openplanr 2.2641.1 → 2.2641.2

package/lib/host-packages/openai/openplanr/skills/delegate/scripts/context.mjs

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { lstat, mkdir, readdir, readFile, realpath, stat, writeFile } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { classifyCredentials, credentialSyntax, resolveFindings } from './credentials.mjs';
 
 export const CAPSULE_SCHEMA_VERSION = '1.0.0';
 
@@ -12,19 +13,14 @@ const DEFAULT_LIMITS = Object.freeze({
 const SECRET_NAME =
   /^(?:\.env(?:\..*)?|\.envrc|\.netrc|\.git-credentials|\.npmrc|\.pypirc|id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?|credentials(?:\.[^.]+)?|service[-_]?account(?:\.[^.]+)?|.*\.(?:pem|p12|pfx|key|tfvars)(?:\.json)?)$/iu;
 const SECRET_SEGMENT = /^(?:\.ssh|\.aws|\.gnupg|\.kube)$/iu;
-const SECRET_VALUE =
-  /-----BEGIN (?:[A-Z ]* )?PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9_]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b|\bsk-(?:proj-)?[A-Za-z0-9_-]{24,}\b|\bxox[baprs]-[A-Za-z0-9-]{20,}\b|"private_key"\s*:\s*"-----BEGIN/iu;
-const SECRET_ASSIGNMENT =
-  /(?:^|[^A-Za-z0-9_])(?:[A-Za-z_][A-Za-z0-9_-]*?)?(?:API[_-]?KEY|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET|PRIVATE[_-]?KEY|PASSWORD|TOKEN|SECRET(?:[_-]?KEY)?)["']?\s*[:=]\s*(["'`])((?:(?!\1|\$\{)[^\r\n\\]|\\.){16,})\1/giu;
-const SECRET_CONFIG_ASSIGNMENT =
-  /^[ \t]*(?:export[ \t]+)?(?:[A-Za-z_][A-Za-z0-9_-]*?)?(?:API[_-]?KEY|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET|PRIVATE[_-]?KEY|PASSWORD|TOKEN|SECRET(?:[_-]?KEY)?)[ \t]*[:=][ \t]*(?!process\.env(?:\.|\[)|import\.meta\.env(?:\.|\[)|Deno\.env\.|os\.environ|env\.)([^\s"'`#()\[\]{}$]{16,})[ \t]*(?:#[^\r\n]*)?\r?$/gimu;
-const CREDENTIAL_PLACEHOLDER =
-  /^(?:example(?:[-_].*)?|placeholder(?:[-_].*)?|your[-_].*|(?:change|replace)[-_]me(?:[-_].*)?|(?:dummy|fake|mock|test|never[-_]return)[-_](?:api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|password|token|secret(?:[-_]?key)?))$/iu;
 const TASK_ID = /^(?:T|TASK|QT)-\d{3,}$/u;
 const STORY_ID = /^US-\d{3,}$/u;
 const SPEC_ID = /^SPEC-\d{3,}$/u;
 const FEATURE_ID = /^FEAT-\d{3,}$/u;
 const EPIC_ID = /^EPIC-\d{3,}$/u;
+// Credential findings of an optional omission, keyed by the omission entry. The delegate reads
+// the written capsule, so they reach only the parent's preview.
+const OMISSION_FINDINGS = new WeakMap();
 
 export class CapsuleError extends Error {
   constructor(code, message, details = {}) {
@@ -68,14 +64,9 @@ function isSecretPath(path) {
   return parts.some((part) => SECRET_SEGMENT.test(part)) || SECRET_NAME.test(parts.at(-1));
 }
 
+/** True when free text holds credential material; source files are classified by their syntax. */
 export function containsSecret(bytes) {
-  const content = bytes.toString('utf8');
-  if (SECRET_VALUE.test(content)) return true;
-  for (const match of content.matchAll(SECRET_ASSIGNMENT))
-    if (!CREDENTIAL_PLACEHOLDER.test(match[2])) return true;
-  for (const match of content.matchAll(SECRET_CONFIG_ASSIGNMENT))
-    if (!CREDENTIAL_PLACEHOLDER.test(match[1])) return true;
-  return false;
+  return classifyCredentials(bytes).findings.length > 0;
 }
 
 export function assertCredentialFreeText(
@@ -84,10 +75,34 @@ export function assertCredentialFreeText(
 ) {
   if (typeof value !== 'string')
     throw new CapsuleError('E_CAPSULE_INPUT', `${label} must be text.`);
-  if (containsSecret(Buffer.from(value, 'utf8')))
+  const { contentDigest, findings } = classifyCredentials(Buffer.from(value, 'utf8'), {
+    label,
+    resolvable: false,
+  });
+  if (findings.length)
     throw new CapsuleError(
       code,
       `${label} contains credential material; use native configuration or credential environment references instead.`,
+      { findings, contentDigest },
+    );
+  return value;
+}
+
+function credentialResolutionList(value) {
+  if (
+    !Array.isArray(value) ||
+    value.length > 64 ||
+    value.some(
+      (resolution) =>
+        !resolution ||
+        typeof resolution !== 'object' ||
+        !/^cred_[a-f0-9]{16}$/u.test(resolution.id ?? '') ||
+        !/^sha256:[a-f0-9]{64}$/u.test(resolution.contentDigest ?? ''),
+    )
+  )
+    throw new CapsuleError(
+      'E_CAPSULE_INPUT',
+      'Credential resolutions must list at most 64 { id, contentDigest } entries from reported findings.',
     );
   return value;
 }
@@ -312,8 +327,22 @@ export async function buildContextCapsule({
   optionalFiles = [],
   readOnlyRepositories = [],
   limits,
+  credentialResolutions = [],
 } = {}) {
   if (!repositoryRoot) throw new CapsuleError('E_CAPSULE_SOURCE', 'repositoryRoot is required.');
+  const resolutions = credentialResolutionList(credentialResolutions);
+  const appliedResolutions = [];
+  const credentialCheck = (bytes, origin) => {
+    const classification = classifyCredentials(bytes, origin);
+    return {
+      ...resolveFindings(classification, resolutions),
+      contentDigest: classification.contentDigest,
+    };
+  };
+  const recordResolutions = ({ applied, contentDigest }, source) => {
+    for (const { id, rule, location } of applied)
+      appliedResolutions.push({ id, contentDigest, ...source, rule, location });
+  };
   if (request !== undefined && typeof request !== 'string')
     throw new CapsuleError('E_CAPSULE_INPUT', 'A direct request must be text.');
   if (Boolean(taskSelector) === Boolean(request?.trim())) {
@@ -354,8 +383,18 @@ export async function buildContextCapsule({
   if (request && Buffer.byteLength(request, 'utf8') > bounds.maxFileBytes) {
     throw new CapsuleError('E_CAPSULE_LIMIT', 'The direct request exceeds the capsule text limit.');
   }
-  if (request && containsSecret(Buffer.from(request, 'utf8'))) {
-    throw new CapsuleError('E_CAPSULE_SECRET', 'The direct request contains credential material.');
+  if (request) {
+    const credentials = credentialCheck(Buffer.from(request, 'utf8'), { label: 'request' });
+    if (credentials.remaining.length)
+      throw new CapsuleError(
+        'E_CAPSULE_SECRET',
+        'The direct request contains credential material.',
+        {
+          findings: credentials.remaining,
+          contentDigest: credentials.contentDigest,
+        },
+      );
+    recordResolutions(credentials, { source: 'request' });
   }
   const roots = await sourceRoots(repositoryRoot, readOnlyRepositories);
   const project = roots.get('project').physical;
@@ -381,9 +420,16 @@ export async function buildContextCapsule({
       return prior;
     }
     const optionalOmission = (reason) => {
-      if (required) throw new CapsuleError(reason.code, reason.message, { repositoryKey, path });
+      if (required)
+        throw new CapsuleError(reason.code, reason.message, {
+          repositoryKey,
+          path,
+          ...reason.details,
+        });
       if (!omitted.has(key)) {
-        omissions.push({ repositoryKey, path, role, reason: reason.code });
+        const omission = { repositoryKey, path, role, reason: reason.code };
+        if (reason.details) OMISSION_FINDINGS.set(omission, reason.details);
+        omissions.push(omission);
         omitted.add(key);
       }
       return null;
@@ -467,11 +513,20 @@ export async function buildContextCapsule({
         message: `Required source exceeds capsule limits: ${path}`,
       });
     }
-    if (containsSecret(bytes))
+    // A link reads as its target's syntax, or as configuration when either path is configuration.
+    const syntaxes = [path, relative(allowed, physical).split(sep).join('/')].map(credentialSyntax);
+    const credentials = credentialCheck(bytes, {
+      path,
+      label: `${repositoryKey}/${path}`,
+      syntax: syntaxes.includes('config') ? 'config' : syntaxes[1],
+    });
+    if (credentials.remaining.length)
       return optionalOmission({
         code: 'E_CAPSULE_SECRET',
         message: `Credential material detected in source: ${path}`,
+        details: { findings: credentials.remaining, contentDigest: credentials.contentDigest },
       });
+    recordResolutions(credentials, { repositoryKey, path });
     const copy = {
       repositoryKey,
       path,
@@ -686,6 +741,7 @@ export async function buildContextCapsule({
     inventory,
     files,
     omissions,
+    ...(appliedResolutions.length ? { credentialResolutions: appliedResolutions } : {}),
     planning: {
       logicalPath: join(project, '.planr'),
       physicalPath: roots.get('project').planning,
@@ -731,7 +787,13 @@ export function previewContextCapsule(capsule) {
     mode: capsule.mode,
     selector: capsule.selector,
     inventory: capsule.inventory,
-    omissions: capsule.omissions,
+    omissions: capsule.omissions.map((omission) => ({
+      ...omission,
+      ...OMISSION_FINDINGS.get(omission),
+    })),
+    ...(capsule.credentialResolutions
+      ? { credentialResolutions: capsule.credentialResolutions }
+      : {}),
     blockers: [],
     planning: capsule.planning ?? null,
     sourceKeys: capsule.sourceKeys,

package/lib/host-packages/openai/openplanr/skills/delegate/scripts/credentials.mjs

@@ -0,0 +1,167 @@
+// Credential classification for delegated context. Findings never carry the matched value.
+import { createHash } from 'node:crypto';
+
+/**
+ * Recognizable credential formats; rejected everywhere, including tests and placeholders.
+ * Case-sensitive: each prefix has a fixed case, and `github_pat_` and `sk-` bodies need an
+ * uppercase letter or digit.
+ */
+export const CREDENTIAL_FORMAT =
+  /-----BEGIN (?:[A-Z ]* )?PRIVATE KEY(?: BLOCK)?-----|"private_key"\s*:\s*"-----BEGIN|(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}\b|(?<![A-Za-z0-9])gh[pousr]_[A-Za-z0-9]{20,}(?![A-Za-z0-9])|(?<![A-Za-z0-9])github_pat_(?=[A-Za-z0-9_]*[A-Z0-9])[A-Za-z0-9_]{20,}\b|(?<![A-Za-z0-9])sk-(?:proj-)?(?=[A-Za-z0-9_-]*[A-Z0-9])[A-Za-z0-9_-]{24,}\b|(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{20,}/u;
+
+// `word` is the credential word findings report as `key`; the rest of a name may hold a value.
+const CREDENTIAL_NAME =
+  '(?<name>(?:[A-Za-z_][A-Za-z0-9_-]*?)?(?<word>API[_-]?KEY|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET|PRIVATE[_-]?KEY|PASSWORD|TOKEN|SECRET(?:[_-]?KEY)?))';
+const QUOTED_ASSIGNMENT = new RegExp(
+  `(?:^|[^A-Za-z0-9_])${CREDENTIAL_NAME}["']?\\s*[:=]\\s*(?<quote>["'\`])(?<value>(?:(?!\\k<quote>|\\$\\{)[^\\r\\n\\\\]|\\\\.){16,})\\k<quote>`,
+  'giu',
+);
+const UNQUOTED_ASSIGNMENT = new RegExp(
+  `^[ \\t]*(?<exported>export[ \\t]+)?${CREDENTIAL_NAME}(?<before>[ \\t]*)(?<operator>[:=])(?<after>[ \\t]*)(?!process\\.env(?:\\.|\\[)|import\\.meta\\.env(?:\\.|\\[)|Deno\\.env\\.|os\\.environ|env\\.)(?<value>[^\\s"'\`#()\\[\\]{}$]{16,})[ \\t]*(?:#[^\\r\\n]*)?\\r?$`,
+  'gimu',
+);
+const PLACEHOLDER =
+  /^(?:example(?:[-_].*)?|placeholder(?:[-_].*)?|your[-_].*|(?:change|replace)[-_]me(?:[-_].*)?|(?:dummy|fake|mock|test|never[-_]return)[-_](?:api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|password|token|secret(?:[-_]?key)?))$/iu;
+// A lowercase marker followed only by words and short numbers, one of them a credential noun.
+const DESCRIBED_PLACEHOLDER =
+  /^(?:dummy|fake|mock|test|fixture|synthetic|never[-_]return)(?:[-_. ](?:[a-z]+|\d{1,4}))+[-_.]?$/u;
+const CREDENTIAL_NOUN = /[-_. ](?:secret|key|token|password|credential)s?(?=[-_. ]|$)/u;
+const SHELL_NAME = /^[A-Z][A-Z0-9_]*$/u;
+const IDENTIFIER_WORD = /[A-Z]{2,}(?![a-z])\d{0,2}|[A-Z]?[a-z]+\d{0,2}|[A-Z]\d{0,2}|\d{1,2}/gu;
+
+const CODE_EXTENSIONS = new Set(
+  'c cc cjs cpp cs cts dart go groovy h hpp java js jsx kt kts lua m mjs mm mts php py rb rs scala svelte swift ts tsx vue'.split(
+    ' ',
+  ),
+);
+const CONFIG_EXTENSIONS = new Set(
+  'bash cfg conf env fish hcl ini json json5 jsonc properties ps1 sh tf toml xml yaml yml zsh'.split(
+    ' ',
+  ),
+);
+const CONFIG_NAMES = new Set(['dockerfile', 'makefile', 'procfile']);
+
+/** The syntax that decides whether an unquoted value is a literal: code, config, or free text. */
+export function credentialSyntax(path) {
+  if (typeof path !== 'string' || !path) return 'text';
+  const name = path.split('/').at(-1).toLowerCase();
+  if (CONFIG_NAMES.has(name) || name.startsWith('.env')) return 'config';
+  const extension = name.includes('.') ? name.split('.').at(-1) : '';
+  if (CODE_EXTENSIONS.has(extension)) return 'code';
+  if (CONFIG_EXTENSIONS.has(extension)) return 'config';
+  return 'text';
+}
+
+function sha256(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+function position(content, index) {
+  const before = content.slice(0, index);
+  return { line: before.split('\n').length, column: index - before.lastIndexOf('\n') };
+}
+
+// Reads like a code identifier: whole words, digits only at word ends, at most one one-letter word.
+function codeIdentifier(value) {
+  if (!/^[A-Za-z_$][\w$]*$/u.test(value) || value.length > 64) return false;
+  let singleLetters = 0;
+  for (const part of value.split(/[_$]+/u).filter(Boolean)) {
+    const words = part.match(IDENTIFIER_WORD) ?? [];
+    if (words.join('') !== part) return false;
+    singleLetters += words.filter((word) => word.replace(/\d+$/u, '').length <= 1).length;
+  }
+  return singleLetters <= 1;
+}
+
+function memberPath(value) {
+  const segments = value.replace(/!$/u, '').split(/[!?]?\./u);
+  return segments.length > 1 && segments.every(codeIdentifier);
+}
+
+// An unquoted value is a literal unless its syntax makes it a reference, type or expression.
+// Multi-line strings in code read like text, so an unterminated identifier stays a literal.
+function unquotedLiteral(raw, operator, syntax) {
+  if (syntax === 'config' || (syntax === 'text' && operator === '=')) return true;
+  const terminated = /[;,]$/u.test(raw);
+  const value = terminated ? raw.slice(0, -1) : raw;
+  if (memberPath(value)) return !(terminated || syntax === 'code');
+  return !(terminated && codeIdentifier(value));
+}
+
+// `export NAME=` is a shell line in any file, and so is an uppercase `NAME=value` without spaces
+// unless it ends in `,` like a keyword argument.
+function shellAssignment({ exported, name, before, operator, after, value }) {
+  if (exported) return true;
+  return operator === '=' && !before && !after && SHELL_NAME.test(name) && !value.endsWith(',');
+}
+
+function placeholder(value) {
+  return (
+    PLACEHOLDER.test(value) || (DESCRIBED_PLACEHOLDER.test(value) && CREDENTIAL_NOUN.test(value))
+  );
+}
+
+/**
+ * Classifies credential material in `bytes` from `origin` ({ path?, label?, syntax?, resolvable? }).
+ * Findings report location, rule, classification, confidence and explanation, never values.
+ * `resolvable: false` marks text that no resolution can admit, such as a correction.
+ */
+export function classifyCredentials(bytes, origin = {}) {
+  const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(String(bytes), 'utf8');
+  const content = buffer.toString('utf8');
+  const label = origin.label ?? origin.path ?? 'text';
+  const syntax = origin.syntax ?? credentialSyntax(origin.path);
+  const resolvable = origin.resolvable !== false;
+  const findings = [];
+  const add = (rule, index, key, details) => {
+    const { line, column } = position(content, index);
+    findings.push({
+      id: `cred_${sha256(`${label}\n${rule}\n${line}:${column}\n${key ?? ''}`).slice(0, 16)}`,
+      rule,
+      ...details,
+      location: { ...(origin.path ? { path: origin.path } : {}), line, column },
+      ...(key ? { key } : {}),
+    });
+  };
+  for (const match of content.matchAll(new RegExp(CREDENTIAL_FORMAT.source, 'gu')))
+    add('credential-format', match.index, null, {
+      classification: 'credential',
+      confidence: 'high',
+      resolvable: false,
+      explanation:
+        'A recognizable credential or private key format cannot be delegated; remove it from the source.',
+    });
+  const literal = ({ index, 0: text, groups: { name, word } }) =>
+    add('credential-assignment', index + text.indexOf(name), word, {
+      classification: 'possible-credential',
+      confidence: 'medium',
+      resolvable,
+      explanation: `${word} is assigned a literal that is neither a reference nor a recognized placeholder; ${resolvable ? 'resolve this finding only if the value is not a credential' : 'remove the value or replace it with a reference'}.`,
+    });
+  for (const match of content.matchAll(QUOTED_ASSIGNMENT))
+    if (!placeholder(match.groups.value)) literal(match);
+  for (const match of content.matchAll(UNQUOTED_ASSIGNMENT)) {
+    const { operator, value } = match.groups;
+    const lineSyntax = shellAssignment(match.groups) ? 'config' : syntax;
+    if (unquotedLiteral(value, operator, lineSyntax) && !placeholder(value.replace(/[;,]$/u, '')))
+      literal(match);
+  }
+  return { contentDigest: `sha256:${sha256(buffer)}`, syntax, findings };
+}
+
+/**
+ * Splits findings into those an explicit resolution covers and the rest. A resolution names one
+ * resolvable finding and the exact content digest it was recorded for; changed bytes invalidate it.
+ */
+export function resolveFindings(classification, resolutions = []) {
+  const accepted = new Set(
+    resolutions
+      .filter((resolution) => resolution?.contentDigest === classification.contentDigest)
+      .map((resolution) => resolution.id),
+  );
+  const applied = [];
+  const remaining = [];
+  for (const finding of classification.findings)
+    (finding.resolvable && accepted.has(finding.id) ? applied : remaining).push(finding);
+  return { applied, remaining };
+}

package/lib/host-packages/openai/openplanr/skills/delegate/scripts/presentation.mjs

@@ -39,7 +39,7 @@ export function preparationPresentation(preview) {
   return {
     phase: 'preview',
     headline: `${taskLabel(preview.selector)} is ready for review before dispatch.`,
-    context: `${preview.inventory.length} copied file(s); ${preview.omissions.length} omission(s).`,
+    context: `${preview.inventory.length} copied file(s); ${preview.omissions.length} omission(s); ${preview.credentialResolutions?.length ?? 0} accepted credential resolution(s).`,
     writableRepository: preview.writableRepository,
     worktreePath: preview.worktreePath,
     selectedPaths: preview.selectedPaths,
@@ -49,6 +49,7 @@ export function preparationPresentation(preview) {
       : 'Legacy run has no recorded integration scope; supply explicit paths at review. The worktree is not a filesystem sandbox.',
     inventory: preview.inventory,
     omissions: preview.omissions,
+    credentialResolutions: preview.credentialResolutions ?? [],
     blockers: preview.blockers ?? [],
     planning: preview.planning ?? null,
     helper: preview.helper ?? null,
@@ -61,7 +62,7 @@ export function preparationPresentation(preview) {
     destination: preview.destination,
     ...(preview.executionPolicy ? { executionPolicy: preview.executionPolicy } : {}),
     nextAction:
-      'Review required sources, optional omissions, planning location, integration scope, and destination before dispatch.',
+      'Review required sources, optional omissions, accepted credential resolutions, planning location, integration scope, and destination before dispatch.',
   };
 }
 

package/lib/host-packages/openai/openplanr/skills/delegate/scripts/run-contract.mjs

@@ -2,6 +2,7 @@
 import { createHash } from 'node:crypto';
 import { isAbsolute, sep } from 'node:path';
 import { assertCredentialFreeText } from './context.mjs';
+import { CREDENTIAL_FORMAT } from './credentials.mjs';
 import { updateRunRecord } from './run-record.mjs';
 
 const MAX_HANDOFF_TEXT = 4096;
@@ -16,9 +17,6 @@ export const SHA256 = /^[a-f0-9]{64}$/u;
 
 const RESULT_STATES = new Set(['completed', 'blocked', 'question']);
 
-const CREDENTIAL =
-  /-----BEGIN (?:[A-Z ]* )?PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9_]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b|\bsk-(?:proj-)?[A-Za-z0-9_-]{24,}\b|\bxox[baprs]-[A-Za-z0-9-]{20,}/iu;
-
 export class DelegateRunError extends Error {
   constructor(code, message, runId = null, details = null) {
     super(message);
@@ -68,7 +66,7 @@ export function boundedText(value, label) {
     typeof value !== 'string' ||
     !value.trim() ||
     Buffer.byteLength(value, 'utf8') > MAX_HANDOFF_TEXT ||
-    CREDENTIAL.test(value)
+    CREDENTIAL_FORMAT.test(value)
   ) {
     throw new DelegateRunError(
       'E_DELEGATE_INPUT',
@@ -152,7 +150,7 @@ function validQuestion(question) {
     typeof question.text !== 'string' ||
     !question.text.trim() ||
     Buffer.byteLength(question.text, 'utf8') > MAX_HANDOFF_TEXT ||
-    CREDENTIAL.test(question.text) ||
+    CREDENTIAL_FORMAT.test(question.text) ||
     (question.options !== undefined &&
       (!Array.isArray(question.options) ||
         question.options.length > 12 ||
@@ -160,7 +158,7 @@ function validQuestion(question) {
           (option) =>
             typeof option !== 'string' ||
             Buffer.byteLength(option, 'utf8') > 256 ||
-            CREDENTIAL.test(option),
+            CREDENTIAL_FORMAT.test(option),
         )))
   )
     return false;
@@ -181,7 +179,7 @@ export function resultShape(result, expectedSessionId = null) {
   ) {
     return null;
   }
-  if (CREDENTIAL.test(result.summary)) return null;
+  if (CREDENTIAL_FORMAT.test(result.summary)) return null;
   if (result.status === 'blocked' && !result.summary.trim()) return null;
   if (result.status === 'question' && !validQuestion(result.question)) return null;
   if (

package/lib/host-packages/openai/openplanr/skills/delegate/scripts/run-preparation.mjs

@@ -143,6 +143,7 @@ export async function prepareDelegateRun({
   selectedFiles = [],
   optionalFiles = [],
   readOnlyRepositories = [],
+  credentialResolutions = [],
   selectedPaths,
   scopePaths,
   preservePaths = [],
@@ -199,6 +200,7 @@ export async function prepareDelegateRun({
     selectedFiles,
     optionalFiles,
     readOnlyRepositories,
+    credentialResolutions,
   });
   const integrationScopePaths = scopePaths === undefined ? null : integrationPaths(scopePaths);
   let identity = profileIdentity(prepared);

package/lib/host-packages/openai/openplanr/skills/delegate/scripts/run-record.mjs

@@ -14,6 +14,7 @@ import {
 import { homedir } from 'node:os';
 import { join, resolve, sep } from 'node:path';
 import { promisify } from 'node:util';
+import { CREDENTIAL_FORMAT } from './credentials.mjs';
 import { captureFileState } from './custody.mjs';
 
 export const RUN_RECORD_SCHEMA_VERSION = '2.0.0';
@@ -21,8 +22,6 @@ export const MAX_RUN_RECORD_BYTES = 64 * 1024;
 export const CLOSED_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
 
 const RUN_ID = /^[a-zA-Z0-9][a-zA-Z0-9-]{0,99}$/u;
-const CREDENTIAL =
-  /-----BEGIN (?:[A-Z ]* )?PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9_]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b|\bsk-(?:proj-)?[A-Za-z0-9_-]{24,}\b|\bxox[baprs]-[A-Za-z0-9-]{20,}/iu;
 
 const execute = promisify(execFile);
 
@@ -74,7 +73,7 @@ function encoded(record) {
   if (bytes.length > MAX_RUN_RECORD_BYTES) {
     throw new RunRecordError('E_RUN_LIMIT', 'Delegated run record exceeds its private size limit.');
   }
-  if (CREDENTIAL.test(bytes.toString('utf8'))) {
+  if (CREDENTIAL_FORMAT.test(bytes.toString('utf8'))) {
     throw new RunRecordError('E_RUN_CREDENTIAL', 'Credential material cannot enter a run record.');
   }
   return bytes;

package/lib/host-packages/openai/openplanr/skills/diagram/references/diagram-sharing.md

@@ -13,7 +13,7 @@ review. Preview the exact diagram title, source revision, elements, connections,
 destination and retention before creating it. Use `--yes` only when the user has
 already authorized that publication. The stable URL and generated access token
 are separate; copy the token through the local studio's **Share diagram** dialog,
-never into a URL, prompt, ordinary output or repository file. Owner credentials
+never into a URL, prompt, ordinary output or repository file. Owner keys
 are saved privately outside the project. The review remains available until the
 owner revokes or deletes it and works while the local studio is stopped.
 

package/lib/host-packages/openai/openplanr/skills/operate/SKILL.md

@@ -47,9 +47,11 @@ matches. Never overwrite a prior cycle implicitly.
 ```
 
 `cycle.md` records the effective scope, roster, repository revision when relevant, and the outcome
-of each lens. If the directory is ignored by Git, continue locally and mention that in the report;
-do not ask the user to change ignore rules. Report an exact filesystem error only when the cycle
-workspace cannot be created or written.
+of each lens. An advisor lens run on its own creates the same layout with a one-lens roster and an
+unsynthesized `board-report.md`, so every review the dashboard lists has one shape.
+If the directory is ignored by Git, continue locally and mention that in the report; do not ask the
+user to change ignore rules. Report an exact filesystem error only when the cycle workspace cannot be
+created or written.
 
 ## Build shared context once
 

package/lib/host-packages/openai/openplanr/skills/plan/SKILL.md

@@ -79,8 +79,14 @@ Write stories and tasks directly in the repository's active planning mode.
   deleted ID. The packaged [planning ID helper](scripts/planning-ids.mjs) may
   inspect or reserve IDs; it never generates content.
 - Give each story stable acceptance IDs starting at `AC-001`.
-- Create one Tech task when no design surface applies; create one UI and one
-  Tech task when it does. Never exceed two tasks for one story.
+- Split each story into tasks that are coherent and independently verifiable.
+  Separate by ownership first: UI work is a `UI` task for the frontend role and
+  server, data, or integration work is a `Tech` task for the backend role.
+  Within one owner, split further only for a real output dependency, a distinct
+  verification surface, or reviewable size. Most stories need one Tech task,
+  plus one UI task when a design surface applies; never fragment one coherent
+  change into tasks that cannot be verified alone, and never fold unrelated work
+  into one task.
 - Map every acceptance ID through `acceptanceRefs` and name it with a concrete
   verification statement under `## Test Requirements`.
 - Set `reviewRisks` and `browserSurfaces` from repository evidence; use empty

package/lib/host-packages/openai/openplanr/skills/sprint/SKILL.md

@@ -36,7 +36,7 @@ capability; it never blocks the run. Name every degraded input in `Issues`.
 | Capacity (engineers × working days) | Fit the list and name the overflow | Ask once; default 1 engineer × 10 days, stated in the return |
 | Previous sprint or refinement note (`.planr/sprints/SPRINT-NNN/refinement.json`) | Carry `leftovers`; `openplanr sprint diff` is possible | First run, no diff |
 | Last Operate cycle | Rank its unfinished actions alongside | Skipped silently |
-| Linear or GitHub connector | Push statuses on approval, read PR state | Local files only; report the external step as not run |
+| Linear or GitHub connection ([tracker connections](references/tracker-connections.md)) | Update linked issues on approval, read PR state | Local files only; report the external step as not run and name the connection to add |
 
 ## Step 0: Frame the run
 
@@ -135,9 +135,10 @@ openplanr sprint apply SPRINT-NNN --dry-run          # show the status and prior
 openplanr sprint apply SPRINT-NNN --yes --commit     # one commit: chore(planr): refine backlog for SPRINT-NNN
 ```
 
-Where a connector is configured, push each changed item afterwards
-(`openplanr linear push <id>`, `openplanr github push <id>`) and report the ones that
-were not pushed. When the CLI is unavailable, apply the same status changes with
+Then update the issue linked to each changed item through the host's Linear or
+GitHub connection, with the status mapping in
+[tracker connections](references/tracker-connections.md), and report the items that
+were not updated. When the CLI is unavailable, apply the same status changes with
 the repository's own vocabulary and commit them with the same message.
 
 Close a finished sprint with `openplanr sprint close SPRINT-NNN`; it records the

package/lib/host-packages/openai/openplanr/skills/sprint/openplanr.skill.json

@@ -44,6 +44,17 @@
       ],
       "executable": false
     },
+    {
+      "path": "references/tracker-connections.md",
+      "kind": "reference",
+      "hosts": [
+        "claude-code",
+        "codex",
+        "chatgpt",
+        "cursor"
+      ],
+      "executable": false
+    },
     {
       "path": "schemas/refinement.schema.json",
       "kind": "schema",

package/lib/host-packages/openai/openplanr/skills/sprint/references/tracker-connections.md

@@ -0,0 +1,70 @@
+# GitHub and Linear connections
+
+These skills store and read no GitHub or Linear credentials. Remote steps run through a
+connection the host already has; the planning files stay the source of truth.
+
+## Use the host's connection
+
+- **Linear:** the host's Linear connection, whose tools read, create and update issues.
+- **GitHub:** the host's GitHub connection, or the GitHub CLI when
+  `gh auth status --hostname github.com` succeeds.
+
+Never ask the user for a token, read one from the environment or a file, or put one in a
+command, URL or file.
+
+## When a connection is missing
+
+Finish the local work first. Then report the remote step as not run and give the one
+line for the current host:
+
+| Host | Linear | GitHub |
+| --- | --- | --- |
+| Claude Code | Run `/plugin install linear@claude-plugins-official`, then sign in to Linear from `/mcp`. | Install the GitHub CLI (cli.github.com) and run `gh auth login`. |
+| Codex | Run `codex mcp add linear --url https://mcp.linear.app/mcp`, then `codex mcp login linear`. | Install the GitHub plugin from `/plugins`, or run `gh auth login`. |
+| Cursor | Add Linear from the Cursor Marketplace and sign in to Linear. | Install the GitHub CLI (cli.github.com) and run `gh auth login`. |
+
+Ask the user to try again once connected; never retry the remote step on your own.
+
+## Status mapping
+
+| Local status | Linear workflow state | GitHub issue |
+| --- | --- | --- |
+| `planning`, `pending` | Unstarted (for example Todo) | open |
+| `in-progress` | Started (for example In Progress) | open |
+| `done` | Completed (for example Done) | closed |
+| Backlog `open` | Backlog, else Unstarted | open |
+| Backlog `closed` | Completed | closed |
+| Backlog `promoted` | Leave as it is | Leave as it is |
+
+When reading state back, write only a status the item's type allows. A backlog item takes
+`open` or `closed` and keeps `promoted`.
+
+- Linear Completed or Canceled sets `done`, or `closed` for a backlog item. Started sets
+  `in-progress`, and Triage, Backlog or Unstarted sets `planning` for features and stories
+  and `pending` for quick tasks; a backlog item takes `open` from any of these. Epics and
+  task files keep their status.
+- A closed GitHub issue sets `done`, or `closed` for a backlog item. An open issue sets
+  `in-progress` for a `done` item and `open` for a `closed` backlog item; other statuses
+  stay as they are.
+
+## Links
+
+A linked item records its tracker identity in frontmatter. Update a linked item through
+that identity instead of creating another, and record the identity of everything you
+create.
+
+- **GitHub:** each item is one issue, recorded as `githubIssue`.
+- **Linear:** use the shapes the OpenPlanr CLI uses, so its later pushes reuse what you
+  create:
+  - An epic is a Linear project (`linearProjectId`, `linearProjectIdentifier`,
+    `linearProjectUrl`). When its `linearMappingStrategy` is `milestone-of` or `label-on`,
+    it is a milestone in an existing project (`linearMilestoneId`) or a team label
+    (`linearLabelId`) instead, and every issue under it carries that milestone
+    (`linearProjectMilestoneId`) or label (`linearLabelIds`).
+  - A feature, quick task or backlog item is one issue (`linearIssueId`,
+    `linearIssueIdentifier`, `linearIssueUrl`). A story is a sub-issue of its feature's
+    issue (`linearParentIssueId`).
+  - All task files of one feature share one task-list issue: a sub-issue of the feature's
+    issue whose checklist merges every task file, recorded in each task file. Its state is
+    Completed when every task file is `done`, Unstarted when every one is `pending`, and
+    Started otherwise.

package/lib/host-packages/openai/openplanr/skills/status/SKILL.md

@@ -11,9 +11,10 @@ planning artifacts, task statuses, dependency graph, current branch, and relevan
 runtime markers directly. Use the optional deterministic `openplanr status --json`
 utility when available, but do not require it or a semantic subprocess.
 
-Add GitHub or Linear lookups only when the user requests live remote state. Keep
-local results useful when credentials or connectors are unavailable. Report
-counts, ready and blocked work, dependency problems, and the most useful next
+Add GitHub or Linear lookups only when the user requests live remote state, through
+the host's connections as described in [tracker connections](references/tracker-connections.md).
+Keep local results useful when a connection is unavailable, and name the one to add.
+Report counts, ready and blocked work, dependency problems, and the most useful next
 action. Do not repair artifacts, start Plan or Ship, or change lifecycle state.
 
 When the OpenPlanr dashboard is running (`planr-dashboard`), the same delivery