@intentic/sandbox-contract 1.331.0 → 1.332.0

package/src/models/plan-pools.test.ts

@@ -1,5 +1,6 @@
 import {
     bindingWindow,
+    currentWindows,
     gatesModel,
     gatingWindows,
     headroomState,
@@ -116,6 +117,38 @@ test("a reading is live until its reset, or, with none published, for one window
     expect(windowLive(window({ kind: "claude:tangelo" }), NOW - 400 * HOUR, NOW)).toBe(true);
 });
 
+test("a pool whose window closed since its reading stays on the account, at the floor and marked lapsed, not dropped", () => {
+    const NOW = 1_700_000_000_000;
+    const HOUR = 3_600_000;
+    // The case that lost the five-hour row: re-reads failing for hours, the weekly pools still current.
+    const stale: AccountUsage = {
+        measuredAt: NOW - 8 * HOUR,
+        windows: [
+            window({ kind: "five_hour", utilization: 63, resetsAt: (NOW - 5 * HOUR) / 1_000, rounded: true }),
+            window({ kind: "seven_day", utilization: 42, resetsAt: NOW / 1_000 + 100 * 3_600 }),
+            window({ kind: "model:Fable", label: "Fable", utilization: 0, resetsAt: NOW / 1_000 + 100 * 3_600, gates: { models: ["Fable"] } }),
+        ],
+    };
+    const current = currentWindows(stale, NOW);
+    expect(current.map((pool) => pool.kind)).toEqual(["five_hour", "seven_day", "model:Fable"]);
+    expect(current[0]).toEqual({ kind: "five_hour", utilization: 0, gates: "all", lapsedAt: (NOW - 5 * HOUR) / 1_000 });
+    expect(current.slice(1)).toEqual(stale.windows.slice(1));
+    // The floor binds nothing: the weekly pool is still the one that gates the next turn.
+    expect(bindingWindow({ ...stale, windows: current })?.kind).toBe("seven_day");
+    // Applying it again changes nothing, so a surface may run it over rows the daemon already ran it over.
+    expect(currentWindows({ ...stale, windows: current }, NOW)).toEqual(current);
+
+    // An idle pool published with no reset lapses at the end of its own length.
+    const idle: AccountUsage = {
+        measuredAt: NOW - 6 * HOUR,
+        windows: [window({ kind: "five_hour", utilization: 0 }), window({ kind: "seven_day", utilization: 5, resetsAt: NOW / 1_000 + 3_600 })],
+    };
+    expect(currentWindows(idle, NOW)[0]?.lapsedAt).toBe((NOW - HOUR) / 1_000);
+
+    // A reading with nothing current left says nothing about now: the account reads as unmeasured.
+    expect(currentWindows({ measuredAt: NOW - 8 * HOUR, windows: stale.windows.slice(0, 1) }, NOW)).toEqual([]);
+});
+
 // Serviceability: the one verdict on whether an account can serve a turn.
 
 const at = (measuredAt: number, ...windows: UsageWindow[]): AccountUsage => ({ windows, measuredAt });
@@ -248,6 +281,31 @@ test("a provider's accounts are judged together: a standing refusal lands only o
     expect(answered.get("a")).toEqual({ kind: "ready", room: 60 });
 });
 
+// The provider's last refusal moves on to whichever account says no next; an account's own refusal on file stays true of
+// it. A pool Anthropic reads at a rounded 100 is only proven empty by that refusal.
+test("each account answers to the newest refusal on file that still stands over it", () => {
+    const line = at(5_000, window({ kind: "seven_day", utilization: 100, rounded: true, resetsAt: 20 }));
+    // Read before its sign-in was refused, so nothing has answered that refusal yet.
+    const room = at(2_000, window({ kind: "seven_day", utilization: 30 }));
+    const own = refusal({ kind: "limit", account: "a", resetsAt: 20, at: 1_000 });
+    const elsewhere = refusal({ kind: "auth", account: "b", at: 3_000 });
+    const accounts = [
+        { account: "a", usage: line },
+        { account: "b", usage: room },
+    ];
+    expect(Object.fromEntries(serviceStates(accounts, [elsewhere, own], undefined, 9_999))).toEqual({
+        a: { kind: "spent", reopensAt: 20 },
+        b: { kind: "blocked", fix: "reconnect", reason: "no." },
+    });
+    // Only the provider's last one: the first account is back at the line, no room but not proven spent.
+    expect(serviceStates(accounts, elsewhere, undefined, 9_999).get("a")).toEqual({ kind: "ready", room: 0 });
+    // Past the instant the provider named, its refusal is over and the reading speaks alone.
+    expect(serviceStates(accounts, [elsewhere, own], undefined, 20_000).get("a")).toEqual({ kind: "ready", room: 0 });
+    // A newer refusal on the same account outranks the older one.
+    const revoked = refusal({ kind: "auth", account: "a", at: 6_000 });
+    expect(serviceStates(accounts, [own, revoked], undefined, 9_999).get("a")).toEqual({ kind: "blocked", fix: "reconnect", reason: "no." });
+});
+
 test("an unnamed turn takes the most room, then an unmeasured account, then a spent one, and a blocked one only when that is all", () => {
     const entry = (id: string, state: AccountState) => ({ id, state });
     const blocked: AccountState = { kind: "blocked", fix: "admin", reason: "no seat" };

package/src/models/plan-pools.ts

@@ -146,6 +146,28 @@ export const windowLive = (window: UsageWindow, measuredAt: number, now: number)
     return period === undefined || measuredAt + period.seconds * 1000 > now;
 };
 
+// A pool whose reading belongs to a window that has since closed: still the account's pool, at the floor any new window
+// starts from, and marked with when the old window closed so a surface can say it has not been re-read since.
+const lapsedWindow = (window: UsageWindow, measuredAt: number): UsageWindow => {
+    const { resetsAt, rounded: _rounded, utilization: _utilization, ...pool } = window;
+    // Only reached for a window windowLive retired, so with no published reset its length is known.
+    const closedAt = resetsAt ?? Math.floor((measuredAt + (windowPeriod(window)?.seconds ?? 0) * 1000) / 1000);
+    return { ...pool, utilization: 0, lapsedAt: closedAt };
+};
+
+// What a reading says about each of the account's pools now. A window past its reset is kept rather than dropped, as a
+// lapsed pool (lapsedWindow): dropping it made a reading whose re-reads were failing lose its five-hour row within hours
+// while the weekly rows stayed, a partial card that reads as complete. The floor of 0 is what dropping it already meant
+// to every verdict (an absent pool binds nothing). A reading with no window still current says nothing about now and
+// answers none, so the account reads as unmeasured. Idempotent: a pool already lapsed stays as it is.
+export const currentWindows = (usage: AccountUsage, now: number): UsageWindow[] => {
+    const live = (window: UsageWindow): boolean => window.lapsedAt === undefined && windowLive(window, usage.measuredAt, now);
+    if (!usage.windows.some(live)) {
+        return [];
+    }
+    return usage.windows.map((window) => (window.lapsedAt !== undefined || live(window) ? window : lapsedWindow(window, usage.measuredAt)));
+};
+
 // Whether an account can serve a turn: the one rule every picker and surface reads (AccountState). The daemon runs it and
 // publishes the verdict on each account row; the editor runs it only on a row from a daemon older than that field.
 
@@ -283,19 +305,28 @@ export const serviceState = (facts: ServiceFacts, refusal?: ProviderRefusal, mod
     return refusal?.kind === "limit" ? refusedPool(facts.usage, refusal, model) : headroomState(facts.usage, model);
 };
 
-/** Every account of one provider, judged together, since a refusal naming no account is answered by any of them. */
+/** The refusals a provider's accounts are judged against: its last one, or every one on file (each account's own beside it). */
+export type RefusalsOnFile = ProviderRefusal | readonly ProviderRefusal[] | undefined;
+
+const refusalList = (refusals: RefusalsOnFile): readonly ProviderRefusal[] =>
+    refusals === undefined ? [] : "kind" in refusals ? [refusals] : refusals;
+
+/**
+ * Every account of one provider, judged together, since a refusal naming no account is answered by any of them. Each
+ * account answers to the newest refusal that still stands over it: the provider's last one moves on to whichever account
+ * said no next, and an account's own refusal on file stays true of it until something answers it.
+ */
 export const serviceStates = (
     accounts: readonly ServiceFacts[],
-    refusal: ProviderRefusal | undefined,
+    refusals: RefusalsOnFile,
     model?: ModelRef,
     now: number = Date.now(),
 ): ReadonlyMap<string, AccountState> => {
-    const standing = refusal !== undefined && refusalVerdict(refusal, accounts, now) === "standing" ? refusal : undefined;
+    const standing = refusalList(refusals)
+        .filter((refusal) => refusalVerdict(refusal, accounts, now) === "standing")
+        .toSorted((left, right) => right.at - left.at);
     return new Map(
-        accounts.map((facts) => [
-            facts.account,
-            serviceState(facts, standing !== undefined && (standing.account ?? facts.account) === facts.account ? standing : undefined, model, now),
-        ]),
+        accounts.map((facts) => [facts.account, serviceState(facts, standing.find((refusal) => (refusal.account ?? facts.account) === facts.account), model, now)]),
     );
 };
 

package/src/models/provider-specs.ts

@@ -1,5 +1,5 @@
 import type { ProviderBrand } from "@intentic/constants";
-import { type AgentCapabilities, CLAUDE_CODE, CODEX, CURSOR, OPENCODE, OPENCODE_GEMINI } from "./agent-runtimes.js";
+import { type AgentCapabilities, CLAUDE_CODE, CODEX, CURSOR, DEVIN, OPENCODE, OPENCODE_GEMINI } from "./agent-runtimes.js";
 
 // Every fact about a provider more than one surface needs, one row each, replacing lists that drifted out of sync.
 // `access` (cost) and `auth` (connection) stay separate: conflating them mis-describes Z.ai, a prepaid plan spent
@@ -150,6 +150,24 @@ export const PROVIDER_SPECS = [
         // Cursor ignores harness too: there is no route to it but its own SDK.
         runtimes: { native: CURSOR, claudeCode: CURSOR },
     },
+    {
+        // Cognition's Devin through its own CLI (`devin acp`); labelled for the account, since it vends many vendors'
+        // models (SWE, Claude, GPT, Gemini…) under one Devin plan.
+        id: "devin",
+        label: "Devin",
+        vendor: "Devin",
+        accountLabel: "Devin",
+        destination: "Devin",
+        brand: "devin",
+        // Free is a real tier here: a free Devin account runs turns, on the smaller list of models its plan offers.
+        access: { kind: "free", requirement: "Devin account", runs: "Devin's agent on the models your plan offers" },
+        // The daemon drives the CLI's own sign-in and holds the key it hands back, one per account.
+        auth: { kind: "oauth" },
+        // Devin publishes its quota only on its own pages and in its CLI's interactive view, nothing a key can read.
+        planLimits: false,
+        // The CLI is the only door, so harness is not a choice: both axes are Devin's own runtime.
+        runtimes: { native: DEVIN, claudeCode: DEVIN },
+    },
     // The two minted providers need no new runtime or translator hop: each has its own Anthropic Messages endpoint.
     {
         id: "meta",
@@ -223,7 +241,7 @@ export const PROVIDER_SPECS = [
 type Spec = (typeof PROVIDER_SPECS)[number];
 
 // The agent runtimes the daemon can serve; a native id is reserved, `endpoint/<id>` or any other value names an
-// installed capability instead. Derived from the table and a union of six names, so the wire vocabulary can't drift.
+// installed capability instead. Derived from the table and a union of its ids, so the wire vocabulary can't drift.
 export type NativeProvider = Spec["id"];
 export const NATIVE_PROVIDERS: readonly NativeProvider[] = PROVIDER_SPECS.map((spec) => spec.id);
 

package/src/policy/command-classes.ts

@@ -1,5 +1,6 @@
 import { HISTORY_ROOT, WORKSPACE_ROOT } from "@intentic/constants";
 import { type CommandClass, CommandClassSchema, type CommandLocus } from "../schemas/agent.js";
+import { SECRET_REFERENCE } from "../schemas/needs.js";
 import { inertRegions, isLive } from "../text/shell-regions.js";
 
 // Classifies a shell command, shared by the sandbox gate and the machine agent's shell tool so they can't drift on what
@@ -72,7 +73,7 @@ const GIT_DESTRUCTIVE = [
 const GIT_BRANCH_SWITCH = [/\bgit\s+switch\b/, /\bgit\s+checkout\b(?![^|;&]*\s--\s)(?![^|;&]*\s\.(?:\s|$))/];
 
 // The credential is IN the command, not in a file; there is nothing for a filesystem to fact-check here.
-const SECRET_REFERENCES = [/\{\{secret:[A-Za-z0-9_./-]+\}\}/];
+const SECRET_REFERENCES = [SECRET_REFERENCE];
 
 // A path that usually holds a credential, a guess about a FILE, so every entry here is subject to holdsSecret.
 // The directory in front of a filename, so a pattern spans the whole path, not just the file inside it.
@@ -404,6 +405,23 @@ const findAndXargsDeletes = (command: string): CommandSpan[] => [
     ...spansOf([XARGS_RM], command),
 ];
 
+// The same tree delete in Windows' own shells, which is what a device's run_command runs there: PowerShell's
+// Remove-Item (and its aliases) with -Recurse, which it answers without asking, and cmd's rd/rmdir /s and del /s. Only
+// PowerShell's own names are read with a bare -r (any prefix of -Recurse, which PowerShell accepts), since `rm -r` is
+// also POSIX rm, whose bare -r asks before anything write-protected and is left to the rm rule above. And .NET's
+// Directory.Delete(path, true), the same delete from a script.
+const POWERSHELL_RECURSE = String.raw`\s-r(?:e(?:c(?:u(?:r(?:s(?:e)?)?)?)?)?)?(?::\$true)?(?![\w-])`;
+const WINDOWS_RECURSIVE_DELETES = [
+    new RegExp(String.raw`(?<![\w-])(?:Remove-Item|ri|rd|rmdir|del|erase)\b[^|;&\n]*?${POWERSHELL_RECURSE}`, "i"),
+    new RegExp(String.raw`(?<![\w-])rm\b[^|;&\n]*?\s-recurse(?![\w-])`, "i"),
+    /(?<![\w-])(?:rd|rmdir|del|erase)\b[^|;&\n]*?\s\/s\b/i,
+    /\[(?:System\.)?IO\.Directory\]::Delete\s*\([^)]*,\s*\$true\s*\)/i,
+];
+const windowsDeletes = (command: string): CommandSpan[] => spansOf(globally(WINDOWS_RECURSIVE_DELETES), command);
+
+// A disk wiped by Windows' own tools: a volume formatted, a disk cleared, from PowerShell or cmd.
+const WINDOWS_DISK_WIPES = [/(?<![\w-])(?:Format-Volume|Clear-Disk)\b/i, /(?<![\w-])format(?:\.com)?\s+[A-Za-z]:/i];
+
 // What cuts a checkout off from its repository's history: deleting its `.git` (for a worktree, a one-line pointer
 // whose loss strands every commit the checkout was reading), or `git init` over the folder it stands in, which makes
 // a standalone repository sharing nothing with the one it came from. A `git init <new-dir>` for a new project is not
@@ -500,8 +518,17 @@ const MATCHES: Readonly<Record<CommandClass, (command: string, context: CommandC
     "git.destructive": (command) => [...spansOf(GIT_DESTRUCTIVE_G, command), ...checkoutUnlinks(command)],
     // The only class that can answer "not here": in its own copy a conversation's checkout is its own to move.
     "git.branch-switch": (command, context) => (context.ownCheckout === true ? [] : spansOf(GIT_BRANCH_SWITCH_G, command)),
-    "files.destructive": (command) => [...recursiveForceRms(command), ...recursiveDeletes(command), ...findAndXargsDeletes(command)],
-    "system.destructive": (command, context) => [...spansOf(BLOCK_DEVICE_G, command), ...rootDeletes(command, context.locus)],
+    "files.destructive": (command) => [
+        ...recursiveForceRms(command),
+        ...recursiveDeletes(command),
+        ...findAndXargsDeletes(command),
+        ...windowsDeletes(command),
+    ],
+    "system.destructive": (command, context) => [
+        ...spansOf(BLOCK_DEVICE_G, command),
+        ...spansOf(globally(WINDOWS_DISK_WIPES), command),
+        ...rootDeletes(command, context.locus),
+    ],
     "container.state": (command) => spansOf(CONTAINER_STATE_G, command),
     "secrets.access": credentialReads,
     "package.publish": (command) => spansOf(PACKAGE_PUBLISH_G, command),
@@ -565,6 +592,9 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "rimraf(<path>)" },
         { code: "find <path> -delete", qualifier: "also -exec rm and -execdir rm" },
         { code: "xargs rm" },
+        { code: "Remove-Item -Recurse <path>", qualifier: "also its aliases ri, rd, rmdir, del, erase, and rm -Recurse" },
+        { code: "rd /s <path>", qualifier: "also rmdir /s and del /s" },
+        { code: "[IO.Directory]::Delete(<path>, $true)" },
     ],
     "system.destructive": [
         { code: "mkfs" },
@@ -574,6 +604,7 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "dd of=/dev/…" },
         { code: "shred /dev/…" },
         { code: "> /dev/sda" },
+        { code: "Format-Volume", qualifier: "also Clear-Disk, and format C:" },
         { code: "rm -rf /", qualifier: "also find / -delete; only when the target is a root, listed below" },
     ],
     "container.state": [

package/src/policy/credential-material.ts

@@ -1,3 +1,5 @@
+import { escapeRegExp } from "@intentic/base/escape";
+
 // Whether a file's text actually holds a credential, the fact command-classes.ts's path table can only guess at from a
 // name. Pure over the text (no fs, no config), so it stays testable and works where there's no filesystem. Biased
 // toward yes: a false positive costs one card, a false negative un-gates a real credential read.
@@ -25,24 +27,62 @@ const STRUCTURAL_SHAPES = [
     /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:(?!\*+@)[^\s/@]{3,}@/i,
 ];
 
-const ISSUED_TOKENS = [
-    /\bnpm_[A-Za-z0-9]{30,}/,
-    /\bgh[pousr]_[A-Za-z0-9]{20,}/,
-    /\bgithub_pat_[A-Za-z0-9_]{50,}/,
-    /\bglpat-[A-Za-z0-9_-]{16,}/,
-    /\bxox[baprs]-[A-Za-z0-9-]{10,}/,
-    /\bsk-[A-Za-z0-9_-]{20,}/,
-    /\b(?:sk|rk)_live_[A-Za-z0-9]{16,}/,
-    /\bAKIA[0-9A-Z]{16}\b/,
-    /\bASIA[0-9A-Z]{16}\b/,
-    /\bAIza[0-9A-Za-z_-]{35}\b/,
-    /\bhf_[A-Za-z0-9]{30,}/,
-    /\bdop_v1_[a-f0-9]{60,}/,
-    // A JWT: three base64url segments, the first two of which decode from {" and so always begin "ey".
-    /\bey[A-Za-z0-9_-]{10,}\.ey[A-Za-z0-9_-]{10,}\./,
+// An issuer's literal prefix and the regex source of the body it mints after it.
+export interface CredentialIssuer {
+    readonly prefix: string;
+    readonly body: string;
+}
+
+// Credentials that name their own issuer. Kept as data, not regexes, so the terminal filter's copy
+// (CREDENTIAL_ISSUERS in _sandbox/output-cleaners/src/cleaners.mjs, builtins only, so it cannot import this) can be
+// compared entry by entry: the daemon's src/secrets/terminal-masking-parity.test.ts fails the moment the two part. Only
+// the whole shape counts here, never the prefix alone: the outbox reads text nobody said holds a credential, where a
+// bare `sk-` in prose is not one. The terminal side also takes the prefix alone beside a credential-shaped name, where
+// the name already said so.
+export const CREDENTIAL_ISSUERS: readonly CredentialIssuer[] = [
+    { prefix: "npm_", body: "[A-Za-z0-9]{30,}" },
+    { prefix: "ghp_", body: "[A-Za-z0-9]{20,}" },
+    { prefix: "gho_", body: "[A-Za-z0-9]{20,}" },
+    { prefix: "ghu_", body: "[A-Za-z0-9]{20,}" },
+    { prefix: "ghs_", body: "[A-Za-z0-9]{20,}" },
+    { prefix: "ghr_", body: "[A-Za-z0-9]{20,}" },
+    { prefix: "github_pat_", body: "[A-Za-z0-9_]{50,}" },
+    { prefix: "glpat-", body: "[A-Za-z0-9_-]{16,}" },
+    { prefix: "xoxa-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "xoxb-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "xoxo-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "xoxp-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "xoxr-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "xoxs-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "sk-", body: "[A-Za-z0-9_-]{20,}" },
+    { prefix: "pk-", body: "[A-Za-z0-9_-]{20,}" },
+    { prefix: "rk-", body: "[A-Za-z0-9_-]{20,}" },
+    { prefix: "sk_live_", body: "[A-Za-z0-9]{16,}" },
+    { prefix: "rk_live_", body: "[A-Za-z0-9]{16,}" },
+    { prefix: "AKIA", body: String.raw`[0-9A-Z]{16}\b` },
+    { prefix: "ASIA", body: String.raw`[0-9A-Z]{16}\b` },
+    { prefix: "AIza", body: String.raw`[0-9A-Za-z_-]{35}\b` },
+    { prefix: "ya29.", body: "[0-9A-Za-z_-]{20,}" },
+    { prefix: "hf_", body: "[A-Za-z0-9]{30,}" },
+    { prefix: "dop_v1_", body: "[a-f0-9]{60,}" },
+    { prefix: "shpat_", body: "[a-fA-F0-9]{32,}" },
+    // SendGrid: a key id and its secret, dot-separated.
+    { prefix: "SG.", body: String.raw`[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}` },
+    // A JWT: three base64url segments, the first two of which decode from `{"` and so always begin `eyJ` and `ey`.
+    { prefix: "eyJ", body: String.raw`[A-Za-z0-9_-]{9,}\.ey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*` },
 ];
+export const CREDENTIAL_ISSUER_PREFIXES: readonly string[] = CREDENTIAL_ISSUERS.map(({ prefix }) => prefix);
+
+// Starts where no word or kebab-case word runs into it: `task-sk-runner-config-file` is a name, not a key. The other
+// side builds its patterns the same way.
+const ISSUED_TOKENS = CREDENTIAL_ISSUERS.map(({ prefix, body }) => new RegExp(String.raw`(?<![\w-])${escapeRegExp(prefix)}${body}`));
+
+// An opaque bearer credential, which names no issuer: the scheme word, then an RFC 6750 token holding a letter and a
+// digit and longer than prose puts after "Bearer" (`Bearer <token>`, `Bearer YOUR_TOKEN`, an already-masked `***`).
+const BEARER_VALUE = String.raw`(?=[\w.~+/-]*\d)(?=[\w.~+/-]*[A-Za-z])[\w.~+/-]{16,}=*`;
+const BEARER_TOKEN = new RegExp(String.raw`\bBearer[ \t]+${BEARER_VALUE}`, "i");
 
-const TOKEN_SHAPES = [...STRUCTURAL_SHAPES, ...ISSUED_TOKENS];
+const TOKEN_SHAPES = [...STRUCTURAL_SHAPES, BEARER_TOKEN, ...ISSUED_TOKENS];
 
 // Deferred references, stripped first: unstripped, each reads as a credential twice over.
 const DEFERRED_VALUE = /\{\{[^}\n]*\}\}|\$\{[^}\n]*\}/g;
@@ -91,6 +131,7 @@ const PRIVATE_KEY_BLOCK = new RegExp(
 );
 const PUTTY_KEY = new RegExp(String.raw`(PuTTY-User-Key-File-\d:)${MASKED_NEXT}[^\n\\]*${ARMOR_LINES}`, "g");
 const URL_PASSWORD = /(\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:)(?!\*+@)[^\s/@]{3,}@/gi;
+const BEARER_TOKEN_G = new RegExp(String.raw`(\bBearer[ \t]+)${BEARER_VALUE}`, "gi");
 
 // The truncated opener left once the bare-value arm stops at its first `}`, anchored at the start.
 const DEFERRED_OPENER = /^(?:\{\{|\$)/;
@@ -106,6 +147,7 @@ export const maskCredentialMaterial = (text: string): string =>
             .replace(PUTTY_KEY, `$1 ${MASK}`),
     )
         .replace(URL_PASSWORD, `$1${MASK}@`)
+        .replace(BEARER_TOKEN_G, `$1${MASK}`)
         // Masks just the value, leaving key/separator/quoting readable; skips mirror the detector's own.
         .replace(CREDENTIAL_ASSIGNMENT_G, (match, ...groups: unknown[]) => {
             const value = (groups[0] ?? groups[1] ?? groups[2] ?? "") as string;

package/src/policy/search-globs.ts

@@ -58,3 +58,138 @@ export const includeGlobs = (include: string | undefined): IncludeGlobs => {
         notGlobs: segments.filter((segment) => segment.startsWith(`!`)).flatMap((segment) => expand(segment.slice(1))),
     };
 };
+
+// ONE GLOB MATCHER, with Bun.Glob's reading of every construct, so the daemon, the desktop folder server (which runs
+// Bun.Glob itself) and the demo admit the same files for the same pattern. Before this the daemon's copy took
+// `[!t]` as a set of the characters `!` and `t`, where Bun.Glob reads "anything but t".
+// - `*` is any run within one path segment, `?` one character of it
+// - `**` as a whole segment is any number of segments, none included (`**/x` matches `x`); inside a segment it is `*`
+// - `[abc]`, `[a-z]`, and `[!abc]` or `[^abc]` for "none of these"; a `]` first in the set is literal
+// - `{a,b}` is either, nested groups and globs inside included; `\` makes the next character literal
+// - an unclosed `[` or `{` is literal, where Bun.Glob matches nothing: a half-typed pattern then still finds its text
+const REGEXP_SPECIAL = /[.*+?^${}()|[\]\\/]/;
+
+const literal = (char: string): string => (REGEXP_SPECIAL.test(char) ? `\\${char}` : char);
+
+// The index of the `]` closing the set opened at `open`, or -1.
+const setEnd = (glob: string, open: number): number => {
+    let index = open + 1;
+    if (glob[index] === `!` || glob[index] === `^`) {
+        index += 1;
+    }
+    // A `]` straight after the opening (or its negation) is a member, not the close.
+    if (glob[index] === `]`) {
+        index += 1;
+    }
+    for (; index < glob.length; index += 1) {
+        if (glob[index] === `\\`) {
+            index += 1;
+        } else if (glob[index] === `]`) {
+            return index;
+        }
+    }
+    return -1;
+};
+
+const setSource = (body: string): string => {
+    const negated = body.startsWith(`!`) || body.startsWith(`^`);
+    const members = (negated ? body.slice(1) : body).replaceAll(/\\(.)/g, `$1`).replaceAll(/[\\\]^[]/g, (char) => `\\${char}`);
+    return `[${negated ? `^` : ``}${members}]`;
+};
+
+// The index of the `}` closing the group opened at `open`, and where its top-level commas fall; undefined if unclosed.
+const groupOf = (glob: string, open: number): { readonly end: number; readonly commas: readonly number[] } | undefined => {
+    const commas: number[] = [];
+    let depth = 0;
+    for (let index = open; index < glob.length; index += 1) {
+        const char = glob[index];
+        if (char === `\\`) {
+            index += 1;
+        } else if (char === `[`) {
+            const end = setEnd(glob, index);
+            index = end === -1 ? index : end;
+        } else if (char === `{`) {
+            depth += 1;
+        } else if (char === `}`) {
+            depth -= 1;
+            if (depth === 0) {
+                return { end: index, commas };
+            }
+        } else if (char === `,` && depth === 1) {
+            commas.push(index);
+        }
+    }
+    return undefined;
+};
+
+// `**` filling a whole segment: the source it stands for and how many characters of the glob it consumed.
+const globstar = (glob: string, index: number, segmentStart: boolean): { readonly source: string; readonly length: number } | undefined => {
+    if (!segmentStart || glob[index + 1] !== `*`) {
+        return undefined;
+    }
+    const after = glob[index + 2];
+    if (after === `/`) {
+        return { source: `(?:[^/]*/)*`, length: 3 };
+    }
+    return after === undefined ? { source: `.*`, length: 2 } : undefined;
+};
+
+const compileGlob = (glob: string, segmentStart: boolean): string => {
+    let source = ``;
+    let atStart = segmentStart;
+    for (let index = 0; index < glob.length; index += 1) {
+        const char = glob[index]!;
+        const star = char === `*` ? globstar(glob, index, atStart) : undefined;
+        if (star !== undefined) {
+            source += star.source;
+            index += star.length - 1;
+            atStart = true;
+            continue;
+        }
+        if (char === `*`) {
+            // A run of stars inside a segment is one star.
+            while (glob[index + 1] === `*`) {
+                index += 1;
+            }
+            source += `[^/]*`;
+        } else if (char === `?`) {
+            source += `[^/]`;
+        } else if (char === `\\` && index + 1 < glob.length) {
+            index += 1;
+            source += literal(glob[index]!);
+        } else if (char === `[` && setEnd(glob, index) !== -1) {
+            const end = setEnd(glob, index);
+            source += setSource(glob.slice(index + 1, end));
+            index = end;
+        } else if (char === `{` && groupOf(glob, index) !== undefined) {
+            const group = groupOf(glob, index)!;
+            const bounds = [index, ...group.commas, group.end];
+            const alternatives = bounds.slice(1).map((end, at) => compileGlob(glob.slice(bounds[at]! + 1, end), atStart));
+            source += `(?:${alternatives.join(`|`)})`;
+            index = group.end;
+        } else {
+            source += literal(char);
+        }
+        atStart = char === `/`;
+    }
+    return source;
+};
+
+// The whole path must match: `*.ts` is a name at the root, not a suffix anywhere.
+export const globRegExp = (glob: string): RegExp => new RegExp(`^${compileGlob(glob, true)}$`);
+
+// A matcher for slash-separated relative paths, compiled once.
+export const globMatcher = (glob: string): ((path: string) => boolean) => {
+    const pattern = globRegExp(glob);
+    return (path) => pattern.test(path);
+};
+
+// The search box's whole second field as one test over a relative path: admitted by any include (or by none being
+// typed), and by no exclude. An anchored include's `./` is the root, so it is dropped before matching.
+export const includeMatcher = (include: string | undefined): ((path: string) => boolean) => {
+    const { globs, notGlobs } = includeGlobs(include);
+    const rooted = (glob: string): string => glob.replace(/^\.\//, ``);
+    const admits = globs.map((glob) => globMatcher(rooted(glob)));
+    const refuses = notGlobs.map((glob) => globMatcher(rooted(glob)));
+    return (path) => (admits.length === 0 || admits.some((test) => test(path))) && !refuses.some((test) => test(path));
+};

package/src/policy/secret-hosts.ts

@@ -42,6 +42,13 @@ export const normalizeHost = (raw: string): string | undefined => {
 export const hostMatches = (pattern: string, host: string): boolean =>
     pattern.startsWith(WILDCARD) ? host.endsWith(pattern.slice(1)) : host === pattern;
 
+// Whether one entry of a domain list covers a host: a plain entry names a domain and every host under it at any depth
+// (`example.com` covers `example.com` and `api.example.com`, never `notexample.com`), a wildcard only the hosts under it.
+// Both sides are expected normalized. The wallet's allow and deny lists read their entries this way; a secret's host
+// guard reads its own exactly (hostMatches).
+export const hostCovers = (entry: string, host: string): boolean =>
+    entry.startsWith(WILDCARD) ? hostMatches(entry, host) : host === entry || host.endsWith(`.${entry}`);
+
 export const hostAllowed = (patterns: readonly string[], host: string): boolean => patterns.some((pattern) => hostMatches(pattern, host));
 
 // Whether every host `pattern` matches is already matched by `patterns`: an exact host by any pattern that matches it, a

package/src/policy/tests/command-classes.test.ts

@@ -656,3 +656,38 @@ describe("git.branch-switch", () => {
         expect(marked("cd repo && git switch main && pnpm build", "git.branch-switch")).toEqual(["git switch"]);
     });
 });
+
+describe("Windows' own shells", () => {
+    test("PowerShell's and cmd's recursive deletes are files.destructive, the way a device's run_command meets them", () => {
+        for (const command of [
+            "Remove-Item -Recurse -Force C:\\Users\\me\\thesis",
+            "Remove-Item C:\\x -Recurse",
+            "Remove-Item -Recurse:$true x",
+            "ri -r C:\\x",
+            "rm -Recurse x",
+            "rd /s /q C:\\x",
+            "rmdir /S C:\\x",
+            "del /s /q *.tmp",
+            "[System.IO.Directory]::Delete('C:\\x', $true)",
+            "powershell -Command 'Remove-Item -Recurse -Force C:\\x'",
+            "cmd /c 'rmdir /s /q C:\\x'",
+        ]) {
+            expect(classify(command), command).toContain("files.destructive");
+        }
+    });
+
+    test("what only looks like one is not: a single file, a read that recurses, POSIX rm's asking -r", () => {
+        for (const command of ["Remove-Item C:\\x\\file.txt", "del file.txt", "Get-ChildItem -Recurse C:\\x", "Copy-Item -Recurse a b", "rmdir empty", "rm -r build", "git rm -r --cached x"]) {
+            expect(classify(command), command).not.toContain("files.destructive");
+        }
+    });
+
+    test("a volume formatted or a disk cleared is system.destructive", () => {
+        for (const command of ["Format-Volume -DriveLetter D", "Clear-Disk -Number 1 -RemoveData", "format D: /q"]) {
+            expect(classify(command), command).toContain("system.destructive");
+        }
+        for (const command of ["npm run format", "prettier --write . && echo format done", "dotnet format"]) {
+            expect(classify(command), command).not.toContain("system.destructive");
+        }
+    });
+});

package/src/policy/tests/credential-material.test.ts

@@ -202,6 +202,26 @@ describe("a credential token in text that is not a credential file", () => {
         expect(holdsCredentialToken("-----BEGIN PRIVATE KEY-----\nMIIEvQ")).toBe(true);
     });
 
+    // The issuers the terminal filter already knew; the two tables are one list now (ISSUERS).
+    test.each([
+        ["an opaque bearer", "curl -H 'Authorization: Bearer 8f3kQ2mZ9xLp4RtV7wNb' https://api.example.com", "curl -H 'Authorization: Bearer ***' https://api.example.com"],
+        // Prefixes split from bodies so push protection does not read these fixtures as live keys.
+        ["a shopify admin token", `token ${"shpat_"}0123456789abcdef0123456789abcdef in use`, "token *** in use"],
+        ["a sendgrid key", `key ${"SG."}aB3dE5fG7hJ9kL1mN3pQ5r.sT7uV9wX1yZ3aB5cD7eF9gH1jK3lM5nP7qR9sT1uV3w set`, "key *** set"],
+        ["a google oauth token", "refreshed ya29.a0AfB_byC3dE5fG7hJ9kL1mN3pQ5 ok", "refreshed *** ok"],
+        ["a public-prefixed key", "langfuse pk-lf-0a1b2c3d-4e5f-6a7b-8c9d now", "langfuse *** now"],
+    ])("names itself and masks: %s", (_label, text, masked) => {
+        expect(holdsCredentialToken(text)).toBe(true);
+        expect(maskCredentialMaterial(text)).toBe(masked);
+        expect(holdsCredentialToken(masked)).toBe(false);
+    });
+
+    test("a bearer in prose or a template is not one", () => {
+        for (const text of ["Authorization: Bearer <token>", "Authorization: Bearer YOUR_API_TOKEN_HERE", "Bearer ${TOKEN}", "the Bearer scheme"]) {
+            expect(holdsCredentialToken(text), text).toBe(false);
+        }
+    });
+
     test("is never a credential-named key beside a value", () => {
         expect(holdsCredentialToken("const config={apiKey:process.env.API_KEY,password:hunter22x}")).toBe(false);
         expect(holdsCredentialMaterial("const config={apiKey:process.env.API_KEY,password:hunter22x}")).toBe(true);

package/src/policy/tests/search-globs.test.ts

@@ -1,4 +1,4 @@
-import { includeGlobs } from "../search-globs.js";
+import { globMatcher, includeGlobs, includeMatcher } from "../search-globs.js";
 
 test("an empty field scopes nothing", () => {
     expect(includeGlobs(undefined)).toEqual({ globs: [], notGlobs: [] });
@@ -43,3 +43,48 @@ test("a leading ! excludes instead", () => {
     // A lone "!" excludes nothing: expanded, it would have matched everything.
     expect(includeGlobs(`!`)).toEqual({ globs: [], notGlobs: [] });
 });
+
+describe("globMatcher", () => {
+    // Every construct, held against Bun.Glob itself: the desktop folder server matches with Bun.Glob, so any
+    // disagreement here is two machines admitting different files for one pattern.
+    const patterns = [
+        `*.ts`, `**/*.ts`, `**/*.[!t]s`, `**/*.[^t]s`, `src/**`, `src/**/*.ts`, `a/**/b`, `a?c`, `[a-c]x`, `[!a]`, `[]]`,
+        `*.{ts,js}`, `{a,{b,c}}/*`, `a/{b,c/**}`, `{**/x,y}`, `a**b`, `**`, `**/`, `**/**/x`, `{,a}b`, `\\*x`, `**.ts`, `a/**b`,
+    ];
+    const paths = [
+        `a.ts`, `a.js`, `a/b.ts`, `a/b.js`, `.hidden.ts`, `.x/y.ts`, `src`, `src/a.ts`, `src/a/b.ts`, `a/b`, `a/x/b`, `abc`, `a/c`,
+        `bx`, `dx`, `/`, `a`, `]`, `c/x`, `a/c/d`, `a/x`, `x`, `y`, `axxb`, `ax/xb`, `b`, `ab`, `*x`, `a/xb`, `a/c/xb`, `a/`, `a/b/`,
+    ];
+    for (const pattern of patterns) {
+        test(`reads ${pattern} as Bun.Glob does`, () => {
+            const glob = new Bun.Glob(pattern);
+            const matches = globMatcher(pattern);
+            expect(paths.filter((path) => matches(path))).toEqual(paths.filter((path) => glob.match(path)));
+        });
+    }
+
+    test("[!t] means anything but t", () => {
+        const matches = globMatcher(`**/*.[!t]s`);
+        expect([matches(`src/a.js`), matches(`src/a.ts`)]).toEqual([true, false]);
+    });
+
+    test("an unclosed set or group is literal", () => {
+        expect([globMatcher(`[ab`)(`[ab`), globMatcher(`{a,b`)(`{a,b`)]).toEqual([true, true]);
+    });
+});
+
+describe("includeMatcher", () => {
+    test("admits by any include and refuses by any exclude", () => {
+        const matches = includeMatcher(`src, !*.test.ts`);
+        expect([`src/a.ts`, `src/a.test.ts`, `lib/src/b.ts`, `docs/c.md`].map(matches)).toEqual([true, false, true, false]);
+    });
+
+    test("an anchored include matches from the root only", () => {
+        const matches = includeMatcher(`./src`);
+        expect([matches(`src/a.ts`), matches(`lib/src/a.ts`)]).toEqual([true, false]);
+    });
+
+    test("nothing typed admits every path", () => {
+        expect(includeMatcher(undefined)(`any/where.ts`)).toBe(true);
+    });
+});