secret_guard: .dart/.kt missing from _SOURCE_SUFFIXES — Dart/Kotlin sources are pattern-redacted and stop compiling

Start in argus_skill/core/secret_guard.py by reading _SOURCE_SUFFIXES and scrub_recent_text_artifacts, especially the include_patterns check around line 848. Add regression coverage for inline privateKey: and apiKey: expressions in .dart and .kt files, while confirming equivalent patterns remain redacted in .env or .json artifacts.

Summary

The round secret guard (argus_skill/core/secret_guard.py) rewrites inline "secret" patterns in artifacts changed during a round. Source-code files listed in _SOURCE_SUFFIXES are exempt from this pattern redaction, but .dart and .kt are missing from that set. Ordinary Dart/Kotlin expressions such as privateKey: this.privateKey are therefore rewritten in place to privateKey: <REDACTED:secret> at the end of a round, and sources stop compiling.

The rewrite is silent (in-place, no backup) and happens after the Engineer has validated the tree, so the build breaks between rounds and the next round inherits a broken tree.

Impact

• Any Flutter/Dart or Android/Kotlin project managed by Argus gets its changed sources corrupted whenever an ordinary privateKey: / apiKey: / clientSecret: expression is present.
• Observed on argus-skill 0.1.1 (installed from main), macOS: 33 occurrences across 9 changed .dart/.kt files in a single round, re-applied after the agent restored the identifiers (the guard runs every round on git-changed files).
• The false positive is systematic for mobile code: privateKey is a normal identifier in Dart/Kotlin, not a secret literal.

Root cause

argus_skill/core/secret_guard.py, _SOURCE_SUFFIXES (~line 180):

_SOURCE_SUFFIXES = {
    ".c",
    ".cc",
    ".cpp",
    ".cue",
    ".go",
    ".h",
    ".hpp",
    ".java",
    ".js",
    ".jsx",
    ".py",
    ".rs",
    ".sh",
    ".ts",
    ".tsx",
}

Used at ~line 848:

include_patterns = (
    not known_secret_only
    and path.suffix.casefold() not in _SOURCE_SUFFIXES
)

Files whose suffix is not in the set are pattern-redacted; Dart and Kotlin are not listed.

Minimal reproduction

Temp tree (no git repo → mtime path), a.dart contains:

class ServerConfig {
  final String privateKey;
  ServerConfig copy() => ServerConfig(privateKey: this.privateKey);
}

.env contains PRIVATE_KEY=0123456789abcdef (positive control). Call
scrub_recent_text_artifacts(tmp, modified_since=time.time() - 60).

Actual — upstream main@746f76b7a7:

changed: True  replacements: 2  files: ('.env', 'a.dart')
a.dart: ... ServerConfig(privateKey: <REDACTED:secret>;   <- broken: ')' consumed
.env :  PRIVATE_KEY= <REDACTED:secret>                    <- intended

With .dart added to _SOURCE_SUFFIXES:

changed: True  replacements: 1  files: ('.env',)
a.dart: ... ServerConfig(privateKey: this.privateKey);    <- untouched
.env :  PRIVATE_KEY= <REDACTED:secret>                    <- intended

Proposed fix

 _SOURCE_SUFFIXES = {
     ".c",
     ".cc",
     ".cpp",
     ".cue",
+    ".dart",
     ".go",
     ".h",
     ".hpp",
     ".java",
     ".js",
     ".jsx",
+    ".kt",
     ".py",
     ".rs",
     ".sh",
     ".ts",
     ".tsx",
 }

(Optionally .kts for Kotlin scripts.)

Suggested regression test

Assert that scrub_recent_text_artifacts leaves inline privateKey: / apiKey: expressions untouched in .dart and .kt files, while still redacting the same patterns in non-source artifacts (e.g. .env, .json).

Environment

• argus-skill 0.1.1, installed from main zip, macOS (Darwin 25.6, arm64), Python 3.12.13
• Verified on upstream main @ 746f76b7a7 (raw file still lacks .dart/.kt); the preview repo (lbx154/Argus, main) shows the same set.