The secret scanner's bundled patterns know sk-ant-, sk-proj- and sk-svcacct- keys but no plain sk- key, the shape OpenAI's older keys and many OpenAI-compatible services issue (sk- followed by a long alphanumeric run). The guided connect refuses a typed value as a key only by those patterns (keyLines in internal/core/oracle/connect_guide.go), so a plain sk- key pasted where the guide asks for a model name still passes validModel and is printed in the command; every store-before-commit redactor has the same gap.

The secret scanner's bundled patterns know sk-ant-, sk-proj- and sk-svcacct- keys but no plain sk- key, the shape OpenAI's older keys and many OpenAI-compatible services issue (sk- followed by a long alphanumeric run). The guided connect refuses a typed value as a key only by those patterns (keyLines in internal/core/oracle/connect_guide.go), so a plain sk- key pasted where the guide asks for a model name still passes validModel and is printed in the command; every store-before-commit redactor has the same gap.

Grounds

• pursued: a plain, OpenRouter or legacy sk- key typed where the guided connect asks a name is refused and never quoted back, and every store-before-commit redactor masks it; shown wrong by such a key reaching a record or a guide turn raw, or by a committed non-key the new rules flag (the tree sweep found none).