fix(secret-guard): extras-deny hyphen-digit grep and resume scopes

Author: TheGreatAxios

src/exec/runner.ts

@@ -1105,6 +1105,8 @@ export async function runExec(config: Config): Promise<ExecResult> {
         resolveParkedCallId: (correlationId) =>
           resolveParkedCallIdFromStore(activeStorage, correlationId),
         gate: permissionGate,
+        cwd: config.cwd,
+        extraDeniedPaths: [config.globalSettingsPath],
         deliver: async (message, stillCurrent) => {
           if (!stillCurrent()) return;
           await approvalDeliverer.deliver(message);

src/plugins/ripgrep-plugin.ts

@@ -109,16 +109,24 @@ export function ripgrepPlugin(
   const maxBytes = limits.maxOutputBytes ?? MAX_OUTPUT_BYTES;
   const isExtraDenied = createExtraDeniedPathMatcher(extraDeniedPaths);
 
-  // The file a `file:line:match` grep line came from, resolved so it can be
-  // tested against the extras-denied set. Context separators (`--`) and our
-  // own `...` notice lines carry no file and are never matches.
+  // The file a `file:line:match` (or context `file-line-`) grep line came from,
+  // resolved so it can be tested against the extras-denied set. Context
+  // separators (`--`) and our own `...` notice lines carry no file and are
+  // never matches.
+  //
+  // rg's separator is `:-digits-:` / `:digits:`. A non-greedy first match
+  // treats `-<digits>-` inside a dated or versioned path (`2026-09-26-config.json`,
+  // `gpt-4-1.json`) as the line-number field and tests the wrong prefix. Every
+  // separator is a candidate so a hyphen-digit path is still extras-denied, and
+  // a later `:digits:` in the match text cannot un-deny the real file.
   const grepLineDeniedFile = (line: string, rgCwd: string): boolean => {
     if (line.startsWith("...") || line === "--") return false;
-    const match = /^(.*?)[:-]\d+[:-]/.exec(line);
-    if (match?.[1] === undefined) return false;
-    const candidate = match[1].replace(/^\.\//, "");
-    if (candidate.length === 0) return false;
-    return isExtraDenied(resolvePath(rgCwd, candidate));
+    for (const match of line.matchAll(/[:-]\d+[:-]/g)) {
+      const candidate = line.slice(0, match.index).replace(/^\.\//, "");
+      if (candidate.length === 0) continue;
+      if (isExtraDenied(resolvePath(rgCwd, candidate))) return true;
+    }
+    return false;
   };
 
   // Drop extras-denied matches from grep output (both legs). Filtering before

src/plugins/secret-guard-config-denylist.test.ts

@@ -50,6 +50,23 @@ async function withFixture<T>(
   }
 }
 
+async function withNamedConfig<T>(
+  name: string,
+  run: (paths: { cwd: string; customConfig: string }) => Promise<T>,
+): Promise<T> {
+  const parent = await mkdtemp(join(tmpdir(), "cl9386-dated-config-"));
+  const cwd = join(parent, "ws");
+  await mkdir(cwd, { recursive: true });
+  const customConfig = join(cwd, name);
+  await writeFile(customConfig, `${SKIP_PAYLOAD}\n`);
+  await writeFile(join(cwd, "scratch.txt"), "ordinary workspace file\n");
+  try {
+    return await run({ cwd, customConfig });
+  } finally {
+    await rm(parent, { recursive: true, force: true });
+  }
+}
+
 function runner(
   cwd: string,
   skipPermissions: boolean,
@@ -158,6 +175,32 @@ describe("CL-9386 runtime-denylist the active --config path holding skip", () =>
       });
     });
 
+    for (const datedName of [
+      "2026-09-26-config.json",
+      "gpt-4-1.json",
+    ] as const) {
+      test(`${mode}: dir-scoped grep does not surface extras-denied ${datedName}`, async () => {
+        await withNamedConfig(datedName, async ({ cwd, customConfig }) => {
+          const { tools } = runner(cwd, skipPermissions, customConfig);
+          const result = await tools.run(
+            {
+              id: "1",
+              name: "grep",
+              arguments: {
+                pattern: "dangerouslySkipPermissions",
+                path: ".",
+              },
+            },
+            new AbortController().signal,
+          );
+          expect(result.isError !== true).toBe(true);
+          expect(String(result.content)).not.toContain(
+            "dangerouslySkipPermissions",
+          );
+        });
+      });
+    }
+
     test(`${mode}: dir-scoped search_files does not surface extras-denied names`, async () => {
       await withFixture(async ({ cwd, customConfig }) => {
         const { tools } = runner(cwd, skipPermissions, customConfig);
@@ -254,6 +297,29 @@ describe("CL-9386 runtime-denylist the active --config path holding skip", () =>
     });
   });
 
+  for (const datedName of ["2026-09-26-config.json", "gpt-4-1.json"] as const) {
+    test(`rg missing: fallback grep does not surface extras-denied ${datedName}`, async () => {
+      await withNamedConfig(datedName, async ({ cwd, customConfig }) => {
+        const tools = createPosixTools({
+          cwd,
+          plugins: [ripgrepPlugin(cwd, {}, rgMissingSpawn, [customConfig])],
+        });
+        const result = await tools.run(
+          {
+            id: "1",
+            name: "grep",
+            arguments: { pattern: "dangerouslySkipPermissions", path: cwd },
+          },
+          new AbortController().signal,
+        );
+        expect(result.isError !== true).toBe(true);
+        expect(String(result.content)).not.toContain(
+          "dangerouslySkipPermissions",
+        );
+      });
+    });
+  }
+
   test("rg missing: fallback search_files does not surface extras-denied names", async () => {
     await withFixture(async ({ cwd, customConfig }) => {
       const tools = createPosixTools({

src/session/approval-resume.test.ts

@@ -1,4 +1,7 @@
 import { describe, expect, mock, test } from "bun:test";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import type { Agent, SendResult } from "@intx/agent";
 import type {
   ApprovalSnapshot,
@@ -10,6 +13,7 @@ import type {
 
 import { APPROVAL_TIMEOUT_RESULT_TEXT } from "../permission/decline-markers.js";
 import type { PermissionGate } from "../permission/gate.js";
+import { createExtraDeniedPathMatcher } from "../plugins/secret-guard-plugin.js";
 import {
   APPROVAL_DROPPED_NOTICE,
   createApprovalResume,
@@ -137,6 +141,69 @@ describe("requestFromApprovalSnapshot aliased file tools", () => {
   });
 });
 
+function shellSnapshot(command: string): ApprovalSnapshot {
+  return {
+    name: "run_shell",
+    description: "run a shell command",
+    inputSchema: {},
+    arguments: { command },
+  };
+}
+
+describe("requestFromApprovalSnapshot secret persist scopes", () => {
+  test("static secret shell strips persist scopes without extras", () => {
+    const request = requestFromApprovalSnapshot(
+      shellSnapshot("cat .env"),
+      "corr-env",
+    );
+    expect(request?.tool).toBe("run_shell");
+    expect(request?.scopes).toEqual([]);
+  });
+
+  test("non-secret shell keeps persist scopes", () => {
+    const request = requestFromApprovalSnapshot(
+      shellSnapshot("cat README.md"),
+      "corr-readme",
+    );
+    expect(request?.tool).toBe("run_shell");
+    expect(request?.scopes.length).toBeGreaterThan(0);
+  });
+
+  test("extras-secret shell strips persist scopes", async () => {
+    const parent = await mkdtemp(join(tmpdir(), "cl9386-resume-extras-"));
+    const cwd = join(parent, "ws");
+    const customConfig = join(cwd, "operator-config.json");
+    try {
+      await mkdir(cwd, { recursive: true });
+      await writeFile(
+        customConfig,
+        `${JSON.stringify({ dangerouslySkipPermissions: true }, null, 2)}\n`,
+      );
+      const request = requestFromApprovalSnapshot(
+        shellSnapshot("cat operator-config.json"),
+        "corr-extras",
+        {
+          cwd,
+          isExtraDenied: createExtraDeniedPathMatcher([customConfig]),
+        },
+      );
+      expect(request?.tool).toBe("run_shell");
+      expect(request?.scopes).toEqual([]);
+    } finally {
+      await rm(parent, { recursive: true, force: true });
+    }
+  });
+
+  test("pin: custom config path without extras keeps persist scopes", () => {
+    const request = requestFromApprovalSnapshot(
+      shellSnapshot("cat operator-config.json"),
+      "corr-no-extras",
+    );
+    expect(request?.tool).toBe("run_shell");
+    expect(request?.scopes.length).toBeGreaterThan(0);
+  });
+});
+
 describe("approval decision intent headers", () => {
   for (const allow of [true, false]) {
     test(`preserves ${allow ? "granted" : "denied"} intent and correlation through the session queue`, async () => {

src/session/approval-resume.ts

@@ -23,7 +23,10 @@ import { getLogger } from "@intx/log";
 
 import { LOG_NAMESPACE_ROOT } from "../branding.js";
 import { canonicalToolName } from "../agent/canonical-tool-name.js";
-import { commandReferencesSensitivePath } from "../plugins/secret-guard-plugin.js";
+import {
+  commandReferencesSensitivePath,
+  createExtraDeniedPathMatcher,
+} from "../plugins/secret-guard-plugin.js";
 import { APPROVAL_TIMEOUT_RESULT_TEXT } from "../permission/decline-markers.js";
 import { buildRequests } from "../permission/classify.js";
 import type { PermissionGate } from "../permission/gate.js";
@@ -59,6 +62,10 @@ export interface ApprovalResume {
 export function requestFromApprovalSnapshot(
   snapshot: ApprovalSnapshot,
   correlationId: string,
+  extras: {
+    cwd?: string;
+    isExtraDenied?: (value: string) => boolean;
+  } = {},
 ): PermissionRequest | null {
   const parsed = ApprovalSnapshotShape(snapshot);
   if (parsed instanceof type.errors) return null;
@@ -71,7 +78,11 @@ export function requestFromApprovalSnapshot(
   if (request === undefined) return null;
   const anySecret =
     request.tool === "run_shell" &&
-    commandReferencesSensitivePath(request.subject) !== undefined;
+    commandReferencesSensitivePath(
+      request.subject,
+      extras.cwd ?? process.cwd(),
+      extras.isExtraDenied ?? (() => false),
+    ) !== undefined;
   return anySecret ? { ...request, scopes: [] } : request;
 }
 
@@ -184,7 +195,16 @@ export function createApprovalResume(args: {
     correlationId: string,
   ) => string | undefined | Promise<string | undefined>;
   gate: PermissionGate;
+  // Workspace the parked shell ran in, and extras-denied config paths the live
+  // decide()/resolveSuspended secret check already consults. Resume rebuilds
+  // persistable scopes from the snapshot and must apply the same extras so
+  // Always/Project are not offered for extras-secret shell.
+  cwd?: string;
+  extraDeniedPaths?: readonly string[];
 }): ApprovalResume {
+  const isExtraDenied = createExtraDeniedPathMatcher(
+    args.extraDeniedPaths ?? [],
+  );
   // Retry re-await wiring: correlation ids whose decision was handed to the
   // reactor reuse that acceptance. A retry after an observed acceptance
   // returns without opening the gate or delivering again, so the parked call
@@ -254,7 +274,10 @@ export function createApprovalResume(args: {
       const request =
         approvalSnapshot === undefined
           ? null
-          : requestFromApprovalSnapshot(approvalSnapshot, correlationId);
+          : requestFromApprovalSnapshot(approvalSnapshot, correlationId, {
+              ...(args.cwd !== undefined ? { cwd: args.cwd } : {}),
+              isExtraDenied,
+            });
       if (request === null) {
         args.registerParkedCancel?.(undefined);
         await deliverDecision(

src/tui/runner/session.ts

@@ -541,6 +541,8 @@ export async function assembleTUISession(
       });
     },
     gate: permissionGate,
+    cwd: config.cwd,
+    extraDeniedPaths: [config.globalSettingsPath],
   });
   state.enqueueAgentDeliver = (
     deliverToLiveAgent: () => void,