openplanr 2.2641.1 → 2.2641.2

package/lib/host-packages/cursor/openplanr/rules/planr-delegate/scripts/adapters/claude.mjs

@@ -18,9 +18,16 @@ const PROVIDER_VARIABLES = [
   'CLAUDE_CODE_USE_VERTEX',
   'CLAUDE_CODE_USE_FOUNDRY',
 ];
+const ROUTING_VARIABLES = ['ANTHROPIC_BASE_URL', ...PROVIDER_VARIABLES];
 
-// These values stay in trusted memory. Callers expose only source labels and origins.
-export async function readClaudeSettingsEnvironment(profile, env, cwd, options = {}) {
+function routingVariables(env) {
+  return Object.fromEntries(
+    ROUTING_VARIABLES.filter((name) => Object.hasOwn(env, name)).map((name) => [name, env[name]]),
+  );
+}
+
+// Keeps only routing variables from settings files; callers expose source labels and origins.
+async function readClaudeRoutingSettings(profile, env, cwd, options = {}) {
   const managedRoot =
     options.managedRoot ??
     (process.platform === 'darwin'
@@ -100,7 +107,7 @@ export async function readClaudeSettingsEnvironment(profile, env, cwd, options =
         throw new AdapterError('E_DESTINATION_UNKNOWN', 'Claude routing environment is malformed.');
       inspected.push({
         source,
-        env: settings.env ?? {},
+        env: routingVariables(settings.env ?? {}),
         ...(settings.policyHelper ? { opaqueRouting: true } : {}),
       });
     } catch (error) {
@@ -122,7 +129,7 @@ export async function readClaudeSettingsEnvironment(profile, env, cwd, options =
 }
 
 export async function resolveClaudeRouting(profile, env, cwd, options) {
-  const settings = await readClaudeSettingsEnvironment(profile, env, cwd, options);
+  const settings = await readClaudeRoutingSettings(profile, env, cwd, options);
   const sources = [{ source: 'parent environment', env }, ...settings];
   const candidates = [];
   const providerSources = [];

package/lib/host-packages/cursor/openplanr/rules/planr-delegate/scripts/adapters/native.mjs

@@ -122,7 +122,7 @@ export function safeNativeDiagnostic(value, destination) {
 }
 
 const ROUTING_SOURCE =
-  /^(?:parent environment|user settings|project settings|project local settings|managed file settings|managed fragment settings(?: \d{1,2})?)(?:: (?:ANTHROPIC_BASE_URL|CLAUDE_CODE_USE_BEDROCK|CLAUDE_CODE_USE_VERTEX|CLAUDE_CODE_USE_FOUNDRY|policyHelper|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_API_KEY))?$/u;
+  /^(?:parent environment|user settings|project settings|project local settings|managed file settings|managed fragment settings(?: \d{1,2})?)(?:: (?:ANTHROPIC_BASE_URL|CLAUDE_CODE_USE_BEDROCK|CLAUDE_CODE_USE_VERTEX|CLAUDE_CODE_USE_FOUNDRY|policyHelper))?$/u;
 
 function safeRoutingDestination(value) {
   if (value?.class === 'native-managed' && value.origin === 'native-managed')

package/lib/host-packages/cursor/openplanr/rules/planr-delegate/scripts/backend-diagnostics.mjs

@@ -1,40 +1,8 @@
 // Local probes are diagnostics; native CLI execution remains authoritative.
 
-import { readClaudeSettingsEnvironment, resolveClaudeRouting } from './adapters/claude.mjs';
+import { resolveClaudeRouting } from './adapters/claude.mjs';
 import { AdapterError, validateDestination } from './adapters/generic.mjs';
 
-async function localProbeToken(profile, env, cwd) {
-  const sources = [{ source: 'parent environment', env }];
-  const names = ['LM_STUDIO_API_KEY', 'LM_API_TOKEN'];
-  // Only Claude routing confirmed to this local origin may present its Anthropic token.
-  if (profile.kind === 'claude') {
-    sources.push(...(await readClaudeSettingsEnvironment(profile, env, cwd)));
-    names.push('ANTHROPIC_AUTH_TOKEN');
-  }
-  for (const name of names) {
-    const candidates = sources.filter(
-      (source) => source.env[name] !== undefined && source.env[name] !== '',
-    );
-    if (!candidates.length) continue;
-    const values = candidates.map((source) => source.env[name]);
-    if (
-      values.some(
-        (value) => typeof value !== 'string' || value.length >= 4096 || /[\r\n]/u.test(value),
-      ) ||
-      new Set(values).size !== 1
-    )
-      throw new AdapterError(
-        'E_BACKEND_AUTH_CONFIG',
-        'Local metadata authentication could not be confirmed.',
-        {
-          sources: candidates.map((source) => `${source.source}: ${name}`),
-        },
-      );
-    return values[0];
-  }
-  return null;
-}
-
 async function withinDeadline(operation, signal) {
   if (signal.aborted)
     throw new AdapterError('E_BACKEND_TIMEOUT', 'Local model metadata inspection timed out.');
@@ -106,9 +74,8 @@ export async function inspectLocalBackend(
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   const signal = controller.signal;
   try {
-    let token;
-    try {
-      if (profile.kind === 'claude') {
+    if (profile.kind === 'claude') {
+      try {
         const resolved = await resolveClaudeRouting(profile, env, cwd);
         if (
           resolved.destination.class !== 'local' ||
@@ -122,22 +89,21 @@ export async function inspectLocalBackend(
               routing: resolved.routing,
             },
           );
+      } catch (error) {
+        return {
+          status: 'not-checked',
+          modelStatus: 'unverified',
+          selectedModel,
+          visibleModels: [],
+          diagnostic: { code: error.code ?? 'E_DESTINATION_UNKNOWN', ...error.details },
+        };
       }
-      token = await localProbeToken(profile, env, cwd);
-    } catch (error) {
-      return {
-        status: 'not-checked',
-        modelStatus: 'unverified',
-        selectedModel,
-        visibleModels: [],
-        diagnostic: { code: error.code ?? 'E_BACKEND_AUTH_CONFIG', ...error.details },
-      };
     }
+    // Sends no credentials: a server that requires sign-in reports authentication-required.
     const readModels = async (path) => {
       const response = await withinDeadline(
         fetchImpl(new URL(path, profile.destination.origin), {
           method: 'GET',
-          ...(token ? { headers: { Authorization: `Bearer ${token}` } } : {}),
           signal,
           redirect: 'error',
         }),
@@ -269,9 +235,9 @@ export function profileReadiness(destination, backend) {
   if (backend.status === 'authentication-required') {
     return {
       state: 'authentication-required',
-      dispatchable: false,
+      dispatchable: true,
       nextAction:
-        'Provide the local server token through an allowed environment variable, then probe again.',
+        'The local server requires sign-in, so its models were not checked. The delegated CLI signs in with its own configuration.',
     };
   }
   if (backend.modelStatus === 'not-listed') {

package/lib/host-packages/cursor/openplanr/rules/planr-delegate/scripts/context.mjs

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { lstat, mkdir, readdir, readFile, realpath, stat, writeFile } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { classifyCredentials, credentialSyntax, resolveFindings } from './credentials.mjs';
 
 export const CAPSULE_SCHEMA_VERSION = '1.0.0';
 
@@ -12,19 +13,14 @@ const DEFAULT_LIMITS = Object.freeze({
 const SECRET_NAME =
   /^(?:\.env(?:\..*)?|\.envrc|\.netrc|\.git-credentials|\.npmrc|\.pypirc|id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?|credentials(?:\.[^.]+)?|service[-_]?account(?:\.[^.]+)?|.*\.(?:pem|p12|pfx|key|tfvars)(?:\.json)?)$/iu;
 const SECRET_SEGMENT = /^(?:\.ssh|\.aws|\.gnupg|\.kube)$/iu;
-const SECRET_VALUE =
-  /-----BEGIN (?:[A-Z ]* )?PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9_]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b|\bsk-(?:proj-)?[A-Za-z0-9_-]{24,}\b|\bxox[baprs]-[A-Za-z0-9-]{20,}\b|"private_key"\s*:\s*"-----BEGIN/iu;
-const SECRET_ASSIGNMENT =
-  /(?:^|[^A-Za-z0-9_])(?:[A-Za-z_][A-Za-z0-9_-]*?)?(?:API[_-]?KEY|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET|PRIVATE[_-]?KEY|PASSWORD|TOKEN|SECRET(?:[_-]?KEY)?)["']?\s*[:=]\s*(["'`])((?:(?!\1|\$\{)[^\r\n\\]|\\.){16,})\1/giu;
-const SECRET_CONFIG_ASSIGNMENT =
-  /^[ \t]*(?:export[ \t]+)?(?:[A-Za-z_][A-Za-z0-9_-]*?)?(?:API[_-]?KEY|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET|PRIVATE[_-]?KEY|PASSWORD|TOKEN|SECRET(?:[_-]?KEY)?)[ \t]*[:=][ \t]*(?!process\.env(?:\.|\[)|import\.meta\.env(?:\.|\[)|Deno\.env\.|os\.environ|env\.)([^\s"'`#()\[\]{}$]{16,})[ \t]*(?:#[^\r\n]*)?\r?$/gimu;
-const CREDENTIAL_PLACEHOLDER =
-  /^(?:example(?:[-_].*)?|placeholder(?:[-_].*)?|your[-_].*|(?:change|replace)[-_]me(?:[-_].*)?|(?:dummy|fake|mock|test|never[-_]return)[-_](?:api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|password|token|secret(?:[-_]?key)?))$/iu;
 const TASK_ID = /^(?:T|TASK|QT)-\d{3,}$/u;
 const STORY_ID = /^US-\d{3,}$/u;
 const SPEC_ID = /^SPEC-\d{3,}$/u;
 const FEATURE_ID = /^FEAT-\d{3,}$/u;
 const EPIC_ID = /^EPIC-\d{3,}$/u;
+// Credential findings of an optional omission, keyed by the omission entry. The delegate reads
+// the written capsule, so they reach only the parent's preview.
+const OMISSION_FINDINGS = new WeakMap();
 
 export class CapsuleError extends Error {
   constructor(code, message, details = {}) {
@@ -68,14 +64,9 @@ function isSecretPath(path) {
   return parts.some((part) => SECRET_SEGMENT.test(part)) || SECRET_NAME.test(parts.at(-1));
 }
 
+/** True when free text holds credential material; source files are classified by their syntax. */
 export function containsSecret(bytes) {
-  const content = bytes.toString('utf8');
-  if (SECRET_VALUE.test(content)) return true;
-  for (const match of content.matchAll(SECRET_ASSIGNMENT))
-    if (!CREDENTIAL_PLACEHOLDER.test(match[2])) return true;
-  for (const match of content.matchAll(SECRET_CONFIG_ASSIGNMENT))
-    if (!CREDENTIAL_PLACEHOLDER.test(match[1])) return true;
-  return false;
+  return classifyCredentials(bytes).findings.length > 0;
 }
 
 export function assertCredentialFreeText(
@@ -84,10 +75,34 @@ export function assertCredentialFreeText(
 ) {
   if (typeof value !== 'string')
     throw new CapsuleError('E_CAPSULE_INPUT', `${label} must be text.`);
-  if (containsSecret(Buffer.from(value, 'utf8')))
+  const { contentDigest, findings } = classifyCredentials(Buffer.from(value, 'utf8'), {
+    label,
+    resolvable: false,
+  });
+  if (findings.length)
     throw new CapsuleError(
       code,
       `${label} contains credential material; use native configuration or credential environment references instead.`,
+      { findings, contentDigest },
+    );
+  return value;
+}
+
+function credentialResolutionList(value) {
+  if (
+    !Array.isArray(value) ||
+    value.length > 64 ||
+    value.some(
+      (resolution) =>
+        !resolution ||
+        typeof resolution !== 'object' ||
+        !/^cred_[a-f0-9]{16}$/u.test(resolution.id ?? '') ||
+        !/^sha256:[a-f0-9]{64}$/u.test(resolution.contentDigest ?? ''),
+    )
+  )
+    throw new CapsuleError(
+      'E_CAPSULE_INPUT',
+      'Credential resolutions must list at most 64 { id, contentDigest } entries from reported findings.',
     );
   return value;
 }
@@ -312,8 +327,22 @@ export async function buildContextCapsule({
   optionalFiles = [],
   readOnlyRepositories = [],
   limits,
+  credentialResolutions = [],
 } = {}) {
   if (!repositoryRoot) throw new CapsuleError('E_CAPSULE_SOURCE', 'repositoryRoot is required.');
+  const resolutions = credentialResolutionList(credentialResolutions);
+  const appliedResolutions = [];
+  const credentialCheck = (bytes, origin) => {
+    const classification = classifyCredentials(bytes, origin);
+    return {
+      ...resolveFindings(classification, resolutions),
+      contentDigest: classification.contentDigest,
+    };
+  };
+  const recordResolutions = ({ applied, contentDigest }, source) => {
+    for (const { id, rule, location } of applied)
+      appliedResolutions.push({ id, contentDigest, ...source, rule, location });
+  };
   if (request !== undefined && typeof request !== 'string')
     throw new CapsuleError('E_CAPSULE_INPUT', 'A direct request must be text.');
   if (Boolean(taskSelector) === Boolean(request?.trim())) {
@@ -354,8 +383,18 @@ export async function buildContextCapsule({
   if (request && Buffer.byteLength(request, 'utf8') > bounds.maxFileBytes) {
     throw new CapsuleError('E_CAPSULE_LIMIT', 'The direct request exceeds the capsule text limit.');
   }
-  if (request && containsSecret(Buffer.from(request, 'utf8'))) {
-    throw new CapsuleError('E_CAPSULE_SECRET', 'The direct request contains credential material.');
+  if (request) {
+    const credentials = credentialCheck(Buffer.from(request, 'utf8'), { label: 'request' });
+    if (credentials.remaining.length)
+      throw new CapsuleError(
+        'E_CAPSULE_SECRET',
+        'The direct request contains credential material.',
+        {
+          findings: credentials.remaining,
+          contentDigest: credentials.contentDigest,
+        },
+      );
+    recordResolutions(credentials, { source: 'request' });
   }
   const roots = await sourceRoots(repositoryRoot, readOnlyRepositories);
   const project = roots.get('project').physical;
@@ -381,9 +420,16 @@ export async function buildContextCapsule({
       return prior;
     }
     const optionalOmission = (reason) => {
-      if (required) throw new CapsuleError(reason.code, reason.message, { repositoryKey, path });
+      if (required)
+        throw new CapsuleError(reason.code, reason.message, {
+          repositoryKey,
+          path,
+          ...reason.details,
+        });
       if (!omitted.has(key)) {
-        omissions.push({ repositoryKey, path, role, reason: reason.code });
+        const omission = { repositoryKey, path, role, reason: reason.code };
+        if (reason.details) OMISSION_FINDINGS.set(omission, reason.details);
+        omissions.push(omission);
         omitted.add(key);
       }
       return null;
@@ -467,11 +513,20 @@ export async function buildContextCapsule({
         message: `Required source exceeds capsule limits: ${path}`,
       });
     }
-    if (containsSecret(bytes))
+    // A link reads as its target's syntax, or as configuration when either path is configuration.
+    const syntaxes = [path, relative(allowed, physical).split(sep).join('/')].map(credentialSyntax);
+    const credentials = credentialCheck(bytes, {
+      path,
+      label: `${repositoryKey}/${path}`,
+      syntax: syntaxes.includes('config') ? 'config' : syntaxes[1],
+    });
+    if (credentials.remaining.length)
       return optionalOmission({
         code: 'E_CAPSULE_SECRET',
         message: `Credential material detected in source: ${path}`,
+        details: { findings: credentials.remaining, contentDigest: credentials.contentDigest },
       });
+    recordResolutions(credentials, { repositoryKey, path });
     const copy = {
       repositoryKey,
       path,
@@ -686,6 +741,7 @@ export async function buildContextCapsule({
     inventory,
     files,
     omissions,
+    ...(appliedResolutions.length ? { credentialResolutions: appliedResolutions } : {}),
     planning: {
       logicalPath: join(project, '.planr'),
       physicalPath: roots.get('project').planning,
@@ -731,7 +787,13 @@ export function previewContextCapsule(capsule) {
     mode: capsule.mode,
     selector: capsule.selector,
     inventory: capsule.inventory,
-    omissions: capsule.omissions,
+    omissions: capsule.omissions.map((omission) => ({
+      ...omission,
+      ...OMISSION_FINDINGS.get(omission),
+    })),
+    ...(capsule.credentialResolutions
+      ? { credentialResolutions: capsule.credentialResolutions }
+      : {}),
     blockers: [],
     planning: capsule.planning ?? null,
     sourceKeys: capsule.sourceKeys,

package/lib/host-packages/cursor/openplanr/rules/planr-delegate/scripts/credentials.mjs

@@ -0,0 +1,167 @@
+// Credential classification for delegated context. Findings never carry the matched value.
+import { createHash } from 'node:crypto';
+
+/**
+ * Recognizable credential formats; rejected everywhere, including tests and placeholders.
+ * Case-sensitive: each prefix has a fixed case, and `github_pat_` and `sk-` bodies need an
+ * uppercase letter or digit.
+ */
+export const CREDENTIAL_FORMAT =
+  /-----BEGIN (?:[A-Z ]* )?PRIVATE KEY(?: BLOCK)?-----|"private_key"\s*:\s*"-----BEGIN|(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}\b|(?<![A-Za-z0-9])gh[pousr]_[A-Za-z0-9]{20,}(?![A-Za-z0-9])|(?<![A-Za-z0-9])github_pat_(?=[A-Za-z0-9_]*[A-Z0-9])[A-Za-z0-9_]{20,}\b|(?<![A-Za-z0-9])sk-(?:proj-)?(?=[A-Za-z0-9_-]*[A-Z0-9])[A-Za-z0-9_-]{24,}\b|(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{20,}/u;
+
+// `word` is the credential word findings report as `key`; the rest of a name may hold a value.
+const CREDENTIAL_NAME =
+  '(?<name>(?:[A-Za-z_][A-Za-z0-9_-]*?)?(?<word>API[_-]?KEY|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET|PRIVATE[_-]?KEY|PASSWORD|TOKEN|SECRET(?:[_-]?KEY)?))';
+const QUOTED_ASSIGNMENT = new RegExp(
+  `(?:^|[^A-Za-z0-9_])${CREDENTIAL_NAME}["']?\\s*[:=]\\s*(?<quote>["'\`])(?<value>(?:(?!\\k<quote>|\\$\\{)[^\\r\\n\\\\]|\\\\.){16,})\\k<quote>`,
+  'giu',
+);
+const UNQUOTED_ASSIGNMENT = new RegExp(
+  `^[ \\t]*(?<exported>export[ \\t]+)?${CREDENTIAL_NAME}(?<before>[ \\t]*)(?<operator>[:=])(?<after>[ \\t]*)(?!process\\.env(?:\\.|\\[)|import\\.meta\\.env(?:\\.|\\[)|Deno\\.env\\.|os\\.environ|env\\.)(?<value>[^\\s"'\`#()\\[\\]{}$]{16,})[ \\t]*(?:#[^\\r\\n]*)?\\r?$`,
+  'gimu',
+);
+const PLACEHOLDER =
+  /^(?:example(?:[-_].*)?|placeholder(?:[-_].*)?|your[-_].*|(?:change|replace)[-_]me(?:[-_].*)?|(?:dummy|fake|mock|test|never[-_]return)[-_](?:api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|password|token|secret(?:[-_]?key)?))$/iu;
+// A lowercase marker followed only by words and short numbers, one of them a credential noun.
+const DESCRIBED_PLACEHOLDER =
+  /^(?:dummy|fake|mock|test|fixture|synthetic|never[-_]return)(?:[-_. ](?:[a-z]+|\d{1,4}))+[-_.]?$/u;
+const CREDENTIAL_NOUN = /[-_. ](?:secret|key|token|password|credential)s?(?=[-_. ]|$)/u;
+const SHELL_NAME = /^[A-Z][A-Z0-9_]*$/u;
+const IDENTIFIER_WORD = /[A-Z]{2,}(?![a-z])\d{0,2}|[A-Z]?[a-z]+\d{0,2}|[A-Z]\d{0,2}|\d{1,2}/gu;
+
+const CODE_EXTENSIONS = new Set(
+  'c cc cjs cpp cs cts dart go groovy h hpp java js jsx kt kts lua m mjs mm mts php py rb rs scala svelte swift ts tsx vue'.split(
+    ' ',
+  ),
+);
+const CONFIG_EXTENSIONS = new Set(
+  'bash cfg conf env fish hcl ini json json5 jsonc properties ps1 sh tf toml xml yaml yml zsh'.split(
+    ' ',
+  ),
+);
+const CONFIG_NAMES = new Set(['dockerfile', 'makefile', 'procfile']);
+
+/** The syntax that decides whether an unquoted value is a literal: code, config, or free text. */
+export function credentialSyntax(path) {
+  if (typeof path !== 'string' || !path) return 'text';
+  const name = path.split('/').at(-1).toLowerCase();
+  if (CONFIG_NAMES.has(name) || name.startsWith('.env')) return 'config';
+  const extension = name.includes('.') ? name.split('.').at(-1) : '';
+  if (CODE_EXTENSIONS.has(extension)) return 'code';
+  if (CONFIG_EXTENSIONS.has(extension)) return 'config';
+  return 'text';
+}
+
+function sha256(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+function position(content, index) {
+  const before = content.slice(0, index);
+  return { line: before.split('\n').length, column: index - before.lastIndexOf('\n') };
+}
+
+// Reads like a code identifier: whole words, digits only at word ends, at most one one-letter word.
+function codeIdentifier(value) {
+  if (!/^[A-Za-z_$][\w$]*$/u.test(value) || value.length > 64) return false;
+  let singleLetters = 0;
+  for (const part of value.split(/[_$]+/u).filter(Boolean)) {
+    const words = part.match(IDENTIFIER_WORD) ?? [];
+    if (words.join('') !== part) return false;
+    singleLetters += words.filter((word) => word.replace(/\d+$/u, '').length <= 1).length;
+  }
+  return singleLetters <= 1;
+}
+
+function memberPath(value) {
+  const segments = value.replace(/!$/u, '').split(/[!?]?\./u);
+  return segments.length > 1 && segments.every(codeIdentifier);
+}
+
+// An unquoted value is a literal unless its syntax makes it a reference, type or expression.
+// Multi-line strings in code read like text, so an unterminated identifier stays a literal.
+function unquotedLiteral(raw, operator, syntax) {
+  if (syntax === 'config' || (syntax === 'text' && operator === '=')) return true;
+  const terminated = /[;,]$/u.test(raw);
+  const value = terminated ? raw.slice(0, -1) : raw;
+  if (memberPath(value)) return !(terminated || syntax === 'code');
+  return !(terminated && codeIdentifier(value));
+}
+
+// `export NAME=` is a shell line in any file, and so is an uppercase `NAME=value` without spaces
+// unless it ends in `,` like a keyword argument.
+function shellAssignment({ exported, name, before, operator, after, value }) {
+  if (exported) return true;
+  return operator === '=' && !before && !after && SHELL_NAME.test(name) && !value.endsWith(',');
+}
+
+function placeholder(value) {
+  return (
+    PLACEHOLDER.test(value) || (DESCRIBED_PLACEHOLDER.test(value) && CREDENTIAL_NOUN.test(value))
+  );
+}
+
+/**
+ * Classifies credential material in `bytes` from `origin` ({ path?, label?, syntax?, resolvable? }).
+ * Findings report location, rule, classification, confidence and explanation, never values.
+ * `resolvable: false` marks text that no resolution can admit, such as a correction.
+ */
+export function classifyCredentials(bytes, origin = {}) {
+  const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(String(bytes), 'utf8');
+  const content = buffer.toString('utf8');
+  const label = origin.label ?? origin.path ?? 'text';
+  const syntax = origin.syntax ?? credentialSyntax(origin.path);
+  const resolvable = origin.resolvable !== false;
+  const findings = [];
+  const add = (rule, index, key, details) => {
+    const { line, column } = position(content, index);
+    findings.push({
+      id: `cred_${sha256(`${label}\n${rule}\n${line}:${column}\n${key ?? ''}`).slice(0, 16)}`,
+      rule,
+      ...details,
+      location: { ...(origin.path ? { path: origin.path } : {}), line, column },
+      ...(key ? { key } : {}),
+    });
+  };
+  for (const match of content.matchAll(new RegExp(CREDENTIAL_FORMAT.source, 'gu')))
+    add('credential-format', match.index, null, {
+      classification: 'credential',
+      confidence: 'high',
+      resolvable: false,
+      explanation:
+        'A recognizable credential or private key format cannot be delegated; remove it from the source.',
+    });
+  const literal = ({ index, 0: text, groups: { name, word } }) =>
+    add('credential-assignment', index + text.indexOf(name), word, {
+      classification: 'possible-credential',
+      confidence: 'medium',
+      resolvable,
+      explanation: `${word} is assigned a literal that is neither a reference nor a recognized placeholder; ${resolvable ? 'resolve this finding only if the value is not a credential' : 'remove the value or replace it with a reference'}.`,
+    });
+  for (const match of content.matchAll(QUOTED_ASSIGNMENT))
+    if (!placeholder(match.groups.value)) literal(match);
+  for (const match of content.matchAll(UNQUOTED_ASSIGNMENT)) {
+    const { operator, value } = match.groups;
+    const lineSyntax = shellAssignment(match.groups) ? 'config' : syntax;
+    if (unquotedLiteral(value, operator, lineSyntax) && !placeholder(value.replace(/[;,]$/u, '')))
+      literal(match);
+  }
+  return { contentDigest: `sha256:${sha256(buffer)}`, syntax, findings };
+}
+
+/**
+ * Splits findings into those an explicit resolution covers and the rest. A resolution names one
+ * resolvable finding and the exact content digest it was recorded for; changed bytes invalidate it.
+ */
+export function resolveFindings(classification, resolutions = []) {
+  const accepted = new Set(
+    resolutions
+      .filter((resolution) => resolution?.contentDigest === classification.contentDigest)
+      .map((resolution) => resolution.id),
+  );
+  const applied = [];
+  const remaining = [];
+  for (const finding of classification.findings)
+    (finding.resolvable && accepted.has(finding.id) ? applied : remaining).push(finding);
+  return { applied, remaining };
+}

package/lib/host-packages/cursor/openplanr/rules/planr-delegate/scripts/presentation.mjs

@@ -39,7 +39,7 @@ export function preparationPresentation(preview) {
   return {
     phase: 'preview',
     headline: `${taskLabel(preview.selector)} is ready for review before dispatch.`,
-    context: `${preview.inventory.length} copied file(s); ${preview.omissions.length} omission(s).`,
+    context: `${preview.inventory.length} copied file(s); ${preview.omissions.length} omission(s); ${preview.credentialResolutions?.length ?? 0} accepted credential resolution(s).`,
     writableRepository: preview.writableRepository,
     worktreePath: preview.worktreePath,
     selectedPaths: preview.selectedPaths,
@@ -49,6 +49,7 @@ export function preparationPresentation(preview) {
       : 'Legacy run has no recorded integration scope; supply explicit paths at review. The worktree is not a filesystem sandbox.',
     inventory: preview.inventory,
     omissions: preview.omissions,
+    credentialResolutions: preview.credentialResolutions ?? [],
     blockers: preview.blockers ?? [],
     planning: preview.planning ?? null,
     helper: preview.helper ?? null,
@@ -61,7 +62,7 @@ export function preparationPresentation(preview) {
     destination: preview.destination,
     ...(preview.executionPolicy ? { executionPolicy: preview.executionPolicy } : {}),
     nextAction:
-      'Review required sources, optional omissions, planning location, integration scope, and destination before dispatch.',
+      'Review required sources, optional omissions, accepted credential resolutions, planning location, integration scope, and destination before dispatch.',
   };
 }
 

package/lib/host-packages/cursor/openplanr/rules/planr-delegate/scripts/run-contract.mjs

@@ -2,6 +2,7 @@
 import { createHash } from 'node:crypto';
 import { isAbsolute, sep } from 'node:path';
 import { assertCredentialFreeText } from './context.mjs';
+import { CREDENTIAL_FORMAT } from './credentials.mjs';
 import { updateRunRecord } from './run-record.mjs';
 
 const MAX_HANDOFF_TEXT = 4096;
@@ -16,9 +17,6 @@ export const SHA256 = /^[a-f0-9]{64}$/u;
 
 const RESULT_STATES = new Set(['completed', 'blocked', 'question']);
 
-const CREDENTIAL =
-  /-----BEGIN (?:[A-Z ]* )?PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9_]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b|\bsk-(?:proj-)?[A-Za-z0-9_-]{24,}\b|\bxox[baprs]-[A-Za-z0-9-]{20,}/iu;
-
 export class DelegateRunError extends Error {
   constructor(code, message, runId = null, details = null) {
     super(message);
@@ -68,7 +66,7 @@ export function boundedText(value, label) {
     typeof value !== 'string' ||
     !value.trim() ||
     Buffer.byteLength(value, 'utf8') > MAX_HANDOFF_TEXT ||
-    CREDENTIAL.test(value)
+    CREDENTIAL_FORMAT.test(value)
   ) {
     throw new DelegateRunError(
       'E_DELEGATE_INPUT',
@@ -152,7 +150,7 @@ function validQuestion(question) {
     typeof question.text !== 'string' ||
     !question.text.trim() ||
     Buffer.byteLength(question.text, 'utf8') > MAX_HANDOFF_TEXT ||
-    CREDENTIAL.test(question.text) ||
+    CREDENTIAL_FORMAT.test(question.text) ||
     (question.options !== undefined &&
       (!Array.isArray(question.options) ||
         question.options.length > 12 ||
@@ -160,7 +158,7 @@ function validQuestion(question) {
           (option) =>
             typeof option !== 'string' ||
             Buffer.byteLength(option, 'utf8') > 256 ||
-            CREDENTIAL.test(option),
+            CREDENTIAL_FORMAT.test(option),
         )))
   )
     return false;
@@ -181,7 +179,7 @@ export function resultShape(result, expectedSessionId = null) {
   ) {
     return null;
   }
-  if (CREDENTIAL.test(result.summary)) return null;
+  if (CREDENTIAL_FORMAT.test(result.summary)) return null;
   if (result.status === 'blocked' && !result.summary.trim()) return null;
   if (result.status === 'question' && !validQuestion(result.question)) return null;
   if (

package/lib/host-packages/cursor/openplanr/rules/planr-delegate/scripts/run-preparation.mjs

@@ -143,6 +143,7 @@ export async function prepareDelegateRun({
   selectedFiles = [],
   optionalFiles = [],
   readOnlyRepositories = [],
+  credentialResolutions = [],
   selectedPaths,
   scopePaths,
   preservePaths = [],
@@ -199,6 +200,7 @@ export async function prepareDelegateRun({
     selectedFiles,
     optionalFiles,
     readOnlyRepositories,
+    credentialResolutions,
   });
   const integrationScopePaths = scopePaths === undefined ? null : integrationPaths(scopePaths);
   let identity = profileIdentity(prepared);

package/lib/host-packages/cursor/openplanr/rules/planr-delegate/scripts/run-record.mjs

@@ -14,6 +14,7 @@ import {
 import { homedir } from 'node:os';
 import { join, resolve, sep } from 'node:path';
 import { promisify } from 'node:util';
+import { CREDENTIAL_FORMAT } from './credentials.mjs';
 import { captureFileState } from './custody.mjs';
 
 export const RUN_RECORD_SCHEMA_VERSION = '2.0.0';
@@ -21,8 +22,6 @@ export const MAX_RUN_RECORD_BYTES = 64 * 1024;
 export const CLOSED_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
 
 const RUN_ID = /^[a-zA-Z0-9][a-zA-Z0-9-]{0,99}$/u;
-const CREDENTIAL =
-  /-----BEGIN (?:[A-Z ]* )?PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9_]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b|\bsk-(?:proj-)?[A-Za-z0-9_-]{24,}\b|\bxox[baprs]-[A-Za-z0-9-]{20,}/iu;
 
 const execute = promisify(execFile);
 
@@ -74,7 +73,7 @@ function encoded(record) {
   if (bytes.length > MAX_RUN_RECORD_BYTES) {
     throw new RunRecordError('E_RUN_LIMIT', 'Delegated run record exceeds its private size limit.');
   }
-  if (CREDENTIAL.test(bytes.toString('utf8'))) {
+  if (CREDENTIAL_FORMAT.test(bytes.toString('utf8'))) {
     throw new RunRecordError('E_RUN_CREDENTIAL', 'Credential material cannot enter a run record.');
   }
   return bytes;

package/lib/host-packages/cursor/openplanr/rules/planr-delegate.mdc

@@ -44,6 +44,13 @@ Capacity and duration remain unverified without matching measurements. For a lar
 local task, select only relevant sources or split the task before a new preparation;
 never silently omit, truncate or replace a required source with a summary.
 
+If `prepare` reports `E_CAPSULE_SECRET`, show its masked findings (path, line, rule,
+confidence); never edit, redact or drop a required source to pass the check. For a
+resolvable finding, ask whether that exact value is a credential. Only when the user
+confirms it is not, prepare again with `credentialResolutions` naming that finding's
+`id` and `contentDigest`. Recognizable credential formats, private keys and credential
+files are never resolvable: ask the user to remove the credential from the source.
+
 Call `prepare` with the engine/profile, context and explicit integration scope.
 Show its engine, model selection, known provider or native-managed routing,
 trusted configuration, working directory and context inventory once before

package/lib/host-packages/cursor/openplanr/rules/planr-diagram/references/diagram-sharing.md

@@ -13,7 +13,7 @@ review. Preview the exact diagram title, source revision, elements, connections,
 destination and retention before creating it. Use `--yes` only when the user has
 already authorized that publication. The stable URL and generated access token
 are separate; copy the token through the local studio's **Share diagram** dialog,
-never into a URL, prompt, ordinary output or repository file. Owner credentials
+never into a URL, prompt, ordinary output or repository file. Owner keys
 are saved privately outside the project. The review remains available until the
 owner revokes or deletes it and works while the local studio is stopped.
 

package/lib/host-packages/cursor/openplanr/rules/planr-operate.mdc

@@ -46,9 +46,11 @@ matches. Never overwrite a prior cycle implicitly.
 ```
 
 `cycle.md` records the effective scope, roster, repository revision when relevant, and the outcome
-of each lens. If the directory is ignored by Git, continue locally and mention that in the report;
-do not ask the user to change ignore rules. Report an exact filesystem error only when the cycle
-workspace cannot be created or written.
+of each lens. An advisor lens run on its own creates the same layout with a one-lens roster and an
+unsynthesized `board-report.md`, so every review the dashboard lists has one shape.
+If the directory is ignored by Git, continue locally and mention that in the report; do not ask the
+user to change ignore rules. Report an exact filesystem error only when the cycle workspace cannot be
+created or written.
 
 ## Build shared context once