fix: overzealous 'token' and 'credential' security regexps

[rossigee]

Description

Removes token and credentials file globs for files that Continue should not access.

This matches legitimate source files that we would want our AI agents to be able to read and manage, such as 'tokens.py', 'tokens.go', 'tokens.c' etc etc.

Example:

○ Read(src/pkg/token/options.go)

● Reading or Editing src/pkg/token/options.go is not allowed because it is a security concern. Do not attempt to read or edit this
  file in any way.

AI Code Review

• Team members only: AI review runs automatically when PR is opened or marked ready for review
• Team members can also trigger a review by commenting @continue-review

Checklist

• [] I've read the contributing guide
• [] The relevant docs, if any, have been updated or created
• [] The relevant tests, if any, have been updated or created

Screen recording or screenshot

N/A

Tests

N/A

---

Summary by cubic

Relaxed security ignore patterns by removing token., credentials., and the bare token/credentials filenames from indexing. This prevents excluding legitimate source files (e.g., tokens.py) while still ignoring *.token and other clear secret files (e.g., *.secret, *.secrets, auth.json).

^{Written for commit 19f7a1a. Summary will update automatically on new commits.}

[continue]

Keep this PR in a mergeable state →

Learn more

---

All Green is an AI agent that automatically:

✅ Addresses code review comments

✅ Fixes failing CI checks

✅ Resolves merge conflicts

[continue-development-app]

Keep this PR in a mergeable state →

Learn more

---

All Green is an AI agent that automatically:

✅ Addresses code review comments

✅ Fixes failing CI checks

✅ Resolves merge conflicts

[cubic-dev-ai]

No issues found across 1 file

[RomneyDa]

@rossigee I agree with this change. I think you could also remove the credentials and tokens folder blockers. Looks like some tests will need to be updated since they are now failing

[continue]

I've created a branch with the necessary test updates and IntelliJ pattern fixes: docs/update-pr-9085-tests

Changes

Test Updates (core/indexing/ignore.vitest.ts)

• Removed test expectation for credentials.json which no longer matches after removing the credentials.* pattern
• Added new test cases to verify legitimate source files (like tokens.py, credentials.go, token_manager.py, etc.) are not incorrectly blocked

IntelliJ Implementation (IntelliJIde.kt)

• Removed credentials.* and token.* patterns from the IntelliJ security ignore list to match the core TypeScript changes
• Ensures consistent behavior across both IDE extensions

How to Apply

You can cherry-pick the commits or merge the branch into your PR:

git fetch https://github.com/continuedev/continue.git docs/update-pr-9085-tests
git cherry-pick dffe4c8 358863f

Or view the changes:

• Test updates: dffe4c8
• IntelliJ fix: 358863f