trufflehog catalog hook fails on Windows MSYS2: /dev/fd process substitution unsupported #485

New issue

Closed

opened 2026-07-13 02:19:52 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-13 02:19:52 +00:00

Member

What breaks

On kai-desktop-tower (Windows 11, Git Bash / MSYS2), the catalog trufflehog pre-commit hook fails on every file, regardless of content:

error  trufflehog  unable to open filter file
{"file": "/dev/fd/63", "error": "open /dev/fd/63: The system cannot find the path specified."}

The hook wrapper passes an exclude/filter list via process substitution (<(...)), which surfaces as /dev/fd/63. MSYS2 bash creates the fd, but trufflehog is a native Windows binary and cannot open /dev/fd/N paths, so the hook errors before scanning anything. Verified 2026-07-12 against both changed and untouched files in agentic-os-kai - the failure is environmental, not content-dependent.

Impact

Every commit from the Windows host fails the suite. Workaround used today (agentic-os-kai d5bc815): the agent ran trufflehog filesystem manually from Ubuntu WSL against the changed paths (clean, 0 secrets), then committed with SKIP=trufflehog so all other hooks still ran. No --no-verify.

Fix direction

The wrapper should avoid process substitution on Windows: write the filter list to a real temp file (mktemp) and pass its path, or detect a Windows-native trufflehog binary and branch. Authored here per the authoring-vs-rollout split, so the fix lands in the catalog hook, not in consumer repos.

## What breaks On kai-desktop-tower (Windows 11, Git Bash / MSYS2), the catalog `trufflehog` pre-commit hook fails on every file, regardless of content: ``` error trufflehog unable to open filter file {"file": "/dev/fd/63", "error": "open /dev/fd/63: The system cannot find the path specified."} ``` The hook wrapper passes an exclude/filter list via process substitution (`<(...)`), which surfaces as `/dev/fd/63`. MSYS2 bash creates the fd, but trufflehog is a native Windows binary and cannot open `/dev/fd/N` paths, so the hook errors before scanning anything. Verified 2026-07-12 against both changed and untouched files in agentic-os-kai - the failure is environmental, not content-dependent. ## Impact Every commit from the Windows host fails the suite. Workaround used today (agentic-os-kai d5bc815): the agent ran `trufflehog filesystem` manually from Ubuntu WSL against the changed paths (clean, 0 secrets), then committed with `SKIP=trufflehog` so all other hooks still ran. No `--no-verify`. ## Fix direction The wrapper should avoid process substitution on Windows: write the filter list to a real temp file (`mktemp`) and pass its path, or detect a Windows-native trufflehog binary and branch. Authored here per the authoring-vs-rollout split, so the fix lands in the catalog hook, not in consumer repos.

coilyco-ops added the

headless

labels

2026-07-14 07:44:26 +00:00

coilyco-ops commented

2026-07-14 09:18:18 +00:00

Author

Member

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-agentic-os-485 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-14T09:18:18Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#485 · branch issue-485 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-agentic-os-485 · ward v0.672.0 · dispatched 2026-07-14T09:18:13Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.672.0).

— Codex, via ward agent

WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-agentic-os-485` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-14T09:18:18Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#485` · branch `issue-485` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-agentic-os-485` · ward `v0.672.0` · dispatched `2026-07-14T09:18:13Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.672.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-14 09:21:48 +00:00

fix trufflehog hook on Windows MSYS2 #520

coilyco-ops closed this issue

2026-07-14 09:29:46 +00:00

coilyco-ops commented

2026-07-14 09:31:29 +00:00

Author

Member

WARDED_WORKFLOW: #520

details

review summary: workflow: pull-request-and-merge; review summary: review gate skipped by ~/.ward/config.yaml default
WARDED_WORKFLOW: merge-ready

felt like a straight shell portability fix. confidence: high. surprises: none. follow-ups: none.

WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/pulls/520 <details><summary>details</summary> review summary: workflow: pull-request-and-merge; review summary: review gate skipped by ~/.ward/config.yaml default WARDED_WORKFLOW: merge-ready felt like a straight shell portability fix. confidence: high. surprises: none. follow-ups: none. </details>