fix

internal/triage/triage.go

@@ -47,7 +47,8 @@ var (
 	// control, CMS/admin paths, path traversal. Deliberately path-only.
 	probeRoute = regexp.MustCompile(`(?i)(\.env\b|\.git\b|\.htpasswd|\.htaccess|\.npmrc|\.claude|\.docker|\.kube|\.aws|\.ssh|` +
 		`wp-|/wp/|/wp$|wordpress|phpmyadmin|phpinfo|cgi-bin|xmlrpc|userfiles|@fs/|etc/passwd|proc/self|\.\./|%2e%2e|` +
-		`\.php\b|_debugbar|debug/pprof|server-info|actuator|__env|\.bash_|\.profile$|graphql/console|` +
+		`\.php\b|\.codex|\.cursor|\.windsurf|\.aider|\.clinerules|\.roo(/|code|$)|\.continue/|\.gemini|\.idea/|\.vscode/|copilot-instructions|claude\.md|agents\.md|mcp\.json|` +
+		`_debugbar|debug/pprof|server-info|actuator|__env|\.bash_|\.profile$|graphql/console|` +
 		`credentials|secrets?\b|firebase|serviceaccount|/config(/|\.)|settings\.(js|json|py)$|bootstrap\.properties|` +
 		`\.(ya?ml|toml|properties|sql|bak|old|swp|zip|tar|tgz|gz|ini|conf|cfg|key|pem)$)`)
 	bugText  = regexp.MustCompile(`(?i)panic|nil pointer|index out of range|typeerror|referenceerror|deadlock|unhandled|chunkloaderror|segfault`)

internal/triage/triage_test.go

@@ -41,3 +41,16 @@ func TestProbeBeatsLifecycleFlags(t *testing.T) {
 		t.Fatalf("got %s", got.Category)
 	}
 }
+
+func TestAIToolConfigPathsAreProbes(t *testing.T) {
+	for _, p := range []string{"/.cursorrules", "/.codex/auth.json", "/backup/.claude/credentials.json", "/.windsurfrules", "/.vscode/launch.json", "/.idea/WebServers.xml", "/x/.github/copilot-instructions.md", "/CLAUDE.md", "/mcp.json", "/.clinerules"} {
+		if !IsProbePath(p) {
+			t.Errorf("%s should be a probe", p)
+		}
+	}
+	for _, p := range []string{"/mcp", "/api/agents", "/api/sessions/{id}", "/api/continue"} {
+		if IsProbePath(p) {
+			t.Errorf("%s must not be a probe", p)
+		}
+	}
+}