[RaphaelFakhri]

What this changes

When an agent run fails, userFacingRunError in app/channel-helpers.ts posts a short reason into the Slack or Teams thread. Before it does, sanitizeReason masks GitHub tokens with TOKEN_RE:

const TOKEN_RE = /(ghp|github_pat|gho)_[A-Za-z0-9_]+/g;

The GitHub App coder authentication change (7e9be6d) widened the agent's copy of this pattern in agent/coding/sandbox.py to (ghp|github_pat|gho|ghs|ghu|ghr), because a GitHub App mints ghs_ installation tokens. The runtime copy was not updated. With GitHub App auth configured, an error whose message carries the installation token, for example a git URL of the form https://x-access-token:ghs_...@github.com/..., reaches the thread with the token unmasked.

This change makes the runtime pattern match the agent's: ghs_, ghu_ and ghr_ tokens are now shown as ghs_[redacted] and so on, the same way ghp_ already is.

Verification

• pnpm exec vitest run app/channel-helpers.test.ts: 15 passed. The three new cases (ghs, ghu, ghr) fail on main (3 failed, 12 passed) and pass with the change.
• pnpm check-types: exit 0.
• pnpm test: 34 files, 502 tests passed.
• node node_modules/railway/dist/iac/bin.js: exit 0, "diagnostics": [].

The change touches no Python, so uv run pytest in agent/ was not run.