Make the catalog TruffleHog hook portable to native Windows #694

New issue

Open

opened 2026-07-24 06:14:48 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-24 06:14:48 +00:00

Member

Problem

The catalog-provided trufflehog pre-commit hook fails on native Windows after every preceding hook passes. The hook gives the native TruffleHog binary a process-substitution filter path under /dev/fd, which the binary cannot open. Running the same Ward command from PowerShell and Git Bash produces the same failure because the consuming executable is still Windows-native.

A consumer repository's local offline TruffleHog hook passes immediately before the catalog hook, so this is transport portability rather than a detected secret.

Reproduction

Use a native Windows checkout that consumes the catalog trufflehog hook.
Run the repository's Ward pre-commit verb against all files.
Observe unable to open filter file for /dev/fd/63 from the catalog hook.

Required outcome

Replace process-substitution filter delivery with a transport a native Windows binary can open, such as an explicit temporary file with bounded cleanup.
Preserve the offline, no-verification, no-update secret-scan contract.
Add a Windows-focused test for the generated hook command or wrapper.
Keep consumer repositories on the canonical catalog hook rather than adding per-repo forks.

## Problem The catalog-provided `trufflehog` pre-commit hook fails on native Windows after every preceding hook passes. The hook gives the native TruffleHog binary a process-substitution filter path under `/dev/fd`, which the binary cannot open. Running the same Ward command from PowerShell and Git Bash produces the same failure because the consuming executable is still Windows-native. A consumer repository's local offline TruffleHog hook passes immediately before the catalog hook, so this is transport portability rather than a detected secret. ## Reproduction 1. Use a native Windows checkout that consumes the catalog `trufflehog` hook. 2. Run the repository's Ward pre-commit verb against all files. 3. Observe `unable to open filter file` for `/dev/fd/63` from the catalog hook. ## Required outcome * Replace process-substitution filter delivery with a transport a native Windows binary can open, such as an explicit temporary file with bounded cleanup. * Preserve the offline, no-verification, no-update secret-scan contract. * Add a Windows-focused test for the generated hook command or wrapper. * Keep consumer repositories on the canonical catalog hook rather than adding per-repo forks.

coilyco-ops referenced this issue from coilyco-flight-deck/agent-compose

2026-07-24 19:48:29 +00:00

Strengthen engineer autonomy wording for low-context models #74

coilyco-ops referenced this issue

2026-07-25 14:31:31 +00:00

Make the AOS test suite hermetic on native Windows #747

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-29 03:44:56 +00:00