gitreins-secrets-board-commit-builtin-scanner
Diagnosis complete and verified. The solution document is at ~/gitreins-solution.md.
Root cause — a three-part failure chain on the board-only commit:
1. Enabling condition: the gitleaks TOML scanner timed out at 30s under sibling-worker load, so gitreins fell back to its built-in scanner (engine/guard_manager.py:415).
2. Direct trigger: the pipx 0.11.0 engine at ~/.cache/pipx/391c9db8b4bbbca/.../engine/guard_manager.py:415 still carried the v1 unanchored pattern sk-[A-Za-z0-9_-]{20,} — no left anchor, no requirement for UPPERCASE/DIGIT.
3. False positive: historical board lines genuinely quote sk-premise-verification (all-lowercase, 20 body chars), which v1 matches. The t202 v3 fix (\bsk- lookahead + at least one [A-Z0-9] in the 20+ body) had been applied to gitreins-poc/board-venv engines but not this pipx install.
Verification I ran (Python 3.14, verify_regex.py) — reproduces the bug and proves the fix:
V1 flags real = True, flags lower = True ← bug
V3 flags real = True, flags lower = False ← fixed
VERIFIED: v1 falsely flags board line; v3 does not, and v3 keeps real keys
The document includes:
- 4-step root-cause analysis with pattern mechanics and a triage checklist (which gitreins → grep engine for sk- pattern version)
- Immediate fix: find/replace v1→v3 in guard_manager.py with a backup + guarded Python patcher (avoids sed escaping pitfalls) + grep verification
- Durable fix: pip install --force-reinstall gitreins@git+...@6f7a02b once the pinned engine commit is pushed
- Non-persistent hotfix and a 4-part verification section: functional regex asserts, in-tree grep checks, end-to-end PASS 4/4 commit test, and a negative control (real key still fails)
One correction I made while verifying: the document now uses a real mixed-case key sample (sk-a***), since an all-lowercase sample would have broken the v3 "still catches real keys" assertion.
# Evidence - Problem class: gitreins-secrets-board-commit-builtin-scanner - Model: openrouter/deepseek/deepseek-v4-flash-0731 - Solved: 2026-08-24T16:51:56.355Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "speclang t247: pre-commit guard FAILED on secrets (3 findings) while committing a board-only change (events.jsonl + board.jsonl). Gitleaks TOML timed out after 30s under host load (sibling worker) and gitreins fell back to its built-in scanner. Root cause: the pipx 0.11.0 engine at ~/.cache/pipx/391c9db8b4bbbca/lib/python3.14/site-packages/engine/guard_manager.py:415 still carried the v1 UNANCHORED pattern sk-[A-Za-z0-9_-]{20,} \u2014 historical board lines quoting 'sk-premise-verification' (all lowercase, 21 chars) matched. The t202 v3 fix (\\bsk- lookahead + require >=1 UPPERCASE/DIGIT in the 20+ chars) had been applied to gitreins-poc + board-venv engines but NOT this pipx install. Fix: patch guard_manager.py pattern to v3: \\bsk-(?=[A-Za-z0-9_-]{20,})[A-Za-z0-9_-]*[A-Z0-9][A-Za-z0-9_-]* \u2014 guard then PASS 4/4 with built-in scanner. Triage notes: when the hook flags secrets on board files, check WHICH gitreins install the hook resolved (which gitreins) and grep its engine for the sk- pattern version; v1 unanchored = the trigger; gitleaks timeout under load is the enabling condition. Durable fix = pip install --force-reinstall gitreins@git+...@6f7a02b once the pinned engine commit is pushed to the gitreins repo.", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4-flash-0731", "problem_class": "gitreins-secrets-board-commit-builtin-scanner", "provider": "openrouter", "solved_at": "2026-08-24T16:51:56.355Z", "version": ""}Diagnosis complete and verified. The solution document is at ~/gitreins-solution.md.
Root cause — a three-part failure chain on the board-only commit:
1. Enabling condition: the gitleaks TOML scanner timed out at 30s under sibling-worker load, so gitreins fell back to its built-in scanner (engine/guard_manager.py:415).
2. Direct trigger: the pipx 0.11.0 engine at ~/.cache/pipx/391c9db8b4bbbca/.../engine/guard_manager.py:415 still carried the v1 unanchored pattern sk-[A-Za-z0-9_-]{20,} — no left anchor, no requirement for UPPERCASE/DIGIT.
3. False positive: historical board lines genuinely quote sk-premise-verification (all-lowercase, 20 body chars), which v1 matches. The t202 v3 fix (\bsk- lookahead + at least one [A-Z0-9] in the 20+ body) had been applied to gitreins-poc/board-venv engines but not this pipx install.
Verification I ran (Python 3.14, verify_regex.py) — reproduces the bug and proves the fix:
V1 flags real = True, flags lower = True ← bug
V3 flags real = True, flags lower = False ← fixed
VERIFIED: v1 falsely flags board line; v3 does not, and v3 keeps real keys
The document includes:
- 4-step root-cause analysis with pattern mechanics and a triage checklist (which gitreins → grep engine for sk- pattern version)
- Immediate fix: find/replace v1→v3 in guard_manager.py with a backup + guarded Python patcher (avoids sed escaping pitfalls) + grep verification
- Durable fix: pip install --force-reinstall gitreins@git+...@6f7a02b once the pinned engine commit is pushed
- Non-persistent hotfix and a 4-part verification section: functional regex asserts, in-tree grep checks, end-to-end PASS 4/4 commit test, and a negative control (real key still fails)
One correction I made while verifying: the document now uses a real mixed-case key sample (sk-a***), since an all-lowercase sample would have broken the v3 "still catches real keys" assertion.
# Evidence - Problem class: gitreins-secrets-board-commit-builtin-scanner - Model: openrouter/deepseek/deepseek-v4-flash-0731 - Solved: 2026-08-24T16:51:56.355Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "speclang t247: pre-commit guard FAILED on secrets (3 findings) while committing a board-only change (events.jsonl + board.jsonl). Gitleaks TOML timed out after 30s under host load (sibling worker) and gitreins fell back to its built-in scanner. Root cause: the pipx 0.11.0 engine at ~/.cache/pipx/391c9db8b4bbbca/lib/python3.14/site-packages/engine/guard_manager.py:415 still carried the v1 UNANCHORED pattern sk-[A-Za-z0-9_-]{20,} \u2014 historical board lines quoting 'sk-premise-verification' (all lowercase, 21 chars) matched. The t202 v3 fix (\\bsk- lookahead + require >=1 UPPERCASE/DIGIT in the 20+ chars) had been applied to gitreins-poc + board-venv engines but NOT this pipx install. Fix: patch guard_manager.py pattern to v3: \\bsk-(?=[A-Za-z0-9_-]{20,})[A-Za-z0-9_-]*[A-Z0-9][A-Za-z0-9_-]* \u2014 guard then PASS 4/4 with built-in scanner. Triage notes: when the hook flags secrets on board files, check WHICH gitreins install the hook resolved (which gitreins) and grep its engine for the sk- pattern version; v1 unanchored = the trigger; gitleaks timeout under load is the enabling condition. Durable fix = pip install --force-reinstall gitreins@git+...@6f7a02b once the pinned engine commit is pushed to the gitreins repo.", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4-flash-0731", "problem_class": "gitreins-secrets-board-commit-builtin-scanner", "provider": "openrouter", "solved_at": "2026-08-24T16:51:56.355Z", "version": ""}