feat(policy): content-first sanitizer + apply_patch coverage + web_fetch URL hardening

[AtropinolTT]

Closes the gaps the maintainer committed to handling in the PR #4 reply ("we'll split this into a more general sanitizer fix and handle separately"). All changes are path-only / sandbox-first compatible — no write-side content blockers added.

What it does

Three independent fixes, each with full test coverage and no public API breakage:

1. Sanitizer redesign (src/classifier.ts) — replaces the key-name-driven sanitizeClassifierText with a 10-pattern content-first redactor (redactClassifierText). Every string at any depth in tool arguments is now scanned for credential-shaped substrings, regardless of the field name. Key-name matching (SECRET_KEYS) is retained as defense-in-depth for the property level.

   • Anthropic regex anchors api\d{2}- + 32+ body chars per the G1 spec fix (rejects docs-shaped sk-ant-anything20plus)
   • Covers AKIA/ASIA, gho_/gh[pus]_/github_pat_, sk-/sk-proj-, Anthropic, and PEM private-key blocks
   • sanitizeClassifierArguments rewritten to recurse every string through redactClassifierText; CONTENT_KEYS removed entirely (the [redacted-content:N-chars] placeholder was the leak that hid credentials behind bulk-content keys)

2. apply_patch policy coverage (src/policy.ts) — apply_patch targets live in the patch text, not in file_path/path/cwd/workdir, so the existing hardDenyReason fuse was a no-op for it. Added:

   • New apply_patch block in hardDenyReason that parses the patch text via extractApplyPatchPaths (Task 1) and asks hardDestructiveTargetReason for each target — any destructive path → hard deny
   • New apply_patch branch in assessTool that mirrors write/edit semantics: ask with classifierEligible: true on protected project paths, ask with classifierEligible: false on missing/unparseable patches, allow with filesystemEffects for workspace targets

3. web_fetch URL credential detection (src/policy.ts) — containsCredentialMaterial checked serialized arguments but missed query-parameter URLs. Added:

   • urlContainsCredential(url) helper: parses with new URL(), iterates searchParams, flags any parameter whose name (token / access_token / api_key / sig / signature / auth / authorization) pairs with a credential-shaped value (8+ chars base64url OR 16+ hex digest); regex fallback for relative/malformed URLs
   • New hardDenyReason block gated on the same /^web_fetch|curl|wget/ OR EXTERNAL_WRITE_TOOL predicate the existing containsCredentialMaterial check uses; reason: 'external URL contains credential-shaped query parameter'

Diff scope (code only, against this branch's base)

src/classifier.ts        |  87 ++++++++++++++++++++++---
src/paths.ts             |  75 +++++++++++++++++++++
src/policy.ts            |  94 +++++++++++++++++++++++++++
tests/classifier.spec.ts | 149 ++++++++++++++++++++++++++++++++++++++++--
tests/paths.spec.ts      |  97 ++++++++++++++++++++++++++++
tests/policy.spec.ts     | 165 +++++++++++++++++++++++++++++++++++++++++++++++
6 files changed, 653 insertions(+), 14 deletions(-)

Two additional commits on the branch (docs(spec), docs(plan)) are internal design notes that drove the implementation — the maintainer is welcome to review them for context but they're not required reading. Spec: docs/superpowers/specs/2026-08-17-sanitizer-and-policy-hardening-design.md (~415 lines). Plan: docs/superpowers/plans/2026-08-17-sanitizer-policy-hardening.md (~1259 lines).

Test summary

• 118/118 tests pass across 11 test files (the 2 sandbox-business failures are pre-existing missing upstream dev deps, unrelated to this PR)
• New tests added: 9 (paths) + 10 (classifier) + 7+1 update (classifier) + 10 (policy/apply_patch) + 8 (policy/URL) = 45 new tests; 26 of these are content-first redaction unit tests for the new redactClassifierText API
• pnpm run typecheck on the 3 src files: clean. Project-wide typecheck has only one pre-existing src/escalation.ts TS2307 unrelated to this PR (verified by reproducing against the pre-branch baseline)
• No public API breakage: sanitizeClassifierText(value: string): string and sanitizeClassifierArguments(value, depth=0): unknown signatures preserved; redactClassifierText and ClassifierRedaction are additive new exports; extractApplyPatchPaths is additive new export

Locked constraints honored

• ✅ Diff as small as possible (6 code files, ~650 lines)
• ✅ No new files; only src/classifier.ts, src/policy.ts, src/paths.ts modified
• ✅ No public API breakage at the export level
• ✅ No new write-side content blocker (sandbox-first preserved; all new policy branches are path-only)
• ✅ tests/classifier.spec.ts:54/55/56/58 updated per spec §4.1
• ✅ Anthropic regex anchors api\d{2}- and requires 32+ body chars (G1 review fix)

Sandbox-first philosophy alignment

The PR explicitly does NOT add write-side credential detection. Per the maintainer's PR #4 reply, workspace-internal writes are governed by the filesystem sandbox; credential detection happens at the read + external-send boundaries only. All new decisions are PATH-only (hardDestructiveTargetReason for destructive paths, isProtectedProjectPath for protected metadata, containsCredentialMaterial/urlContainsCredential for external calls). The sanitizer fix is purely on the classifier-boundary text, where bulk content is redacted before crossing the network boundary regardless of the field name it sits under.