Session file security updates (#3071)

crates/goose-cli/src/commands/session.rs

@@ -175,7 +175,12 @@ pub fn handle_session_list(verbose: bool, format: String, ascending: bool) -> Re
 /// without creating an Agent or prompting about working directories.
 pub fn handle_session_export(identifier: Identifier, output_path: Option<PathBuf>) -> Result<()> {
     // Get the session file path
-    let session_file_path = goose::session::get_path(identifier.clone());
+    let session_file_path = match goose::session::get_path(identifier.clone()) {
+        Ok(path) => path,
+        Err(e) => {
+            return Err(anyhow::anyhow!("Invalid session identifier: {}", e));
+        }
+    };
 
     if !session_file_path.exists() {
         return Err(anyhow::anyhow!(

crates/goose-cli/src/commands/web.rs

@@ -250,7 +250,14 @@ async fn list_sessions() -> Json<serde_json::Value> {
 async fn get_session(
     axum::extract::Path(session_id): axum::extract::Path<String>,
 ) -> Json<serde_json::Value> {
-    let session_file = session::get_path(session::Identifier::Name(session_id));
+    let session_file = match session::get_path(session::Identifier::Name(session_id)) {
+        Ok(path) => path,
+        Err(e) => {
+            return Json(serde_json::json!({
+                "error": format!("Invalid session ID: {}", e)
+            }));
+        }
+    };
 
     match session::read_messages(&session_file) {
         Ok(messages) => {
@@ -288,8 +295,15 @@ async fn handle_socket(socket: WebSocket, state: AppState) {
                             ..
                         }) => {
                             // Get session file path from session_id
-                            let session_file =
-                                session::get_path(session::Identifier::Name(session_id.clone()));
+                            let session_file = match session::get_path(session::Identifier::Name(
+                                session_id.clone(),
+                            )) {
+                                Ok(path) => path,
+                                Err(e) => {
+                                    tracing::error!("Failed to get session path: {}", e);
+                                    continue;
+                                }
+                            };
 
                             // Get or create session in memory (for fast access during processing)
                             let session_messages = {

crates/goose-cli/src/session/builder.rs

@@ -234,7 +234,13 @@ pub async fn build_session(session_config: SessionBuilderConfig) -> Session {
         }
     } else if session_config.resume {
         if let Some(identifier) = session_config.identifier {
-            let session_file = session::get_path(identifier);
+            let session_file = match session::get_path(identifier) {
+                Ok(path) => path,
+                Err(e) => {
+                    output::render_error(&format!("Invalid session identifier: {}", e));
+                    process::exit(1);
+                }
+            };
             if !session_file.exists() {
                 output::render_error(&format!(
                     "Cannot resume session {} - no such session exists",
@@ -262,7 +268,13 @@ pub async fn build_session(session_config: SessionBuilderConfig) -> Session {
         };
 
         // Just get the path - file will be created when needed
-        session::get_path(id)
+        match session::get_path(id) {
+            Ok(path) => path,
+            Err(e) => {
+                output::render_error(&format!("Failed to create session path: {}", e));
+                process::exit(1);
+            }
+        }
     };
 
     if session_config.resume && !session_config.no_session {