Deny editor tilde and swap backups of credential files

Author: TheGreatAxios

src/auth/credential-surface.ts

@@ -58,8 +58,11 @@ export function buildCredentialPatterns(): RegExp[] {
     const base = escapeRegExp(basename);
     // Editor backup copies keep full credential bytes next to the live file.
     // Scoped to the settings dir and anchored to known basenames, never a
-    // generic *.bak.
+    // generic *.bak, *~, or *.swp.
     patterns.push(new RegExp(`(^|\\/)${dir}\\/${base}\\.bak[^/]*$`));
+    patterns.push(new RegExp(`(^|\\/)${dir}\\/${base}~$`));
+    patterns.push(new RegExp(`(^|\\/)${dir}\\/${base}\\.swp$`));
+    patterns.push(new RegExp(`(^|\\/)${dir}\\/\\.${base}\\.swp$`));
     patterns.push(new RegExp(`(^|\\/)${base}\\.lock$`));
     // Writers emit a pid.counter middle segment (auth/store.ts,
     // mcp/auth-store.ts), so the middle segment is required; a bare

src/plugins/secret-guard-credential-surface.test.ts

@@ -132,6 +132,22 @@ describe("CL-7789 default-install credential surface", () => {
     expect(
       isSensitivePathResolved(join(home, ".corbits", "codex-auth.json.lock")),
     ).toBe(true);
+    for (const basename of [
+      "settings.json",
+      "permissions.json",
+      "codex-auth.json",
+      "xai-auth.json",
+    ]) {
+      expect(
+        isSensitivePathResolved(join(home, ".corbits", `${basename}~`)),
+      ).toBe(true);
+      expect(
+        isSensitivePathResolved(join(home, ".corbits", `${basename}.swp`)),
+      ).toBe(true);
+      expect(
+        isSensitivePathResolved(join(home, ".corbits", `.${basename}.swp`)),
+      ).toBe(true);
+    }
     expect(
       isSensitivePathResolved(
         join(home, ".corbits", "xai-auth.json.12345.1.tmp"),
@@ -157,6 +173,21 @@ describe("CL-7789 default-install credential surface", () => {
     }
   });
 
+  test("@mentions of credential backup paths stay blocked without leaking bytes", async () => {
+    const fake = await fakeHome();
+    const cwd = await mkdtemp(join(tmpdir(), "cl7789-mention-bak-cwd-"));
+    try {
+      const backup = `${fake.codexAuth}.bak-2026-01-01`;
+      await writeFile(backup, `${CODEX_BYTES}\n`);
+      const resolved = await resolveAtMentions(`read @${backup}`, cwd);
+      expect(resolved).toContain("(blocked: sensitive path)");
+      expect(resolved).not.toContain("CODEX-FIXTURE-ACCESS");
+    } finally {
+      await fake.cleanup();
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("a symlink to a credential file is blocked by mention and by read", async () => {
     const fake = await fakeHome();
     const cwd = await mkdtemp(join(tmpdir(), "cl7789-symlink-cwd-"));