What causes "static Slack workflow token regex must compile" in zeroclaw-labs/zeroclaw?

Fix the regex literal back to a valid pattern such as `xwfp-[0-9A-Za-z-]{10,}` and re-run `cargo test -p zeroclaw-runtime` for the security/leak-detector tests

zeroclaw-labs/zeroclaw · critical

static Slack workflow token regex must compile

Error message

static Slack workflow token regex must compile

What it means

Panic guard inside the secret-leak scanner's API-key pattern table. check_api_keys compiles a hard-coded regex for Slack workflow tokens (xwfp-...) and .expect() fires only if that literal fails to compile. In a shipped build the pattern is a constant, so this panic is unreachable unless someone edited the regex source into an invalid pattern.

Source

Thrown at crates/zeroclaw-runtime/src/security/leak_detector.rs:212

                ),
                (
                    Regex::new(r"github_pat_[a-zA-Z0-9_]{22,}").unwrap(),
                    "GitHub PAT",
                ),
                // Slack
                (
                    Regex::new(r"xox[baprs]-[0-9A-Za-z-]{10,}")
                        .expect("static Slack token regex must compile"),
                    "Slack token",
                ),
                (
                    Regex::new(r"xapp-[0-9A-Za-z-]{10,}")
                        .expect("static Slack app-level token regex must compile"),
                    "Slack app-level token",
                ),
                (
                    Regex::new(r"xwfp-[0-9A-Za-z-]{10,}")
                        .expect("static Slack workflow token regex must compile"),
                    "Slack workflow token",
                ),
                (
                    // Rotation family: refresh tokens (`xoxe-…`) and rotated
                    // access tokens (`xoxe.xoxb-…`, `xoxe.xoxp-…`). The base
                    // `xox[baprs]-` class excludes `e`, and matching only the
                    // inner `xoxb-`/`xoxp-` would leave the `xoxe.` prefix
                    // unredacted, so cover the whole token explicitly.
                    Regex::new(r"xoxe(?:-[0-9A-Za-z-]{10,}|\.xox[bp]-[0-9A-Za-z-]{10,})")
                        .expect("static Slack rotation token regex must compile"),
                    "Slack refresh/rotated token",
                ),
                // Generic
                (
                    Regex::new(r#"api[_-]?key[=:]\s*['"]*[a-zA-Z0-9_-]{20,}"#).unwrap(),
                    "Generic API key",
                ),
            ]

View on GitHub (pinned to 88bb9c8533)

Solutions

Fix the regex literal back to a valid pattern such as `xwfp-[0-9A-Za-z-]{10,}` and re-run `cargo test -p zeroclaw-runtime` for the security/leak-detector tests
Paste the edited pattern into a scratch `regex::Regex::new(...)` test to get the exact syntax error before committing
Keep character-class edits minimal and covered by the existing leak-detector unit tests

Example fix

// before
Regex::new(r"xwfp-[0-9A-Za-z-{10,}") // unbalanced character class
    .expect("static Slack workflow token regex must compile"),

// after
Regex::new(r"xwfp-[0-9A-Za-z-]{10,}")
    .expect("static Slack workflow token regex must compile"),

Defensive patterns

Strategy: validation

Validate before calling

#[test]
fn leak_detector_patterns_compile() {
    let patterns = [
        r"xwfp-[0-9A-Za-z-]{10,}",
        r"xoxe(?:-[0-9A-Za-z-]{10,}|\.xox[bp]-[0-9A-Za-z-]{10,})",
    ];
    for p in patterns {
        regex::Regex::new(p).expect("static pattern must compile");
    }
}

Prevention

Never edit hard-coded detector patterns without running the security test suite afterwards
Add a unit test that compiles every pattern in the table so a broken literal fails in CI, not during a production scan

When it happens

Trigger: A contributor edits the `xwfp-[0-9A-Za-z-]{10,}` literal into an invalid regex (unbalanced bracket, bad escape, stray brace) and any code path then runs a leak scan: scan_with_protected_spans -> check_api_keys builds the pattern table and panics at Regex construction time.

Common situations: Adding or tweaking Slack token families in the leak detector; rebasing a branch where the pattern changed; running the security test suite after hand-editing detector patterns.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/ed017c66fb18ffb0. Report an issue: GitHub.