fix: avoid vsce secret scanner false positive on regex patterns by yiliang114 · Pull Request #6247 · QwenLM/qwen-code

yiliang114 · 2026-07-03T07:39:01Z

Summary

Use character class [b] instead of literal b in Slack token regex patterns (xoxb- → xox[b]-, xoxp- → xox[p]-)
Prevents vsce's secret scanner from detecting regex source strings as real Slack bot tokens during VSIX packaging
Regex semantics are unchanged — [b] is equivalent to b in a character class

Background

Release VSCode IDE Companion workflow fails on v0.19.5 because vsce package detects xoxb- in the bundled dist/qwen-cli/chunks/chunk-2Z43HUXT.js as a potential Slack bot token. The string originates from secret-scanner.ts regex patterns, not from an actual secret.

Files Changed

File	Change
`packages/core/src/memory/secret-scanner.ts:95`	`xoxb-` → `xox[b]-`
`packages/acp-bridge/src/logRedaction.ts:46`	`xoxb-` → `xox[b]-`, `xoxp-` → `xox[p]-`

Test plan

Verify regex equivalence: new RegExp('xox[b]-...') matches the same inputs as new RegExp('xoxb-...')
Run secret-scanner unit tests to confirm no regression
Run vsce package --dry-run to confirm the scanner no longer flags the bundle
Verify existing log redaction tests pass

Fixes #6199

Use character class `[b]` instead of literal `b` in Slack token regex patterns to prevent vsce's secret scanner from detecting `xoxb-` as a real Slack bot token during VSIX packaging. The regex semantics are unchanged — `[b]` is equivalent to `b` in a character class, but the built string no longer contains the continuous `xoxb-` substring that triggers the scanner. Fixes QwenLM#6199

qwen-code-ci-bot · 2026-07-03T07:45:06Z

Thanks for the PR, @yiliang114! (Re-run after additional commits.)

Template: the PR uses custom headings (Summary / Background / Files Changed / Test plan) instead of the template headings (What this PR does / Why it's needed / Reviewer Test Plan / Risk & Scope). The content is all there and clear, so not blocking on this — but please use the template headings next time so reviewers can find info at a glance.

On direction: solid build fix. vsce package failing because it detects regex source strings as real Slack tokens is a real blocker for the release workflow (Fixes #6199). Squarely within project maintenance — clear motivation.

On approach: minimal and correct. [b] is semantically identical to b in a regex character class, and the change is scoped to exactly the files whose output gets bundled into the VSIX. The follow-up commits add explanatory comments and a xoxp- test case — all directly supporting the stated goal. No scope creep.

Moving on to code review and testing. 🔍

中文说明

感谢 @yiliang114 的 PR！（追加提交后重新审查。）

模板：PR 使用了自定义标题（Summary / Background / Files Changed / Test plan），而非模板要求的标题。内容完整清晰，不阻塞——但下次请使用模板标题方便审阅。

方向：靠谱的构建修复。vsce package 因误判正则源码为 Slack token 而失败，确实阻塞发布流程（Fixes #6199），动机明确。

方案：最小且正确。[b] 字符类与 b 语义一致，改动范围精确限于会被打包的文件。后续提交添加了注释说明和 xoxp- 测试用例——均直接服务于修复目标，无范围膨胀。

进入代码审查和测试 🔍

— Qwen Code · qwen3.7-max

qwen-code-ci-bot · 2026-07-03T07:47:47Z

Code review: Clean. The change is exactly what's described — xoxb- → xox[b]- and xoxp- → xox[p]- in two source files, plus explanatory comments and a new xoxp- test case. No correctness issues, no security concerns, no AGENTS.md violations. The [b]/[p] character classes are semantically identical to the literal characters — zero behavioral change.

I verified there are no other xoxb- or xoxp- string literals in production source files that would still get bundled and trigger the scanner. The remaining occurrences are all in test files (logRedaction.test.ts, acpAgent.test.ts) which aren't part of the production bundle. Scope is complete.

Unit tests (on PR branch):

$ cd packages/core && npx vitest run src/memory/secret-scanner.test.ts

 RUN  v3.2.4

 ✓ src/memory/secret-scanner.test.ts (29 tests) 124ms

 Test Files  1 passed (1)
      Tests  29 passed (29)
   Duration  2.79s

$ cd packages/acp-bridge && npx vitest run src/logRedaction.test.ts

 RUN  v3.2.4

 ✓ src/logRedaction.test.ts (39 tests) 2500ms

 Test Files  1 passed (1)
      Tests  39 passed (39)
   Duration  2.75s

All 68 tests pass (29 secret-scanner + 39 logRedaction), including the new xoxp- user token test added in this PR.

Regex equivalence (independent verification):

$ node -e "..."
PASS: xoxb-11111111111111111111 => true
PASS: xoxp-aaaaaaaaaaaaaaaaaaaa => true
PASS: xoxb-123456789012-123456789012 => true
PASS: ghp_aaaaaaaaaaaaaaaaaaaa => true
PASS: not-a-token => false
PASS: xoxa-11111111111111111111 => false
PASS: xoxb-abc => false
PASS: ghu_aaaaaaaaaaaaaaaaaaaa => true
PASS: glpat-aaaaaaaaaaaaaaaaaaaa => true
Total: 9 passed, 0 failed

CI: All 7 required checks pass (14 skipped, 0 failing). Full matrix green.

No blocking issues. Moving to final decision.

中文说明

代码审查： 干净。改动正如描述——两个源文件中的 xoxb- → xox[b]- 和 xoxp- → xox[p]-，加上解释性注释和新的 xoxp- 测试用例。无正确性问题、无安全隐患、无 AGENTS.md 违规。[b]/[p] 字符类与字面字符语义完全一致——行为零变化。

额外检查：生产源码文件中是否还有其他 xoxb-/xoxp- 字面量会被打包触发扫描器。没有——剩余的全在测试文件中，不会进入生产包。范围完整。

单元测试（PR 分支）： secret-scanner 29/29 通过，logRedaction 39/39 通过（含新增的 xoxp- 用户 token 测试）。

正则等价性（独立验证）： 9 个测试用例全部通过，零偏差。

CI： 7 项必需检查全部通过（14 项跳过，0 项失败）。

无阻塞问题。进入最终判定。

— Qwen Code · qwen3.7-max

qwen-code-ci-bot · 2026-07-03T07:48:21Z

This is a clean, minimal fix that does exactly what it says. Two source files changed, both regex patterns semantically equivalent to the originals, solving a real blocker for the release pipeline. The follow-up commits (explanatory comments, xoxp- test coverage) strengthen the PR without adding noise.

The approach matches what I'd have proposed independently — [b] is the standard trick for evading literal-string scanners without changing regex behavior. Every change in the diff is necessary; nothing extraneous. All 68 unit tests pass on the PR branch, regex equivalence holds across all test cases, and CI is fully green.

The author also independently verified that vsce package now completes successfully and rg "xoxb-|xoxp-" on the bundled output returns no matches — confirming the fix end-to-end on the failing Package VSIX (platform-specific) path.

Approving. Ship it. ✅

中文说明

干净、最小化的修复，完全如描述所述。两个源文件改动，正则模式语义均与原始代码等价，解决了发布流水线的真实阻塞问题。后续提交（解释性注释、xoxp- 测试覆盖）增强了 PR 质量而没有引入噪音。

方案与我的独立提案一致——[b] 是规避字面量扫描器的标准技巧，不改变正则行为。diff 中每一处改动都是必要的。68 个单元测试在 PR 分支全部通过，正则等价性经独立验证，CI 全绿。

作者还独立验证了 vsce package 现在能成功完成，且打包产物中 rg "xoxb-|xoxp-" 无匹配——确认了端到端修复效果。

批准。可以合入。✅

— Qwen Code · qwen3.7-max

qwen-code-ci-bot

LGTM, looks ready to ship. ✅

…er-false-positive

yiliang114 · 2026-07-03T08:41:53Z

Small readability follow-up: the xox[b]- / xox[p]- spelling is intentional so VSCE/secretlint does not treat the bundled regex source as a Slack token. I pushed additive commits that document that next to the regexes and remove the raw token-shaped example from the comment. No behavior change.

I also verified the actual failure path from #6199 on the latest PR head 074d0751cb in a clean worktree:

npm ci
UNIVERSAL_BUILD=false VSCODE_TARGET=linux-x64 npm --workspace=qwen-code-vscode-ide-companion run prepackage
cd packages/vscode-ide-companion
../../node_modules/.bin/vsce package --no-dependencies --target linux-x64 --out ../../qwen-code-vscode-companion-0.19.5-linux-x64.vsix

Result: vsce package completed successfully and produced qwen-code-vscode-companion-0.19.5-linux-x64.vsix. It did not report the previous found slack token: xoxb-... [slack] error.

I also checked the staged extension payload directly:

rg -n "xoxb-|xoxp-" packages/vscode-ide-companion/dist/qwen-cli

That returned no matches. The bundled output now contains only xox[b]- / xox[p]-, so the #6199 VSCE secret-scanner false positive is covered for the failing Package VSIX (platform-specific) path. I did not rerun the full release matrix or signing/publishing steps.

qwen-code-ci-bot

No issues found. Downgraded from Approve to Comment: CI still running.

— qwen3.7-max via Qwen Code /review

qwen-code-ci-bot

No review findings. Downgraded from Approve to Comment: CI still running.

— qwen3.7-max via Qwen Code /review

yiliang114 · 2026-07-03T10:28:16Z

@qwen-code /triage

qwen-code-ci-bot

LGTM, looks ready to ship. ✅

wenshao

No issues found. LGTM! ✅

— qwen3.7-max via Qwen Code /review

wenshao · 2026-07-03T12:08:32Z

    expect(redactLogCredentials(token)).toBe(R);
  });

+  it('redacts Slack user access tokens', () => {


[Suggestion] This test proves xoxp- tokens still redact, but it does not guard the release failure this PR fixes: a future change could simplify the source regexes back to raw Slack prefixes and all matching tests would still pass. Please add a focused regression assertion that the regex sources, or the built bundle, do not contain the raw prefixes; construct the forbidden strings via concatenation so the test itself does not trip scanners.

— GPT-5 via Qwen Code /review

qwen-code-ci-bot previously approved these changes Jul 3, 2026

View reviewed changes

qwen-code-ci-bot reviewed Jul 3, 2026

View reviewed changes

Comment thread packages/acp-bridge/src/logRedaction.ts Outdated

Comment thread packages/core/src/memory/secret-scanner.ts

yiliang114 added 2 commits July 3, 2026 16:28

Merge remote-tracking branch 'origin/main' into fix/vsce-secret-scann…

c8da0aa

…er-false-positive

fix: document vsce scanner regex workaround

5075a85

yiliang114 dismissed qwen-code-ci-bot’s stale review via 5075a85 July 3, 2026 08:30

docs: clarify Slack regex workaround

23a8713

qwen-code-ci-bot reviewed Jul 3, 2026

View reviewed changes

Comment thread packages/acp-bridge/src/logRedaction.ts

test(acp-bridge): cover Slack user token redaction

074d075

qwen-code-ci-bot reviewed Jul 3, 2026

View reviewed changes

yiliang114 enabled auto-merge July 3, 2026 10:28

qwen-code-ci-bot approved these changes Jul 3, 2026

View reviewed changes

wenshao approved these changes Jul 3, 2026

View reviewed changes

yiliang114 added this pull request to the merge queue Jul 3, 2026

Merged via the queue into QwenLM:main with commit 6accb8e Jul 3, 2026
42 checks passed

wenshao reviewed Jul 3, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 6, 2026

Upstream changes detected: ACP spec, Codex CLI (App Server Protocol), GitHub Copilot CLI, Qwen Code greenpolo/cc-multi-cli-plugin#11

Open

Uh oh!

Conversation

yiliang114 commented Jul 3, 2026

Summary

Background

Files Changed

Test plan

Uh oh!

qwen-code-ci-bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qwen-code-ci-bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qwen-code-ci-bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qwen-code-ci-bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

yiliang114 commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

qwen-code-ci-bot left a comment

Choose a reason for hiding this comment

Uh oh!

qwen-code-ci-bot left a comment

Choose a reason for hiding this comment

Uh oh!

yiliang114 commented Jul 3, 2026

Uh oh!

qwen-code-ci-bot left a comment

Choose a reason for hiding this comment

Uh oh!

wenshao left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wenshao Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

qwen-code-ci-bot commented Jul 3, 2026 •

edited

Loading

qwen-code-ci-bot commented Jul 3, 2026 •

edited

Loading

qwen-code-ci-bot commented Jul 3, 2026 •

edited

Loading

yiliang114 commented Jul 3, 2026 •

edited

Loading