copilot-operator 0.1.12 → 0.1.15

package/dist/src/config/schema.js

@@ -6,8 +6,8 @@
  * commands denied.
  */
 import { z } from 'zod';
-import { readFile } from 'node:fs/promises';
 import { parse as parseYaml } from 'yaml';
+import { readHandWritten } from './handWritten.js';
 import { applyPolicyLock, readPolicyLocks } from './lockedPolicy.js';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
@@ -70,13 +70,6 @@ const GIT_SOMETIMES_WRITES = 'remote\\s+(?:add|remove|rm|rename|set-url|set-head
     'config\\s+(?:set|unset|rename-section|remove-section|edit)\\b|' +
     'reflog\\s+(?:delete|expire)|' +
     'notes\\s+(?:add|append|edit|remove|copy|prune)';
-/** Which directories of one project are copied to the Desktop, and how. */
-const ProjectMirrorSelection = z.object({
-    includeDirs: z.array(z.string()).default([]),
-    excludeDirs: z.array(z.string()).default([]),
-    respectGitignore: z.boolean().default(true),
-    includeEnvFiles: z.boolean().default(false),
-});
 export const RunConfigSchema = z.object({
     copilot: z
         .object({
@@ -243,7 +236,12 @@ export const RunConfigSchema = z.object({
             'Set-ExecutionPolicy\\s+Unrestricted',
             'diskpart|bcdedit|vssadmin',
             'Disable-WindowsOptionalFeature',
-            'net\\s+user\\s+\\w+\\s+/add',
+            // An account made, or put into a group, however the line spells it. `net user bob p /add`
+            // gives the password before `/add` and is the ordinary form; the pattern that wanted
+            // `/add` straight after the name missed it, as it missed `net.exe`, `net1`, `localgroup`
+            // and the cmdlets that do the same thing.
+            '\\bnet1?(?:\\.exe)?\\s+(?:user|localgroup|group)\\b[^|;&\\n]*\\s/add\\b',
+            '\\b(?:New-LocalUser|Add-LocalGroupMember|New-ADUser|Add-ADGroupMember)\\b',
             // git that changes something. See GIT_WRITE_NOTE below.
             `\\bgit\\s+(?:${GIT_GLOBAL_OPTION}\\s+)*(?:${GIT_ALWAYS_WRITES})(?![\\w-])`,
             `\\bgit\\s+(?:${GIT_GLOBAL_OPTION}\\s+)*(?:${GIT_SOMETIMES_WRITES})`,
@@ -272,9 +270,8 @@ export const RunConfigSchema = z.object({
         rootDir: z.string().default(''),
         /**
          * What to call it. Empty means the folder's own name, which is what this used to be
-         * always — fine until the Desktop mirror started naming a folder per project and the
-         * plan brief started listing them, where "rules-tests" is a path and "the test suite"
-         * is what the operator calls it. The other projects have had a name from the start; the
+         * always — fine until the plan brief started listing the projects, where "rules-tests"
+         * is a path and "the test suite" is what the operator calls it. The other projects have had a name from the start; the
          * default one had nowhere to put it.
          */
         name: z.string().trim().default(''),
@@ -290,47 +287,8 @@ export const RunConfigSchema = z.object({
             .array(z.object({
             name: z.string().trim().min(1),
             rootDir: z.string().trim().min(1),
-            /** Which of this project's directories go to the Desktop. See `mirror` below. */
-            mirror: ProjectMirrorSelection.optional(),
-            /** `false` keeps this project off the Desktop while the switch below is on. Absent means on. */
-            desktop: z.boolean().optional(),
         }))
             .default([]),
-        /**
-         * Keep a copy of every project's selected directories on the Desktop, one folder per
-         * project under `copilot-operator-context`, refreshed before every run.
-         *
-         * The Desktop is the way into OneDrive, and OneDrive is the way into the chat's file
-         * picker. This is the switch for it: on, every project listed here is mirrored, with its
-         * own selection; off, the project folders are removed from the Desktop, because a stale
-         * copy of a code base sitting in the cloud is worse than none.
-         */
-        mirrorToDesktop: z.boolean().default(false),
-        /** The default project's own selection. */
-        mirror: ProjectMirrorSelection.optional(),
-        /** `false` keeps the default project off the Desktop while the switch is on. Absent means on. */
-        desktop: z.boolean().optional(),
-    })
-        .prefault({}),
-    /**
-     * Defaults for the project mirror. Which project and which directories is a property of a
-     * session; these are the mechanics shared by all of them.
-     */
-    projectMirror: z
-        .object({
-        enabled: z.boolean().default(false),
-        rootDir: z.string().optional(),
-        includeDirs: z.array(z.string()).default([]),
-        excludeDirs: z.array(z.string()).default([]),
-        targetDir: z.string().optional(),
-        separator: z.string().default('--'),
-        txtMode: z.enum(['append', 'replace', 'none']).default('append'),
-        respectGitignore: z.boolean().default(true),
-        ignoreDirs: z.array(z.string()).default([]),
-        includeEnvFiles: z.boolean().default(false),
-        maxFileBytes: z.number().int().positive().default(2 * 1024 * 1024),
-        attachToFirstMessage: z.boolean().default(true),
-        maxAttachedFiles: z.number().int().positive().default(20),
     })
         .prefault({}),
     pacing: z
@@ -434,18 +392,11 @@ async function textOf(value, baseDir) {
         return '';
     if (typeof value === 'string')
         return value;
-    return await readFile(expandPath(value.file, baseDir), 'utf8');
+    // A file the run.yaml names is written by hand as the run.yaml is: see `handWritten.ts`.
+    return await readHandWritten(expandPath(value.file, baseDir));
 }
 /** Turns parsed config plus a base directory into absolute paths and loaded texts. */
 export async function resolveConfig(cfg, configPath, baseDir) {
-    if (cfg.projectMirror.enabled) {
-        if (!cfg.projectMirror.rootDir)
-            throw new Error('projectMirror.enabled is true but projectMirror.rootDir is missing.');
-        if (cfg.projectMirror.includeDirs.length === 0) {
-            throw new Error('projectMirror.enabled is true but includeDirs is empty, so nothing would be copied. ' +
-                'List the directories to include, or use ["."] for the whole project.');
-        }
-    }
     /*
      * The administrator's floor, applied here because this is the one function both the terminal's
      * `run.yaml` and the API's `data/settings.json` pass through. Applying it anywhere further in
@@ -462,10 +413,6 @@ export async function resolveConfig(cfg, configPath, baseDir) {
         denyPatterns: cfg.execution.denyPatterns,
         isolation: cfg.execution.isolation,
         passEnv: cfg.execution.passEnv,
-        mirrorToDesktop: cfg.project.mirrorToDesktop,
-        projectMirrorEnabled: cfg.projectMirror.enabled,
-        includeEnvFiles: cfg.project.mirror?.includeEnvFiles ?? cfg.project.others.some((o) => o.mirror?.includeEnvFiles === true),
-        mirrorIncludeEnvFiles: cfg.projectMirror.includeEnvFiles,
     };
     const outcome = { applied: false, changes: [] };
     for (const lock of locks) {
@@ -486,12 +433,6 @@ export async function resolveConfig(cfg, configPath, baseDir) {
             isolation: policy.isolation ?? cfg.execution.isolation,
             passEnv: policy.passEnv ?? cfg.execution.passEnv,
         },
-        project: lockedProject(cfg.project, policy),
-        projectMirror: {
-            ...cfg.projectMirror,
-            enabled: policy.projectMirrorEnabled ?? cfg.projectMirror.enabled,
-            includeEnvFiles: policy.mirrorIncludeEnvFiles ?? cfg.projectMirror.includeEnvFiles,
-        },
         configPath,
         baseDir,
         policyLock: outcome,
@@ -503,29 +444,17 @@ export async function resolveConfig(cfg, configPath, baseDir) {
             level1Path: expandPath(cfg.level1File, baseDir),
             level2Text: await textOf(cfg.level2, baseDir),
             taskText: await textOf(cfg.task, baseDir),
-            mirrorRootDir: cfg.projectMirror.rootDir ? expandPath(cfg.projectMirror.rootDir, baseDir) : undefined,
-            mirrorTargetDir: cfg.projectMirror.targetDir ? expandPath(cfg.projectMirror.targetDir, baseDir) : undefined,
         },
     };
 }
-/** The project section with what the lock decided: the Desktop mirror switch and the .env selections. */
-function lockedProject(project, policy) {
-    const envOff = policy.includeEnvFiles === false;
-    const fix = (m) => (m && envOff ? { ...m, includeEnvFiles: false } : m);
-    return {
-        ...project,
-        mirrorToDesktop: policy.mirrorToDesktop ?? project.mirrorToDesktop,
-        mirror: fix(project.mirror),
-        others: project.others.map((o) => ({ ...o, mirror: fix(o.mirror) })),
-    };
-}
 function formatIssues(issues) {
     return issues.map((i) => `  ${i.path.join('.') || '(root)'}: ${i.message}`).join('\n');
 }
 /** Loads a YAML run config from disk. */
 export async function loadConfig(configPath) {
     const abs = resolve(configPath);
-    const raw = await readFile(abs, 'utf8');
+    // Written by hand, in whatever encoding its editor chose: see `handWritten.ts`.
+    const raw = await readHandWritten(abs);
     const parsed = RunConfigSchema.safeParse(parseYaml(raw) ?? {});
     if (!parsed.success)
         throw new Error(`${abs} is not a valid run config:\n${formatIssues(parsed.error.issues)}`);

package/dist/src/context/desktopDir.js

@@ -0,0 +1,44 @@
+/**
+ * Where the Desktop is, and whether it is backed up by OneDrive.
+ *
+ * Used by "save the log to the Desktop" and by `cop doctor`. What else once lived next to this — the
+ * project copied to a Desktop folder and its files attached to the chat, and the bridge to Context
+ * Picker — was removed on 2026-09-30 at the operator's request; the bot no longer hands the chat any
+ * of the project's files.
+ */
+import { existsSync } from 'node:fs';
+import { join, resolve, sep } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * The Desktop folder.
+ *
+ * Candidates are tried in order and the first that exists wins, which is what makes this
+ * correct under OneDrive's Known Folder Move: when the Desktop is backed up, the real
+ * Desktop is `<OneDrive>\Desktop` and `%USERPROFILE%\Desktop` may not exist at all. No
+ * registry read is needed for that.
+ */
+export function resolveDesktopDir(env = process.env) {
+    const candidates = [
+        env.OneDriveCommercial ? join(env.OneDriveCommercial, 'Desktop') : null,
+        env.OneDrive ? join(env.OneDrive, 'Desktop') : null,
+        join(env.USERPROFILE ?? homedir(), 'Desktop'),
+    ].filter((c) => Boolean(c));
+    for (const c of candidates) {
+        if (existsSync(c))
+            return c;
+    }
+    return candidates[candidates.length - 1];
+}
+/** Whether the resolved Desktop is inside OneDrive, so what is saved there also reaches the cloud. */
+export function desktopIsSynced(env = process.env) {
+    return isInsideOneDrive(resolveDesktopDir(env), env);
+}
+/** Whether a folder sits inside a local OneDrive root. */
+export function isInsideOneDrive(dir, env = process.env) {
+    const roots = [env.OneDriveCommercial, env.OneDrive, env.OneDriveConsumer].filter((r) => Boolean(r && r.trim()));
+    const target = resolve(dir).toLowerCase();
+    return roots.some((r) => {
+        const root = resolve(r).toLowerCase();
+        return target === root || target.startsWith(root + sep);
+    });
+}

package/dist/src/exec/authorizer.js

@@ -14,10 +14,18 @@ import { stdin, stdout } from 'node:process';
  * step. Only for unattended runs — a watched run shows the fetch like every other step, and the
  * person reading it is the whole point of watching. `cfg` is read on every call, not captured, so
  * a run switched to unattended half-way is judged as one from its next step on.
+ *
+ * `signal` is the run's Stop, and it is asked first, before any rule and before the mode: a step
+ * proposed after Stop is aborted in every mode. It used to be asked only inside `ask`, which an
+ * unattended run never reaches, so in a run started unattended — or switched to it by "run the rest
+ * without asking" — a Stop that landed between the runner's own look at the signal and this answer
+ * let one more step run.
  */
-export function makeAuthorizer(cfg, ask) {
+export function makeAuthorizer(cfg, ask, signal) {
     return {
         async authorize(step, ctx) {
+            if (signal?.aborted)
+                return { action: 'abort', reason: 'stopped by the operator', by: 'operator' };
             const blocked = staticCheck(step, cfg, undefined, ctx.confinement);
             if (blocked)
                 return blocked;

package/dist/src/exec/checks.js

@@ -16,8 +16,10 @@
 import { readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
+import { createContext, Script } from 'node:vm';
 import { isWithin } from './confinement.js';
-import { runStep } from './runner.js';
+import { MAX_CAPTURE_CHARS, runStep } from './runner.js';
+import { findRedactions, mergeRedactions, redactSecrets } from './redaction.js';
 import { resolveShell } from './shells.js';
 import { repoState, workingTreePaths } from '../vcs/git.js';
 import { findSuspicious, suspiciousDetail } from '../vcs/commitHygiene.js';
@@ -34,7 +36,13 @@ export const CONTENT_CLEAN_CHECK = { name: 'the text written is clean: encoding,
 /** The checks the runner adds by itself before a commit, rather than ones a plan wrote. */
 export const RUNNER_CHECK_KINDS = new Set(['commit-clean', 'content-clean']);
 const DEFAULT_CHECK_TIMEOUT_MS = 10 * 60 * 1000;
-/** How much of a command's output travels back to the chat with a failure. */
+/**
+ * How much of a command's output travels back to the chat with a failure.
+ *
+ * Only what travels: a verdict is never taken on this shortened text. An output check is a claim
+ * about everything the command printed, and a marker printed after the first few thousand
+ * characters — the FAIL line at the end of a test run — is exactly the one it exists to see.
+ */
 const OUTPUT_KEPT = 4000;
 function shorten(text, max = OUTPUT_KEPT) {
     const trimmed = text.trim();
@@ -44,6 +52,149 @@ function shorten(text, max = OUTPUT_KEPT) {
 function needsCommand(check) {
     return check.expect === 'exit-zero' || check.expect === 'exit-nonzero' || check.expect.startsWith('output-');
 }
+/**
+ * How long a check's pattern may spend on the output, all of it together, before the check is given
+ * up as undecidable.
+ *
+ * The pattern is written by whoever wrote the check, often a model, and some patterns cost a
+ * backtracking engine quadratic time or worse: `.*passed` on one line of 150,000 characters runs for
+ * half a minute, and on two full streams for minutes. It runs on the server's event loop, which is
+ * also the interface, Stop, the live log and the chat's timers, and every one of them stood still
+ * with it. A pattern that suits the output it is tried on is done in milliseconds; one that needs
+ * seconds is not going to finish.
+ */
+const PATTERN_BUDGET_MS = 5_000;
+/** Compiles the check's pattern inside its context. `source` is a value there, never code. */
+const COMPILE_PATTERN = new Script('re = new RegExp(source, "m")');
+/** Whether any of `texts` matches it. */
+const TRY_PATTERN = new Script('texts.some((t) => re.test(t))');
+/**
+ * A check's regular expression, run on a clock.
+ *
+ * V8 cannot be told to give up on a regular expression, but a script run in a `vm` context can be
+ * interrupted when its time is up, and a regular expression running inside one is interrupted with
+ * it. So the pattern is compiled and tried there, each try against what is left of one budget. A try
+ * that runs out of it, or that the engine abandons by itself, leaves the pattern undecided: whether
+ * the output matches is then not known, and the check says so rather than guessing either way.
+ */
+class TimedPattern {
+    context;
+    leftMs = PATTERN_BUDGET_MS;
+    /** Set once any text tried has matched. */
+    matched = false;
+    /** Why the pattern could not be tried to the end, once it could not. */
+    stopped = null;
+    /** Throws, with the engine's own message, when the source is not a regular expression. */
+    constructor(source) {
+        this.context = createContext({ source, texts: [] });
+        COMPILE_PATTERN.runInContext(this.context);
+    }
+    /** Whether the answer is already known: it matched, or it cannot be found out. */
+    get settled() {
+        return this.matched || this.stopped !== null;
+    }
+    /** Tries the texts unless the answer is already known; true once any text tried has matched. */
+    tryOn(texts) {
+        if (this.settled || texts.length === 0)
+            return this.matched;
+        if (this.leftMs <= 0) {
+            this.stopped = this.overtime();
+            return false;
+        }
+        const started = Date.now();
+        this.context.texts = texts;
+        try {
+            this.matched = TRY_PATTERN.runInContext(this.context, { timeout: this.leftMs }) === true;
+        }
+        catch (e) {
+            this.stopped =
+                e.code === 'ERR_SCRIPT_EXECUTION_TIMEOUT'
+                    ? this.overtime()
+                    : `the pattern could not be run to the end (${e.message})`;
+        }
+        finally {
+            this.leftMs -= Date.now() - started;
+            this.context.texts = [];
+        }
+        return this.matched;
+    }
+    overtime() {
+        return (`the pattern ran for more than ${PATTERN_BUDGET_MS / 1000} s on the output and was stopped ` +
+            '(a pattern such as `.*x` can take minutes on one long line)');
+    }
+}
+/**
+ * For output-contains and output-omits: whether the text appears anywhere in either stream.
+ *
+ * Exact, in bounded memory: each piece is searched together with the last `value.length - 1`
+ * characters of its stream before it, so a text that arrived cut in two is still found whole.
+ */
+function watchForText(value) {
+    const carried = { out: '', err: '' };
+    let found = value === '';
+    return {
+        found: () => found,
+        see: (text, stream) => {
+            if (found)
+                return;
+            const joined = carried[stream] + text;
+            if (joined.includes(value))
+                found = true;
+            else
+                carried[stream] = value.length > 1 ? joined.slice(1 - value.length) : '';
+        },
+        end: () => undefined,
+    };
+}
+/**
+ * For output-matches: the pattern on every line of the output that is not wholly in the part kept.
+ *
+ * The part kept is tried afterwards as one text, as it always was, so a pattern written to span lines
+ * still can there. Past it there is no text, only a stream, and a line is the unit a pattern with `^`
+ * and `$` is written against, so each line is tried as it ends. A line longer than MAX_CAPTURE_CHARS
+ * is tried as far as that and the rest of it passed over, so memory stays bounded whatever a program
+ * prints; `partLine` says when that happened.
+ */
+function watchForPattern(pattern) {
+    const held = { out: '', err: '' };
+    const received = { out: 0, err: 0 };
+    const skipping = { out: false, err: false };
+    let partLine = false;
+    // A line that ends inside the part kept is in the text tried afterwards; trying it here as well
+    // would only spend the budget twice.
+    const pastKept = (end) => end > MAX_CAPTURE_CHARS;
+    return {
+        partLine: () => partLine,
+        see: (text, stream) => {
+            const at = received[stream];
+            received[stream] += text.length;
+            if (pattern.settled)
+                return;
+            const ended = [];
+            let start = 0;
+            for (let nl = text.indexOf('\n'); nl >= 0; nl = text.indexOf('\n', start)) {
+                if (skipping[stream])
+                    skipping[stream] = false;
+                else if (pastKept(at + nl))
+                    ended.push(held[stream] + text.slice(start, nl));
+                held[stream] = '';
+                start = nl + 1;
+            }
+            if (!skipping[stream]) {
+                held[stream] += text.slice(start);
+                if (held[stream].length > MAX_CAPTURE_CHARS) {
+                    ended.push(held[stream]);
+                    held[stream] = '';
+                    skipping[stream] = true;
+                    partLine = true;
+                }
+            }
+            pattern.tryOn(ended);
+        },
+        // The last line of a stream need not end in a newline; it has ended all the same.
+        end: () => pattern.tryOn(['out', 'err'].filter((s) => held[s] !== '' && pastKept(received[s])).map((s) => held[s])),
+    };
+}
 /**
  * One check, decided.
  *
@@ -52,8 +203,30 @@ function needsCommand(check) {
  * a gate that opens when it breaks, which is the one behaviour a gate must never have.
  */
 export async function runCheck(check, index, opts) {
-    const fail = (detail, extra = {}) => ({ check, passed: false, detail, ...extra });
-    const pass = (detail, extra = {}) => ({ check, passed: true, detail, ...extra });
+    /*
+     * What an outcome says is quoted to the chat by more than one caller — the checks message, the
+     * reviewer's brief ("Last result"), the message that turns down a reviewer's check — and it
+     * repeats the value the check looked for and the output it saw. So it is redacted where it is
+     * made, once, rather than at each place that happens to quote it — with the operator's own
+     * patterns as well as the built-in shapes, which until 2026-10-01 only the checks file got, so a
+     * company's key format reached the chat in every message beside it. What was taken out is kept
+     * on the outcome, for the event that says so.
+     */
+    const patterns = opts.redactPatterns ?? [];
+    const said = (outcome) => {
+        const found = mergeRedactions([
+            findRedactions(outcome.detail, patterns),
+            outcome.output !== undefined ? findRedactions(outcome.output, patterns) : [],
+        ]);
+        return {
+            ...outcome,
+            detail: redactSecrets(outcome.detail, patterns),
+            ...(outcome.output !== undefined ? { output: redactSecrets(outcome.output, patterns) } : {}),
+            ...(found.length > 0 ? { redactions: found } : {}),
+        };
+    };
+    const fail = (detail, extra = {}) => said({ check, passed: false, detail, ...extra });
+    const pass = (detail, extra = {}) => said({ check, passed: true, detail, ...extra });
     if (check.expect === 'commit-clean') {
         const dir = (opts.repoDir ?? '').trim();
         if (!dir)
@@ -111,6 +284,21 @@ export async function runCheck(check, index, opts) {
         const refused = opts.deny?.(command, shell, cwd);
         if (refused)
             return fail(`the command was refused before it ran: ${refused}`, { refusedBeforeRunning: true });
+        // A pattern that is not one is known before anything runs, and running the command anyway would
+        // spend a test suite's minutes on a verdict that cannot be taken.
+        const value = check.value ?? '';
+        let pattern = null;
+        if (check.expect === 'output-matches') {
+            try {
+                pattern = new TimedPattern(value);
+            }
+            catch (e) {
+                return fail(`the pattern is not a valid regular expression: ${e.message}`);
+            }
+        }
+        const text = watchForText(value);
+        const lines = pattern ? watchForPattern(pattern) : null;
+        const watch = lines ?? (check.expect.startsWith('output-') ? text : null);
         let result;
         try {
             result = await runStep({
@@ -124,13 +312,16 @@ export async function runCheck(check, index, opts) {
                 hardTimeoutMs: opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS,
                 logPath: join(opts.logDir, `check-${index + 1}.txt`),
                 passEnv: opts.passEnv,
-            }, { signal: opts.signal, tracker: opts.tracker });
+            }, { signal: opts.signal, tracker: opts.tracker, onOutput: watch?.see });
         }
         catch (e) {
             return fail(`the check could not be run: ${e.message}`);
         }
-        const output = shorten(`${result.stdout}${result.stderr ? `\n${result.stderr}` : ''}`);
-        const seen = { exitCode: result.exitCode, output, shell: result.shell, shellPath: result.shellPath };
+        watch?.end();
+        // What the runner kept: shortened, it is the copy that is reported, and whole it is the one text
+        // a pattern is tried on. The verdict on a text is taken by the watch, which saw all of it.
+        const output = `${result.stdout}${result.stderr ? `\n${result.stderr}` : ''}`.trim();
+        const seen = { exitCode: result.exitCode, output: shorten(output), shell: result.shell, shellPath: result.shellPath };
         // The shell was there when the run began and would not start when it was wanted. Nothing
         // about the work has been learned, so this is reported as what it is rather than as a
         // command that failed.
@@ -150,24 +341,30 @@ export async function runCheck(check, index, opts) {
                     ? pass(`the command failed, as expected (exit ${result.exitCode})`, seen)
                     : fail('expected the command to fail, but it succeeded', seen);
             case 'output-contains':
-                return output.includes(check.value ?? '')
+                return text.found()
                     ? pass(`the output contains "${check.value}"`, seen)
                     : fail(`expected the output to contain "${check.value}", and it does not`, seen);
             case 'output-omits':
-                return output.includes(check.value ?? '')
+                return text.found()
                     ? fail(`expected the output not to contain "${check.value}", but it does`, seen)
                     : pass(`the output does not contain "${check.value}"`, seen);
             case 'output-matches': {
-                let re;
-                try {
-                    re = new RegExp(check.value ?? '', 'm');
-                }
-                catch (e) {
-                    return fail(`the pattern is not a valid regular expression: ${e.message}`, seen);
-                }
-                return re.test(output)
-                    ? pass(`the output matches /${check.value}/`, seen)
-                    : fail(`expected the output to match /${check.value}/, and it does not`, seen);
+                // The lines past the part kept were tried as they came; the part kept is tried now, as one
+                // text. A pattern that cannot be run is a check that fails, never one that passes.
+                if (pattern?.tryOn([output]))
+                    return pass(`the output matches /${check.value}/`, seen);
+                if (pattern?.stopped)
+                    return fail(`whether the output matches /${check.value}/ cannot be decided: ${pattern.stopped}`, seen);
+                /*
+                 * Said plainly when it is not the whole truth. Past what the runner keeps, the output was
+                 * tried a line at a time, so a match spanning lines there, or in a line longer than the
+                 * runner keeps, was not looked for; the chat is told so, rather than told the text is absent.
+                 */
+                const how = result.truncated
+                    ? ` (past the first ${MAX_CAPTURE_CHARS} characters of each stream the output was tried a line at a time, so a match ` +
+                        `spanning lines there was not looked for${lines?.partLine() ? `, nor one past the first ${MAX_CAPTURE_CHARS} characters of a longer line` : ''})`
+                    : '';
+                return fail(`expected the output to match /${check.value}/, and it does not${how}`, seen);
             }
             default:
                 return fail(`unknown check kind "${check.expect}"`, seen);
@@ -238,8 +435,15 @@ export function describeCheck(check) {
  * Written as an instruction rather than as a complaint: it says what was asked, what happened,
  * and that the task is not over. The full output is attached as a file by the caller, the same
  * way step output is, because a chat message is the wrong place for a compiler's opinion.
+ *
+ * It quotes the checks themselves — the command, the value looked for, the detail that repeats
+ * it — and a plan may well carry a token in one of them, so it leaves here with every
+ * secret-shaped string already redacted (see `redaction.ts`). It used to be redacted only where a
+ * caller remembered to, which for this message was nowhere. The operator's own patterns are applied
+ * on top when the caller passes them (`report.redactPatterns`; this module does not read the
+ * settings): left to the caller, they were applied to the file beside this message and not to it.
  */
-export function failureMessage(outcomes, round, maxRounds) {
+export function failureMessage(outcomes, round, maxRounds, extraPatterns = []) {
     const failed = outcomes.filter((o) => !o.passed);
     const lines = [
         '## The task is not finished yet',
@@ -271,10 +475,23 @@ export function failureMessage(outcomes, round, maxRounds) {
     lines.push(`Fix what is failing and continue. Send steps as usual; do not report the task as done again until you ` +
         `have reason to believe these checks will pass. This is attempt ${round} of ${maxRounds}: after that the ` +
         'task is closed as failed and the operator reads it.');
-    return lines.join('\n');
+    return redactSecrets(lines.join('\n'), extraPatterns);
+}
+/** The same, as the plain text file that travels with the message, redacted here for the same reason. */
+export function failureReport(outcomes, extraPatterns = []) {
+    return redactSecrets(reportText(outcomes), extraPatterns);
+}
+/**
+ * What a round's checks file and message had taken out, by name, for the event that says so: what
+ * each outcome's own words lost where they were made (see `runCheck`), and what the checks' words
+ * — the name, the command, the value, the file — lose in the file. The file quotes everything the
+ * message does, so it stands for both, and a secret the two of them carry is counted once.
+ */
+export function failureRedactions(outcomes, extraPatterns = []) {
+    return mergeRedactions([...outcomes.map((o) => o.redactions ?? []), findRedactions(reportText(outcomes), extraPatterns)]);
 }
-/** The same, as the plain text file that travels with the message. */
-export function failureReport(outcomes) {
+/** The checks file before it is redacted. What its outcomes say already is, where it was made. */
+function reportText(outcomes) {
     const parts = ['CHECKS THAT DID NOT PASS', '='.repeat(60), ''];
     for (const o of outcomes.filter((x) => !x.passed)) {
         parts.push(`CHECK : ${o.check.name}`);

package/dist/src/exec/dangerous.js

@@ -97,10 +97,20 @@ export const DANGEROUS_TECHNIQUES = [
     },
     {
         name: 'run-from-temp',
-        // Any path with a Temp component, however it is spelled — `%TEMP%`, `$env:TEMP`,
-        // `$env:LOCALAPPDATA\\Temp`, `C:\\Windows\\Temp`, `/tmp/`. Matching the one literal spelling
-        // `\\AppData\\Local\\Temp` was matching one of several.
-        pattern: /(%TEMP%|\$env:TEMP|[\\\/]Temp[\\\/]|\/tmp\/)[^\s"';|]*\.(exe|js|jse|vbs|vbe|ps1|bat|cmd|hta|wsf|scr|dll|msi)\b/i,
+        /*
+         * The system's Temp, however it is spelled: `%TEMP%` and `%TMP%`, `$env:TEMP`, `$env:TMP` and
+         * `${env:TEMP}`, Temp under `%LOCALAPPDATA%`, `%SystemRoot%`, `%windir%` or their `$env:` forms,
+         * any `AppData\Local\Temp`, `C:\Temp`, `C:\tmp` and `C:\Windows\Temp` on any drive, and a `/tmp/`
+         * that starts a path. Matching the one literal spelling `\AppData\Local\Temp` was matching one
+         * of several.
+         *
+         * Only those. A folder of the project's own called `temp` or `tmp` — `.\temp\seed.js`,
+         * `test/tmp/fixture.test.js` — is where a project keeps its seed scripts and fixtures, and
+         * refusing it refused honest work in a rule nobody can switch off (found on 2026-10-01, when any
+         * path segment named temp counted). The variable names end at a word boundary, so
+         * `$env:TEMPLATE_DIR` is not Temp either.
+         */
+        pattern: /(%(?:TEMP|TMP)%|\$\{?env:(?:TEMP|TMP)\b\}?|(?:%(?:LOCALAPPDATA|SystemRoot|windir)%|\$\{?env:(?:LOCALAPPDATA|SystemRoot|windir)\b\}?)[\\\/]Temp[\\\/]|AppData[\\\/]Local[\\\/]Temp[\\\/]|\b[A-Za-z]:[\\\/](?:(?:Windows[\\\/])?Temp|tmp)[\\\/]|(?:^|[\s"'=(])\/tmp\/)[^\s"';|]*\.(exe|js|jse|vbs|vbe|ps1|bat|cmd|hta|wsf|scr|dll|msi)\b/i,
         why: 'this runner never executes anything out of Temp, and it downloads nothing: the code a task runs is written into the project by a command step. A binary or script run from Temp is the shape of a dropper.',
     },
     {
@@ -122,8 +132,22 @@ export const DANGEROUS_TECHNIQUES = [
          * asks the shell to "open" something. Asking is how a `.hta`, a `.js` or a `.lnk` ends up run by
          * `mshta`, the script host or whatever a shortcut points at, under this runner as the parent,
          * and how a page ends up in the signed-in browser with the bot's process behind it.
+         *
+         * `Invoke-Item` is matched wherever it is written, with or without an argument, since the name
+         * never turns up in prose. `ii` is an ordinary word — "phase ii", "Type II error", a list's
+         * "(ii)" — and matching it anywhere refused honest lines (found on 2026-10-01), so it is matched
+         * only where PowerShell runs it as a command: after a pipe, at the start of a statement or a
+         * block (`;`, `&`, `(`, `{`, a new line, an assignment) with something to open, or at the start
+         * of a nested `pwsh`/`powershell`'s command string, which is a command line of its own: after its
+         * `-Command` (`-c` and the other short forms, given on the line or in an `-ArgumentList`), or,
+         * with no `-File` before it, as its first word after its switches, which Windows PowerShell runs
+         * as a command. Within that string, the pipe, statement and block cases above find the rest.
+         *
+         * Not anywhere after the shell's name: matched so, it refused `Write-Host "Configuring
+         * PowerShell, part ii"`, where PowerShell is a word in a message, and `pwsh -File
+         * .\migrate.ps1 -Phase ii`, where the words after the script are its own parameters.
          */
-        pattern: /\b(Invoke-Item|ii)\s+\S|\b(Start-Process|saps|start)\s+(?:-\w+\s+)*(?:-FilePath\s+)?["']?(?:[^\s"']+\.(hta|vbs|vbe|js|jse|wsf|wsh|lnk|url|scr|cpl|msc|reg|inf|msi|msp|chm|pif)\b|https?:\/\/|ms-\w+:|file:\/\/)/i,
+        pattern: /\bInvoke-Item\b|\|\s*ii(?![\w.\-:\\\/])|(?:^|[;&({\n]|\$[\w:.{}\[\]]+\s*=)\s*[.&]?\s*ii(?:\s+[^\s;|&)}]|\()|\b(?:pwsh|powershell)(?:\.exe)?\b(?:(?:(?![\s'"]-f)[^|;\n])*?[\s'"]-(?:c|co|com|comm|comma|comman|command)\b['"]?(?:\s*,\s*|\s+)|(?:\s+-(?!f)\w+(?::\S+)?(?:\s+(?![-'"])[\w.]+)?)*\s+)["']?ii(?![\w.\-:\\\/])|\b(Start-Process|saps|start)\s+(?:-\w+\s+)*(?:-FilePath\s+)?["']?(?:[^\s"']+\.(hta|vbs|vbe|js|jse|wsf|wsh|lnk|url|scr|cpl|msc|reg|inf|msi|msp|chm|pif)\b|https?:\/\/|ms-\w+:|file:\/\/)/i,
         why: 'a file opened through its registered handler, or a URL opened in the browser, runs whatever Windows has registered for it under this runner. Start the program itself, by name, with the file as its argument.',
     },
     {