Fix ghs_ token redaction regex to support new token format (#61392)

Co-authored-by: Hirsch Singhal <hpsin@h6cw215236.localdomain>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

content/copilot/tutorials/copilot-cli-hooks.md

@@ -374,7 +374,7 @@ REDACTED_TOOL_ARGS="$(echo "$TOOL_ARGS_RAW" | \
   sed -E 's/ghp_[A-Za-z0-9]{20,}/[REDACTED_TOKEN]/g' | \
   sed -E 's/gho_[A-Za-z0-9]{20,}/[REDACTED_TOKEN]/g' | \
   sed -E 's/ghu_[A-Za-z0-9]{20,}/[REDACTED_TOKEN]/g' | \
-  sed -E 's/ghs_[A-Za-z0-9]{20,}/[REDACTED_TOKEN]/g' | \
+  sed -E 's/ghs_[A-Za-z0-9\._\-]{20,}/[REDACTED_TOKEN]/g' | \
   sed -E 's/Bearer [A-Za-z0-9_\-\.]+/Bearer [REDACTED]/g' | \
   sed -E 's/--password[= ][^ ]+/--password=[REDACTED]/g' | \
   sed -E 's/--token[= ][^ ]+/--token=[REDACTED]/g')"
@@ -416,7 +416,7 @@ deny() {
     sed -E 's/ghp_[A-Za-z0-9]{20,}/[REDACTED_TOKEN]/g' | \
     sed -E 's/gho_[A-Za-z0-9]{20,}/[REDACTED_TOKEN]/g' | \
     sed -E 's/ghu_[A-Za-z0-9]{20,}/[REDACTED_TOKEN]/g' | \
-    sed -E 's/ghs_[A-Za-z0-9]{20,}/[REDACTED_TOKEN]/g' | \
+    sed -E 's/ghs_[A-Za-z0-9\.\-_]{20,}/[REDACTED_TOKEN]/g' | \
     sed -E 's/Bearer [A-Za-z0-9_\-\.]+/Bearer [REDACTED]/g' | \
     sed -E 's/--password[= ][^ ]+/--password=[REDACTED]/g' | \
     sed -E 's/--token[= ][^ ]+/--token=[REDACTED]/g')"

src/search/lib/sanitize-search-query.ts

@@ -11,7 +11,8 @@ export function sanitizeSearchQuery(query: string): string {
 
   // Redact GitHub tokens (all formats)
   // Classic tokens: ghp_, gho_, ghu_, ghs_, ghr_
-  sanitized = sanitized.replace(/\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/gi, '[TOKEN]')
+  // See https://github.blog/changelog/2026-05-15-github-app-installation-tokens-per-request-override-header/
+  sanitized = sanitized.replace(/(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9._-]{20,}/gi, '[TOKEN]')
   // Fine-grained personal access tokens: github_pat_
   sanitized = sanitized.replace(/\bgithub_pat_[A-Za-z0-9_]{20,}\b/gi, '[TOKEN]')
   // OAuth tokens: gho_