is_empty());
+    }
+
+    assert_ne!(
+        router.sandbox_id_for("session:abc").key,
+        router.sandbox_id_for("session-abc").key
+    );
+}
+
+#[test]
+fn test_sandbox_router_scope_is_part_of_identity() {
+    let session_router = SandboxRouter::new(SandboxConfig {
+        scope: SandboxScope::Session,
+        ..Default::default()
+    });
+    let agent_router = SandboxRouter::new(SandboxConfig {
+        scope: SandboxScope::Agent,
+        ..Default::default()
+    });
+    let shared_router = SandboxRouter::new(SandboxConfig {
+        scope: SandboxScope::Shared,
+        ..Default::default()
+    });
+
+    assert_eq!(
+        session_router.sandbox_id_for("session:abc").key,
+        "v2-20562047619de23f04775e9dc09eb3070a7bb944d80c2e336b71e2b603dd95d7"
+    );
+    assert_eq!(
+        agent_router.sandbox_id_for("session:abc").key,
+        "v2-e6a91e10ded6e80f84e1bab8c28c117700c9eef4672ac5632469c77c7a2b7829"
+    );
+    assert_eq!(
+        shared_router.sandbox_id_for("session:abc").key,
+        "v2-655b7035267c8dd21b19326dbcf221ef75d502f246c32fe5c5c522eb427ba2af"
+    );
 }
 
 #[tokio::test]

docs/src/sandbox.md

@@ -363,11 +363,23 @@ home_persistence = "session"   # "off", "session", or "shared" (default)
 ```
 
 - `off`: no home mount, container home is ephemeral
-- `session`: mount a per-session host folder to `/home/sandbox`
+- `session`: mount a per-session host folder to `/home/sandbox`; folder names
+  are opaque, collision-resistant identifiers rather than raw session keys
 - `shared`: mount one shared host folder to `/home/sandbox` for all sessions
   (defaults to `data_dir()/sandbox/home/shared`, or `shared_home_dir` if set)
 
-Moltis stores persisted homes under `data_dir()/sandbox/home/`.
+Moltis stores persisted homes under `data_dir()/sandbox/home/`. Per-session
+folder names are opaque, collision-resistant identifiers; do not derive or
+depend on them directly. The `shared` mode is intentionally visible to every
+sandbox session and is not a session-isolation boundary. Use `session` or `off`
+for credentials or other private state when sessions have different trust
+levels.
+
+After upgrading from a version that used readable session folder names, gateway
+startup discards legacy instance containers. Legacy home folders remain on disk
+but are not automatically reused because multiple session keys may have mapped
+to the same folder. Administrators can inspect and migrate trusted content
+manually.
 
 ## Managed Files mount