fix(orb): one shared token-redaction pattern across the five public surfaces (#9697)

[kai392]

What

Four hand-written token-redaction patterns guarded public-facing text in src/services/**, and every one missed something another caught. The worst gap: three surfaces (miner-dashboard-recommendations, control-panel-roles, weekly-value-report) matched only ghp_, so ghs_ — the GitHub App installation token this Worker mints on every pass via createInstallationToken — passed through a public dashboard string, role summary, and weekly report verbatim. The two path surfaces (score-breakdown, agent-action-explanation-card) matched the correct gh[pousr]_ GitHub class but not the Orb/GitLab/Slack prefixes the others caught.

How

• src/signals/redaction.ts: add PUBLIC_TOKEN_INLINE (the alternation source of every prefix — gh[pousr]_, github_pat_, gts_, orbenr_, orbsec_, glpat-, sk-, xox[baprs]-) and publicTokenPattern() returning a fresh /g RegExp on each call — the credential analogue of the existing PUBLIC_LOCAL_PATH_INLINE / PUBLIC_LOCAL_PATH_SCRUB_PATTERN. gh[pousr]_ is the correct GitHub class (same as src/review/secret-patterns.ts), covering ghp_/gho_/ghu_/ghs_/ghr_ at once.
• All five surfaces now compose from that single source, each keeping its own replacement string ("private context", "<redacted-token>", "<redacted>") and its own trailing body class / path alternation. No hand-written prefix literal remains under src/services/.

Tests

• miner-dashboard-recommendations: a named REGRESSION case for the ghs_ installation-token gap.
• control-panel-roles, weekly-value-report, score-breakdown, and a new agent-action-explanation-card test file: one it.each over every prefix in PUBLIC_TOKEN_INLINE, plus a non-token string left unmodified per site.
• redaction.test: publicTokenPattern() returns a fresh object each call and a repeated .replace() is idempotent (guards the shared-lastIndex regression).

134 tests pass across the six files; the old patterns provably miss ghs_/xoxb- (non-vacuous).

Closes #9697

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-29 23:46:01 UTC}

12 files · 1 AI reviewer · no blockers · CI green · clean

⏸️ Suggested Action - Manual Review

• AI review did not produce public notes: The configured AI reviewer returned no usable public assessment for this PR head.

Review summary
AI review is unavailable for this PR head. LoopOver is holding this PR for manual review until the configured AI provider returns a usable public review summary.

Nits — 1 non-blocking

• AI review did not produce public notes — Fix the configured AI provider, then re-run LoopOver review before relying on the result.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ⚠️ Gate result — Not blocking (Advisory; not blocking this PR.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#9697
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 101 registered-repo PR(s), 55 merged, 7 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	kai392; Gittensor profile; 101 PR(s), 7 issue(s).
Improvement	✅ Minor	risk: clean · value: minor

Linked issue satisfaction

Addressed
The PR adds PUBLIC_TOKEN_INLINE and a fresh-RegExp-returning publicTokenPattern() to redaction.ts, rewrites all five listed surfaces to compose from it while preserving each site's original replacement string and body/path composition, and adds the required regression/it.each tests (ghs_ regression, per-file it.each over every prefix, idempotency/freshness assertions for publicTokenPattern).

Review context

• Author: kai392
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, Cuda, JavaScript, Kotlin, MDX, Perl, Ruby, TypeScript
• Official Gittensor activity: 101 PR(s), 7 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Decision record

• action: hold · clause: ai_review_inconclusive
• config: 83c797456ac9de14dbd56ffc9c3e11ab3a7139aa8610ed31acc20dcf0d064565 · pack: oss-anti-slop · ci: passed
• record: 3900bdc867b8b7b54576884750e2af13b9f0d0481b4137a956d8f8a7a7bfa221 (schema v5, head 1fe01e4)

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.71%. Comparing base (1e1b004) to head (1fe01e4).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #9918       +/-   ##
===========================================
- Coverage   91.86%   79.71%   -12.16%     
===========================================
  Files         921      287      -634     
  Lines      113263    59130    -54133     
  Branches    27300     8873    -18427     
===========================================
- Hits       104046    47133    -56913     
- Misses       7929    11706     +3777     
+ Partials     1288      291      -997     

Flag	Coverage Δ
backend	99.81% <100.00%> (+4.13%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/services/agent-action-explanation-card.ts	100.00% <100.00%> (ø)
src/services/control-panel-roles.ts	100.00% <ø> (ø)
src/services/miner-dashboard-recommendations.ts	100.00% <ø> (ø)
src/services/score-breakdown.ts	99.21% <100.00%> (+<0.01%)	⬆️
src/services/weekly-value-report.ts	100.00% <100.00%> (ø)
src/signals/redaction.ts	100.00% <100.00%> (ø)

... and 767 files with indirect coverage changes