Session file security updates (#3071)

crates/goose/src/agents/reply_parts.rs

@@ -222,7 +222,12 @@ impl Agent {
         usage: &crate::providers::base::ProviderUsage,
         messages_length: usize,
     ) -> Result<()> {
-        let session_file_path = session::storage::get_path(session_config.id.clone());
+        let session_file_path = match session::storage::get_path(session_config.id.clone()) {
+            Ok(path) => path,
+            Err(e) => {
+                return Err(anyhow::anyhow!("Failed to get session file path: {}", e));
+            }
+        };
         let mut metadata = session::storage::read_metadata(&session_file_path)?;
 
         metadata.schedule_id = session_config.schedule_id.clone();

crates/goose/src/agents/schedule_tool.rs

@@ -372,9 +372,17 @@ impl Agent {
             })?;
 
         // Get the session file path
-        let session_path = crate::session::storage::get_path(
+        let session_path = match crate::session::storage::get_path(
             crate::session::storage::Identifier::Name(session_id.to_string()),
-        );
+        ) {
+            Ok(path) => path,
+            Err(e) => {
+                return Err(ToolError::ExecutionError(format!(
+                    "Invalid session ID '{}': {}",
+                    session_id, e
+                )));
+            }
+        };
 
         // Check if session file exists
         if !session_path.exists() {