{"record":{"id":"9b025792ed19fb34","repo":"ruvnet/ruflo","slug":"scansecrets-not-available-in-js-fallback-use-enfo","errorCode":null,"errorMessage":"scanSecrets not available in JS fallback; use EnforcementGates","messagePattern":"scanSecrets not available in JS fallback; use EnforcementGates","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/guidance/src/wasm-kernel.ts","lineNumber":176,"sourceCode":"  } else {\n    // JS fallback — identical outputs, just slower\n    kernelInstance = {\n      available: false,\n      version: 'js-fallback',\n\n      sha256: jsSha256,\n      hmacSha256: jsHmacSha256,\n      contentHash: jsContentHash,\n      signEnvelope: jsHmacSha256,\n      verifyChain: () => {\n        // Chain verification requires full envelope parsing — not implemented\n        // in JS fallback because the ProofChain class already does it.\n        throw new Error('verifyChain not available in JS fallback; use ProofChain.verifyChain()');\n      },\n\n      scanSecrets: (): string[] => {\n        // Gate scanning in JS fallback defers to EnforcementGates class\n        throw new Error('scanSecrets not available in JS fallback; use EnforcementGates');\n      },\n      detectDestructive: (): string | null => {\n        throw new Error('detectDestructive not available in JS fallback; use EnforcementGates');\n      },\n\n      batchProcess: (): BatchResult[] => {\n        throw new Error('batchProcess requires WASM kernel');\n      },\n    };\n  }\n\n  return kernelInstance;\n}\n\n/**\n * Check if the WASM kernel is available without initializing it.\n */\nexport function isWasmAvailable(): boolean {","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/guidance/src/wasm-kernel.ts#L158-L194","documentation":"The JS fallback kernel returned by getKernel() throws from scanSecrets() because secret scanning in the fallback is delegated to the EnforcementGates class rather than reimplemented. The throw is a hard redirect: the operation exists, but only in the WASM kernel or via EnforcementGates. You only hit it when the WASM binary failed to load.","triggerScenarios":"Calling getKernel().scanSecrets(content) when the WASM module did not load (missing .wasm asset, unsupported runtime, CSP restrictions) — the fallback kernel's scanSecrets stub throws immediately.","commonSituations":"Deploying to runtimes without WebAssembly; bundler configs that drop the wasm sidecar; security tools that gate WASM instantiation; tests that assume the accelerated kernel is always present.","solutions":["Use the EnforcementGates class for secret scanning — it is the supported pure-JS implementation","Check isWasmAvailable() before choosing the kernel path, and branch accordingly","Restore WASM loading (ship the .wasm asset, allow WebAssembly in runtime/CSP) if you need the fast path"],"exampleFix":"// before\nconst hits = getKernel().scanSecrets(content); // throws in JS fallback\n\n// after\nconst hits = isWasmAvailable()\n  ? getKernel().scanSecrets(content)\n  : enforcementGates.scanSecrets(content); // JS implementation","handlingStrategy":"type-guard","validationCode":"import { getKernel, isWasmAvailable } from './wasm-kernel.js';\n\nfunction scanSecretsAnywhere(content: string, gates: EnforcementGates): string[] {\n  return isWasmAvailable()\n    ? getKernel().scanSecrets(content)\n    : gates.scanSecrets(content); // supported JS implementation\n}","typeGuard":"function supportsKernelScan(k: WasmKernel): boolean {\n  return k.available; // false => fallback kernel: scanSecrets always throws\n}","tryCatchPattern":"try {\n  hits = kernel.scanSecrets(content);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('JS fallback')) {\n    hits = gates.scanSecrets(content);\n  } else {\n    throw e;\n  }\n}","preventionTips":["Never call kernel scan/verify ops without checking kernel.available","Keep an EnforcementGates instance wired for environments where WASM cannot load","Add a CI job running the secret-scan path in a WASM-disabled runtime"],"tags":["wasm","fallback","secret-scanning","guidance","feature-detection"],"backgroundTag":"wasm-unavailable","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}