From 303e4beed3069dbfd55c9d99d7614ea7578fa109 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Wed, 4 Nov 2026 17:29:17 -0600
Subject: [PATCH] fix(evals): preserve coordinated negative credential
 alternatives

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .../external-company-secret-question.test.ts                | 6 ++++++
 .../chat-catalog-domains/external-company-secret.ts         | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/tests/runner-e2e/chat-catalog-domains/external-company-secret-question.test.ts b/tests/runner-e2e/chat-catalog-domains/external-company-secret-question.test.ts
index b6111ef569e..cf693b0b4ae 100644
--- a/tests/runner-e2e/chat-catalog-domains/external-company-secret-question.test.ts
+++ b/tests/runner-e2e/chat-catalog-domains/external-company-secret-question.test.ts
@@ -94,3 +94,9 @@ it.each([["a plaintext file before opening Settings Secrets",false],["the secure
  const row=environmentQuestion();row.payload.questionSet!.questions[0]!.helpText=`Don't enter the key in chat, and please enter the key in ${destination}.`;
  expect(!!companySecretQuestionHandoff(row,binding)).toBe(accepted);
 });
+it("keeps a coordinated negative alternative within the original prohibition",()=>{
+ const row=environmentQuestion();row.payload.questionSet!.questions[0]!.helpText="Do not paste the key in chat, or enter the key in plaintext files.";
+ expect(companySecretQuestionHandoff(row,binding)).toMatchObject({environmentName:"DEPLOYMENT_API_KEY"});
+ const positive=environmentQuestion();positive.payload.questionSet!.questions[0]!.helpText="Enter the key in plaintext files.";
+ expect(companySecretQuestionHandoff(positive,binding)).toBeUndefined();
+});
diff --git a/tests/runner-e2e/chat-catalog-domains/external-company-secret.ts b/tests/runner-e2e/chat-catalog-domains/external-company-secret.ts
index 2e0db077913..b5e831d346d 100644
--- a/tests/runner-e2e/chat-catalog-domains/external-company-secret.ts
+++ b/tests/runner-e2e/chat-catalog-domains/external-company-secret.ts
@@ -48,7 +48,7 @@ export function companySecretQuestionHandoff(value:unknown,b:SecretQuestionBindi
  if(q.answerMode==="text"){
   const prompt=q.prompt.replace(/\(Do not include the key value\.\)/gi,"").trim();
   const guidance=[qs.title,qs.description,q.header,q.helpText,qs.submitLabel].filter(Boolean).join("\n");
-  const instructions=guidance.replace(/\b(?:(?:do|should|must|can|could|will|would)\s+not|don.t|never)\s+(?:paste|send|share|provide|enter|include)[^.!?,;\n]*/gi,"");
+  const instructions=guidance.replace(/\b(?:(?:do|should|must|can|could|will|would)\s+not|don.t|never)\s+(?:paste|send|share|provide|enter|include)[^.!?,;\n]*(?:,\s*or\s+(?:please\s+)?(?:paste|send|share|provide|enter|include)[^.!?,;\n]*)*/gi,"");
   const unsafeInstructions=instructions.split(/[.!;\n]+/).some(clause=>{
    const request=clause.match(/\b(?:paste|send|share|provide|enter|include|supply|type)\b.{0,70}?\b(?:key|credential|token)\b(.*)/i);
    return !!request&&!/^\s+(?:value\s+)?(?:only\s+)?(?:in|into|on|via|through)\s+(?:(?:the|your|a)\s+)?(?:(?:secure\s+)?Settings(?:\s*(?:→|>|\/)\s*|\s+)Secrets(?:\s+(?:form|page|field))?|(?:secure\s+)?Secrets\s+(?:form|page|field)|secure\s+(?:form|page|field))\b/i.test(request[1]!);