zeroclaw-labs/zeroclaw · info

static Slack app-level token regex must compile

Error message

static Slack app-level token regex must compile

What it means

Sibling of the Slack token pattern: check_api_keys() compiles the hardcoded Slack app-level token pattern xapp-[0-9A-Za-z-]{10,} on each scan and expects compilation to succeed. Regex literals only fail through editing mistakes, so this expect is a programming-error tripwire, not a runtime condition.

Source

Thrown at crates/zeroclaw-runtime/src/security/leak_detector.rs:207

                ),
                // GitHub
                (
                    Regex::new(r"gh[pousr]_[a-zA-Z0-9]{36,}").unwrap(),
                    "GitHub token",
                ),
                (
                    Regex::new(r"github_pat_[a-zA-Z0-9_]{22,}").unwrap(),
                    "GitHub PAT",
                ),
                // Slack
                (
                    Regex::new(r"xox[baprs]-[0-9A-Za-z-]{10,}")
                        .expect("static Slack token regex must compile"),
                    "Slack token",
                ),
                (
                    Regex::new(r"xapp-[0-9A-Za-z-]{10,}")
                        .expect("static Slack app-level token regex must compile"),
                    "Slack app-level token",
                ),
                (
                    Regex::new(r"xwfp-[0-9A-Za-z-]{10,}")
                        .expect("static Slack workflow token regex must compile"),
                    "Slack workflow token",
                ),
                (
                    // Rotation family: refresh tokens (`xoxe-…`) and rotated
                    // access tokens (`xoxe.xoxb-…`, `xoxe.xoxp-…`). The base
                    // `xox[baprs]-` class excludes `e`, and matching only the
                    // inner `xoxb-`/`xoxp-` would leave the `xoxe.` prefix
                    // unredacted, so cover the whole token explicitly.
                    Regex::new(r"xoxe(?:-[0-9A-Za-z-]{10,}|\.xox[bp]-[0-9A-Za-z-]{10,})")
                        .expect("static Slack rotation token regex must compile"),
                    "Slack refresh/rotated token",
                ),
                // Generic

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Test the edited literal in isolation with regex::Regex::new before committing.
2. Run the leak-detector test suite (scan_with_protected_spans paths) after pattern edits.
3. Move the pattern set into LazyLock statics so compilation happens once and errors surface at first test run.

Example fix

// before: per-call compile of an edited, now-invalid literal
Regex::new(r"xapp-[0-9A-Za-z-{10,}").expect("static Slack app-level token regex must compile")

// after: fixed literal, compiled once
static SLACK_APP_TOKEN: LazyLock<Regex> =
    LazyLock::new(|| Regex::new(r"xapp-[0-9A-Za-z-]{10,}").expect("static Slack app-level token regex must compile"));

#[test]
fn slack_app_token_pattern_compiles() {
    assert!(regex::Regex::new(r"xapp-[0-9A-Za-z-]{10,}").is_ok());
}

When it happens

Trigger: Any scan_with_protected_spans() call compiles this pattern; it panics only if the literal in leak_detector.rs was corrupted (bad escape, unbalanced bracket), typically after a hand-merge.

Common situations: Contributors adding or adjusting Slack token patterns; cherry-picks that mangle the regex. Released builds have the pattern covered by tests.

Related errors

• static Slack token regex must compile
• Schema missing required 'type' field
• HMAC accepts any key length
• needs_reassembly implies a step agent alias
• owned implies a reassembly handle

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/eaf1b1fe63eab923. Report an issue: GitHub.