fix(core): mask fine-grained GitHub PATs in both shared redactors

packages/core/src/__tests__/display-redaction.test.ts

@@ -74,6 +74,13 @@ describe('display redactSecrets', () => {
       redactSecrets('https://alice:hunter2@api.example.com/v1?token=abc123'),
       'https://<redacted>@api.example.com/v1?token=<redacted>',
     );
+
+    // Fine-grained GitHub PATs (`github_pat_`) are one of the token families
+    // Maka imports as a Copilot credential (classic `ghp_` is refused); they
+    // mask like the rest.
+    const fineGrained = 'github_pat_11ABCDEFG0abcdefghijklmnop_qrstuvwxyz0123456789ABCD';
+    assert.equal(redactSecrets(`token ${fineGrained} done`), 'token <redacted> done');
+
     // Negatives: bare https://host must not swallow a later @ across spaces/newlines/quotes.
     assert.equal(
       redactSecrets('see https://example.com and mail bob@corp.com'),
@@ -113,10 +120,11 @@ describe('display streaming suffix redactors', () => {
   });
 
   test('still shortens a reversible provider token that reaches end-of-input', () => {
-    const token = `ghp_${'A'.repeat(200)}`;
-    const reversible = redactReversibleStreamingSuffix(token);
-    assert.ok(reversible);
-    assert.equal(redactSecrets(reversible.compactedInput), redactSecrets(token));
-    assert.equal(reversible.compactedToken.length < token.length, true);
+    for (const token of [`ghp_${'A'.repeat(200)}`, `github_pat_${'A'.repeat(200)}`]) {
+      const reversible = redactReversibleStreamingSuffix(token);
+      assert.ok(reversible);
+      assert.equal(redactSecrets(reversible.compactedInput), redactSecrets(token));
+      assert.equal(reversible.compactedToken.length < token.length, true);
+    }
   });
 });

packages/core/src/__tests__/mcp-secrets.test.ts

@@ -20,12 +20,20 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 import {
+  isPatternSecret,
   MCP_SECRET_WITHHELD_MESSAGE,
   mcpSecretInventory,
   scrubKnownMcpSecrets,
 } from '../mcp-secrets.js';
 
 describe('MCP secret inventory and scrubbing', () => {
+  it('sees a fine-grained GitHub PAT as credential material in free-form positions', () => {
+    assert.equal(
+      isPatternSecret('github_pat_11ABCDEFG0abcdefghijklmnop_qrstuvwxyz0123456789ABCD'),
+      true,
+    );
+  });
+
   it('substitutes longer secrets before their prefixes', () => {
     // With both configured, replacing `abcd` first would shred `abcdEFGH`
     // into `[redacted]EFGH` and leave its tail exposed.

packages/core/src/__tests__/redaction.test.ts

@@ -65,6 +65,7 @@ describe('redactSecrets', () => {
       'token sk-ant-abc12345 done',
       'token AIza0123456789_ABCdefGHIjkl done',
       'token ghp_0123456789abcdefghij done',
+      'token github_pat_11ABCDEFG0abcdefghijklmnop_qrstuvwxyz0123456789ABCD done',
       'token xoxb-0123456789abcdef done',
       'token 0123456789abcdef0123456789abcdef01234567 done',
     ];

packages/core/src/display-redaction.ts

@@ -94,12 +94,13 @@ const PATTERNS: Pattern[] = [
     streamingValueGroup: 3,
   },
   // Common provider key prefixes
-  // OpenAI: sk-..., Anthropic: sk-ant-..., Google API: AIza..., GitHub: ghp_/gho_/ghu_/ghs_/ghr_
+  // OpenAI: sk-..., Anthropic: sk-ant-..., Google API: AIza...,
+  // GitHub: ghp_/gho_/ghu_/ghs_/ghr_/github_pat_
   // Slack tokens: xox[abprs]-...
   {
     label: 'provider api key',
     regex:
-      /\b(sk-[A-Za-z0-9_-]{16,}|sk-ant-[A-Za-z0-9_-]{16,}|AIza[0-9A-Za-z_-]{30,}|gh[opusr]_[A-Za-z0-9]{30,}|xox[abprs]-[A-Za-z0-9-]{16,})\b/g,
+      /\b(sk-[A-Za-z0-9_-]{16,}|sk-ant-[A-Za-z0-9_-]{16,}|AIza[0-9A-Za-z_-]{30,}|gh[opusr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{16,})\b/g,
     streamingReversible: true,
   },
   // Long high-entropy hex/base64 strings (40+ chars) — best-effort catch.

packages/core/src/redaction.ts

@@ -71,7 +71,7 @@ const AWS_SECRET_ASSIGNMENT_PATTERN = new RegExp(
 const SECRET_PATTERNS: RegExp[] = [
   /\b(sk-(?:ant-)?[a-z0-9_-]{8,})\b/gi,
   /\b(AIza[0-9A-Za-z_-]{20,})\b/g,
-  /\b(gh[pousr]_[0-9A-Za-z_]{20,})\b/g,
+  /\b(gh[pousr]_[0-9A-Za-z_]{20,}|github_pat_[0-9A-Za-z_]{20,})\b/g,
   /\b(xox[abprs]-[0-9A-Za-z-]{10,})\b/g,
   /\b([a-f0-9]{40,})\b/gi,
 ];