Deny backups of OAuth token stores in the secret guard

Author: TheGreatAxios

docs/ARCHITECTURE.md

@@ -74,7 +74,7 @@ In TUI chat mode there is no completion gate — the session stays open across t
 - `providers.ts` defines the `ProviderCatalogEntry` type and helpers for building TUI provider lists; `profiles.ts` handles profile-level selection logic.
 - `loadConfig` is async (it reads settings files). Parses a leading `exec`/`run` subcommand, flags `--cwd`, `--config`, `--provider`, `--model`, `--dangerously-skip-permissions` (forces this process; TUI `/yolo` persists as the user-global default), `--auto` / `--no-auto` (auto mode defaults on); collects positional arguments as the optional initial task for the TUI or the required prompt for exec.
 - Both settings files and the project/global grant store (`.corbits/permissions.json`) are on the secret-guard denylist for path-keyed tools, so the agent cannot `read_file` its own credentials or persist standing auto-approvals. Shell commands that reference them still require explicit operator approval.
-- Credential-surface ownership: each auth store module enumerates its own files (`*_AUTH_FILENAME` / `MCP_AUTH_DIRNAME`), the data-only registry in `src/auth/credential-surface.ts` turns them into denylist patterns, `secret-guard-plugin.ts` owns matching (lexical plus realpath), and `@mention` resolution consumes the resolved check — never the registry directly. A new token store is denied only once its store module exports its filename and the registry lists it; the coverage test fails the build until both exist.
+- Credential-surface ownership: each auth store module enumerates its own files (`*_AUTH_FILENAME` / `MCP_AUTH_DIRNAME`), the data-only registry in `src/auth/credential-surface.ts` turns them into denylist patterns, `secret-guard-plugin.ts` owns matching (lexical plus realpath), and `@mention` resolution consumes the resolved check — never the registry directly. A new `*-auth.json` token store is denied only once its store module exports its filename and the registry lists it; the coverage test scans store sources for `*-auth.json` literals (registered dirnames get an includes-check instead) and fails the build until both exist.
 
 ### TUI Runner (`src/tui/runner.ts`)
 

src/auth/credential-surface.ts

@@ -54,11 +54,16 @@ export function buildCredentialPatterns(): RegExp[] {
     const scope = escapeRegExp(settingsDirName);
     patterns.push(new RegExp(`(^|\\/)${scope}\\/${escapeRegExp(dirname)}\\/`));
   }
-  // Editor backup copies keep full credential bytes next to the live file.
-  patterns.push(new RegExp(`(^|\\/)${dir}\\/settings\\.json\\.bak[^/]*$`));
   for (const basename of credentialSidecarBasenames) {
     const base = escapeRegExp(basename);
+    // Editor backup copies keep full credential bytes next to the live file.
+    // Scoped to the settings dir and anchored to known basenames, never a
+    // generic *.bak.
+    patterns.push(new RegExp(`(^|\\/)${dir}\\/${base}\\.bak[^/]*$`));
     patterns.push(new RegExp(`(^|\\/)${base}\\.lock$`));
+    // Writers emit a pid.counter middle segment (auth/store.ts,
+    // mcp/auth-store.ts), so the middle segment is required; a bare
+    // `<base>.tmp` has no known writer and stays unmatched.
     patterns.push(new RegExp(`(^|\\/)${base}\\.[^/]*\\.tmp$`));
   }
   return patterns;

src/plugins/secret-guard-credential-surface.test.ts

@@ -107,9 +107,26 @@ describe("CL-7789 default-install credential surface", () => {
 
   test("credential backups and sidecars resolve as sensitive", () => {
     const home = join(tmpdir(), "cl7789-never-created");
+    for (const basename of [
+      "settings.json",
+      "permissions.json",
+      "codex-auth.json",
+      "xai-auth.json",
+    ]) {
+      expect(
+        isSensitivePathResolved(
+          join(home, ".corbits", `${basename}.bak-2026-01-01`),
+        ),
+      ).toBe(true);
+    }
     expect(
       isSensitivePathResolved(
-        join(home, ".corbits", "settings.json.bak-2026-01-01"),
+        join(
+          home,
+          ".corbits",
+          "mcp-auth",
+          "my-server-9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00.json.bak-2026-01-01",
+        ),
       ),
     ).toBe(true);
     expect(
@@ -128,7 +145,7 @@ describe("CL-7789 default-install credential surface", () => {
     try {
       for (const [path, marker] of [
         [fake.codexAuth, "CODEX-FIXTURE-ACCESS"],
-        [fake.mcpAuth, "MCP-FIXTURE-ACCESS"],
+        [fake.mcpAuth, "access_token"],
       ] as const) {
         const resolved = await resolveAtMentions(`read @${path}`, cwd);
         expect(resolved).toContain("(blocked: sensitive path)");

src/plugins/secret-guard-plugin.ts

@@ -183,7 +183,7 @@ function isPathLikeShellToken(token: string): boolean {
 // resolves the home symlink instead of a (usually missing) cwd child.
 // classify.ts's outside-workspace rule would ask anyway; the expansion fixes
 // the *reason* (sensitive-path) rather than relying on that coincidence.
-function expandHome(token: string): string {
+export function expandHome(token: string): string {
   if (token === "~") return homedir();
   if (token.startsWith("~/")) return joinPath(homedir(), token.slice(2));
   return token;

src/tui/mention-resolution.ts

@@ -1,7 +1,9 @@
 import { readFile, opendir, realpath, stat } from "node:fs/promises";
-import { homedir } from "node:os";
-import { resolve, isAbsolute, join } from "node:path";
-import { isSensitivePathResolved } from "../plugins/secret-guard-plugin.js";
+import { resolve, isAbsolute } from "node:path";
+import {
+  expandHome,
+  isSensitivePathResolved,
+} from "../plugins/secret-guard-plugin.js";
 
 const MAX_MENTION_FILE_BYTES = 200_000;
 const MAX_MENTION_TOTAL_BYTES = 400_000;
@@ -45,16 +47,8 @@ async function summarizeDir(abs: string): Promise<string> {
   return parts.length > 0 ? parts.join(", ") : "empty directory";
 }
 
-// `~` means the operator's home to the shell, not a cwd-relative name —
-// expand before both sensitivity gates (same ordering as the shell-token
-// matcher) so a home-relative credential path denies as itself instead of
-// resolving to a usually-missing cwd child that reads as merely not found.
-function expandHome(path: string): string {
-  if (path === "~") return homedir();
-  if (path.startsWith("~/")) return join(homedir(), path.slice(2));
-  return path;
-}
-// An @mention is the operator directly asking the agent to read one path, once,
+// `~` expansion lives in secret-guard-plugin.ts (single owner); the comment
+// there documents the ordering. An @mention is the operator directly asking the agent to read one path, once,
 // right now — the same consent that already lets the agent read any workspace
 // file. There is no workspace-boundary check here: mentioning a path outside
 // the workspace inlines it exactly like a workspace path would, gated only by