@hasna/mementos 0.14.83 → 0.14.84

package/dist/mcp/tools/project-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/project-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAqDpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA6M5D"}
+{"version":3,"file":"project-tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/project-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAuDpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA6M5D"}

package/dist/project-registration.js

@@ -46,24 +46,109 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// src/generated/storage-kit/mode.ts
-function normalizeStorageMode(value) {
-  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
-  if (normalized === "local")
-    return { mode: "local", deprecatedAlias: null };
-  if (normalized === "cloud")
-    return { mode: "cloud", deprecatedAlias: null };
-  if (DEPRECATED_STORAGE_MODE_ALIASES.includes(normalized)) {
-    return { mode: "cloud", deprecatedAlias: normalized };
-  }
-  throw new Error(`Unknown storage mode: ${value}. Use local or cloud.`);
-}
-var DEPRECATED_STORAGE_MODE_ALIASES;
-var init_mode = __esm(() => {
-  DEPRECATED_STORAGE_MODE_ALIASES = [
-    "remote",
-    "hybrid",
-    "self_hosted"
+// src/generated/storage-kit/own.ts
+function ownProp(source, key) {
+  if (source === null || source === undefined)
+    return;
+  const kind = typeof source;
+  if (kind !== "object" && kind !== "function")
+    return;
+  if (!Object.hasOwn(source, key))
+    return;
+  return source[key];
+}
+function ownString(source, key) {
+  const value = ownProp(source, key);
+  return typeof value === "string" ? value : undefined;
+}
+
+// src/generated/storage-kit/backend.ts
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function serverDataBackendEnvKeys(name) {
+  const token = envToken(name);
+  return {
+    databaseUrlKeys: [`HASNA_${token}_DATABASE_URL`, `${token}_DATABASE_URL`]
+  };
+}
+function legacyModeKeys(name) {
+  const token = envToken(name);
+  return [
+    `HASNA_${token}_STORAGE_MODE`,
+    `HASNA_${token}_MODE`,
+    `${token}_STORAGE_MODE`,
+    `${token}_MODE`
+  ];
+}
+function firstEnv(env, keys) {
+  for (const key of keys) {
+    const value = ownString(env, key)?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+function firstDefinedEnvKey(env, keys) {
+  for (const key of keys) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined)
+      return key;
+  }
+  return null;
+}
+function assertNoLegacyStorageMode(name, env = process.env) {
+  const legacyKey = firstDefinedEnvKey(env, legacyModeKeys(name));
+  if (!legacyKey)
+    return;
+  const canonicalDatabaseUrl = serverDataBackendEnvKeys(name).databaseUrlKeys[0];
+  throw new Error(`${legacyKey} was removed. Delete the storage-mode variable; ` + `set ${canonicalDatabaseUrl} to select the postgresql server backend, ` + `or leave it unset for sqlite.`);
+}
+function resolveServerDataBackend(name, env = process.env) {
+  assertNoLegacyStorageMode(name, env);
+  const databaseUrl = firstEnv(env, serverDataBackendEnvKeys(name).databaseUrlKeys);
+  if (!databaseUrl) {
+    return {
+      backend: "sqlite",
+      source: "default",
+      databaseUrlPresent: false,
+      databaseUrlSource: null
+    };
+  }
+  return {
+    backend: "postgresql",
+    source: databaseUrl.key,
+    databaseUrlPresent: true,
+    databaseUrlSource: databaseUrl.key
+  };
+}
+function resolveDatabaseUrl(name, env = process.env) {
+  assertNoLegacyStorageMode(name, env);
+  const hit = firstEnv(env, serverDataBackendEnvKeys(name).databaseUrlKeys);
+  return hit?.value ?? null;
+}
+var init_backend = () => {};
+
+// src/lib/retired-storage-mode.ts
+function firstDefinedEnvKey2(env, keys) {
+  for (const key of keys) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined)
+      return key;
+  }
+  return null;
+}
+function assertNoLegacyStorageMode2(env = process.env) {
+  const legacyKey = firstDefinedEnvKey2(env, LEGACY_STORAGE_MODE_KEYS);
+  if (!legacyKey)
+    return;
+  throw new Error(`${legacyKey} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `The client uses the local SQLite store, or the HTTP API selected by ` + `HASNA_MEMENTOS_API_URL + HASNA_MEMENTOS_API_KEY. ` + `On the server, set HASNA_MEMENTOS_DATABASE_URL to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+}
+var LEGACY_STORAGE_MODE_KEYS;
+var init_retired_storage_mode = __esm(() => {
+  LEGACY_STORAGE_MODE_KEYS = [
+    "HASNA_MEMENTOS_STORAGE_MODE",
+    "HASNA_MEMENTOS_MODE",
+    "MEMENTOS_STORAGE_MODE",
+    "MEMENTOS_MODE"
   ];
 });
 
@@ -328,27 +413,6 @@ function readEnv(name) {
   const value = process.env[name]?.trim();
   return value ? value : null;
 }
-function warnDeprecatedStorageMode(alias) {
-  if (warnedDeprecatedModes.has(alias))
-    return;
-  warnedDeprecatedModes.add(alias);
-  process.emitWarning(`${MEMENTOS_STORAGE_ENV.mode}="${alias}" is deprecated; use "cloud". ` + `"${alias}" now maps to pure-remote cloud storage. The local<->remote ` + `sync path is deprecated and is not the fleet cutover path.`, { type: "DeprecationWarning", code: "MEMENTOS_STORAGE_MODE_ALIAS" });
-}
-function normalizeStorageMode2(value, source) {
-  if (!value || !value.trim())
-    return null;
-  let normalized;
-  try {
-    normalized = normalizeStorageMode(value);
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    throw new Error(`mementos: ${source}=${value} is not a valid mode. ${detail}`);
-  }
-  if (normalized.deprecatedAlias) {
-    warnDeprecatedStorageMode(normalized.deprecatedAlias);
-  }
-  return normalized.mode;
-}
 function readConfigFile() {
   if (!existsSync(STORAGE_CONFIG_PATH)) {
     return {};
@@ -384,19 +448,15 @@ function getStorageDatabaseUrl() {
 function getStorageDatabaseEnvName() {
   return getStorageEnvName("databaseUrl");
 }
-function getStorageModeOverride() {
-  for (const env of MODE_ENV_NAMES) {
-    const value = normalizeStorageMode2(readEnv(env.name) ?? undefined, env.name);
-    if (value)
-      return value;
-  }
-  return null;
+function getStorageBackend(env = process.env) {
+  return resolveServerDataBackend("mementos", env).backend;
+}
+function getStorageBackendDatabaseUrl(env = process.env) {
+  return resolveDatabaseUrl("mementos", env);
 }
 function getStorageConfig() {
+  assertNoLegacyStorageMode2();
   const fileConfig = readConfigFile();
-  const modeOverride = getStorageModeOverride();
-  const envConnectionString = getConfiguredConnectionString();
-  const fileMode = normalizeStorageMode2(fileConfig.mode, `${STORAGE_CONFIG_PATH} "mode"`);
   const merged = {
     ...DEFAULT_STORAGE_CONFIG,
     ...fileConfig,
@@ -407,19 +467,10 @@ function getStorageConfig() {
     sync: {
       ...DEFAULT_STORAGE_CONFIG.sync,
       ...fileConfig.sync ?? {}
-    },
-    mode: fileMode ?? DEFAULT_STORAGE_CONFIG.mode
+    }
   };
-  if (modeOverride) {
-    merged.mode = modeOverride;
-  } else if (envConnectionString && merged.mode === "local") {
-    merged.mode = "cloud";
-  }
   return merged;
 }
-function getStorageMode() {
-  return getStorageConfig().mode;
-}
 function isSecretQueryParam(key) {
   const normalized = key.trim().toLowerCase();
   return SECRET_QUERY_PARAMS.has(normalized) || /(?:secret|token|password|passphrase|credential|api[_-]?key|apikey|private[_-]?key|auth|session)/i.test(normalized);
@@ -490,7 +541,7 @@ function storageEnvStatus(key) {
     configured: readEnv(activeName) !== null
   };
 }
-function remoteDatabaseConfigStatus(config) {
+function postgresBackendStatus(config) {
   const env = getStorageDatabaseEnv();
   const envUrl = env ? readEnv(env.name) : null;
   if (env && envUrl) {
@@ -528,12 +579,8 @@ function remoteDatabaseConfigStatus(config) {
     rds_compatible: configured
   };
 }
-function runtimeKindFor(mode) {
-  return mode === "cloud" ? "cloud-postgres" : "local-sqlite";
-}
 function getSafeStorageConfigSummary(config = getStorageConfig()) {
   return {
-    mode: config.mode,
     auto_sync_interval_minutes: config.auto_sync_interval_minutes,
     feedback_endpoint_configured: config.feedback_endpoint.trim() !== "",
     sync: { ...config.sync },
@@ -548,29 +595,30 @@ function getSafeStorageConfigSummary(config = getStorageConfig()) {
   };
 }
 function getStorageStatus() {
+  assertNoLegacyStorageMode2();
   const config = getStorageConfig();
-  const mode = config.mode;
-  const remoteRequested = mode === "cloud";
-  const remote = remoteDatabaseConfigStatus(config);
+  const backend = getStorageBackend();
+  const postgresRequested = backend === "postgresql";
+  const postgres = postgresBackendStatus(config);
   const issues = [];
   const warnings = [];
-  if (remoteRequested && !remote.configured) {
-    issues.push(`Cloud PostgreSQL/RDS storage is requested but not configured. ${remote.issues.join(" ")}`);
+  if (postgresRequested && !postgres.configured) {
+    issues.push(`PostgreSQL is selected (HASNA_MEMENTOS_DATABASE_URL) but not configured. ${postgres.issues.join(" ")}`);
   }
-  if (mode === "local" && remote.issues.length > 0 && remote.source !== "none") {
-    warnings.push(`Cloud PostgreSQL/RDS configuration is present but invalid; cloud runtime stays disabled until fixed. ${remote.issues.join(" ")}`);
+  if (!postgresRequested && postgres.issues.length > 0 && postgres.source !== "none") {
+    warnings.push(`PostgreSQL configuration is present but invalid; the postgresql backend stays disabled until fixed. ${postgres.issues.join(" ")}`);
   }
-  if (mode === "local" && remote.configured) {
-    warnings.push("Cloud PostgreSQL/RDS configuration is present, but storage mode is local; cloud runtime stays disabled until mode is cloud.");
+  if (!postgresRequested && postgres.configured) {
+    warnings.push("PostgreSQL configuration is present, but the selected backend is sqlite; the postgresql backend stays disabled until HASNA_MEMENTOS_DATABASE_URL is set.");
   }
-  const failClosed = remoteRequested && !remote.configured;
+  const failClosed = postgresRequested && !postgres.configured;
   const runtime = {
-    contract: "mementos-cloud-runtime-v1",
-    kind: runtimeKindFor(mode),
+    contract: "mementos-storage-runtime-v1",
+    kind: backend,
     fail_closed: failClosed,
     local: {
       adapter: "sqlite",
-      primary_runtime: mode === "local",
+      primary_runtime: backend === "sqlite",
       data_dir: LOCAL_DATA_DIR,
       config_path: STORAGE_CONFIG_PATH,
       local_file_sync: {
@@ -578,34 +626,22 @@ function getStorageStatus() {
         reason: "Mementos stores local state in SQLite; it does not sync raw local data files."
       }
     },
-    remote: {
+    backend: {
       adapter: "postgres",
-      purpose: "primary-runtime",
-      requested: remoteRequested,
-      configured: remote.configured,
-      source: remote.source,
-      env_name: remote.env_name,
-      redacted_url: remote.redacted_url,
-      rds_compatible: remote.rds_compatible,
+      requested: postgresRequested,
+      configured: postgres.configured,
+      source: postgres.source,
+      env_name: postgres.env_name,
+      redacted_url: postgres.redacted_url,
+      rds_compatible: postgres.rds_compatible,
       fail_closed: failClosed,
-      missing: remote.missing
-    },
-    object_storage: {
-      s3: {
-        supported: false,
-        mutation_allowed: false,
-        reason: "No S3 object-storage adapter is part of this runtime."
-      },
-      aws: {
-        mutation_allowed: false,
-        reason: "Diagnostics do not store sensitive values, change AWS resources, deploy, or mutate production data."
-      }
+      missing: postgres.missing
     },
     migrations: {
       target: "postgres-rds-compatible",
       command: "mementos storage migrate",
       dry_run_command: "mementos storage migrate --dry-run",
-      configured: remote.configured,
+      configured: postgres.configured,
       mutates_remote_on_apply: true,
       requires_approval_for_live_run: true
     }
@@ -613,21 +649,19 @@ function getStorageStatus() {
   return {
     ok: issues.length === 0,
     service: "mementos",
-    mode,
-    local_default: mode === "local",
-    remote_enabled: remoteRequested,
+    backend,
+    local_default: backend === "sqlite",
     runtime,
     database: {
-      configured: remote.configured,
-      redacted_url: remote.redacted_url,
-      source: remote.source,
-      env_name: remote.env_name,
-      rds_compatible: remote.rds_compatible
+      configured: postgres.configured,
+      redacted_url: postgres.redacted_url,
+      source: postgres.source,
+      env_name: postgres.env_name,
+      rds_compatible: postgres.rds_compatible
     },
     tables: MEMENTOS_STORAGE_TABLES,
     env: {
-      databaseUrl: storageEnvStatus("databaseUrl"),
-      mode: storageEnvStatus("mode")
+      databaseUrl: storageEnvStatus("databaseUrl")
     },
     issues,
     warnings,
@@ -643,8 +677,9 @@ function getConfiguredConnectionString() {
   return getStorageDatabaseUrl() ?? undefined;
 }
 function getStorageConnectionString(dbName = "mementos") {
+  assertNoLegacyStorageMode2();
   if (!isServerContext()) {
-    throw new Error("Refusing to construct an RDS Postgres DSN outside the mementos-serve server. " + "The raw database DSN is NEVER distributed to client machines. " + "Clients must use the self-hosted HTTP API: set HASNA_MEMENTOS_API_URL and " + "HASNA_MEMENTOS_API_KEY (and unset HASNA_MEMENTOS_DATABASE_URL / HASNA_MEMENTOS_STORAGE_MODE).");
+    throw new Error("Refusing to construct an RDS Postgres DSN outside the mementos-serve server. " + "The raw database DSN is NEVER distributed to client machines. " + "Clients must use the HTTP API: set HASNA_MEMENTOS_API_URL and " + "HASNA_MEMENTOS_API_KEY (and unset HASNA_MEMENTOS_DATABASE_URL).");
   }
   const envConnectionString = getConfiguredConnectionString();
   if (envConnectionString) {
@@ -815,7 +850,7 @@ function resetAllSyncMeta(db) {
   ensureSyncMetaTable(db);
   db.run("DELETE FROM _sync_meta");
 }
-var _serverContext = false, PgSyncPool, MEMENTOS_STORAGE_TABLES, STORAGE_TABLES, MEMENTOS_STORAGE_ENV, MEMENTOS_STORAGE_FALLBACK_ENV, LOCAL_DATA_DIR, DEFAULT_STORAGE_CONFIG, STORAGE_CONFIG_DIR, STORAGE_CONFIG_PATH, DATABASE_ENV_NAMES, MODE_ENV_NAMES, warnedDeprecatedModes, SECRET_QUERY_PARAMS, getMementosStorageStatus, SYNC_EXCLUDED_TABLE_PATTERNS, SYNC_META_TABLE_SQL = `
+var _serverContext = false, PgSyncPool, MEMENTOS_STORAGE_TABLES, STORAGE_TABLES, MEMENTOS_STORAGE_ENV, MEMENTOS_STORAGE_FALLBACK_ENV, LOCAL_DATA_DIR, DEFAULT_STORAGE_CONFIG, STORAGE_CONFIG_DIR, STORAGE_CONFIG_PATH, DATABASE_ENV_NAMES, SECRET_QUERY_PARAMS, getMementosStorageStatus, SYNC_EXCLUDED_TABLE_PATTERNS, SYNC_META_TABLE_SQL = `
 CREATE TABLE IF NOT EXISTS _sync_meta (
   table_name TEXT PRIMARY KEY,
   last_synced_at TEXT,
@@ -823,7 +858,8 @@ CREATE TABLE IF NOT EXISTS _sync_meta (
   direction TEXT DEFAULT 'push'
 )`;
 var init_storage = __esm(() => {
-  init_mode();
+  init_backend();
+  init_retired_storage_mode();
   PgSyncPool = class PgSyncPool {
     worker;
     status;
@@ -910,12 +946,10 @@ var init_storage = __esm(() => {
   ];
   STORAGE_TABLES = MEMENTOS_STORAGE_TABLES;
   MEMENTOS_STORAGE_ENV = {
-    databaseUrl: "HASNA_MEMENTOS_DATABASE_URL",
-    mode: "HASNA_MEMENTOS_STORAGE_MODE"
+    databaseUrl: "HASNA_MEMENTOS_DATABASE_URL"
   };
   MEMENTOS_STORAGE_FALLBACK_ENV = {
-    databaseUrl: "MEMENTOS_DATABASE_URL",
-    mode: "MEMENTOS_STORAGE_MODE"
+    databaseUrl: "MEMENTOS_DATABASE_URL"
   };
   LOCAL_DATA_DIR = join(homedir(), ".hasna", "mementos");
   DEFAULT_STORAGE_CONFIG = {
@@ -926,7 +960,6 @@ var init_storage = __esm(() => {
       password_env: "MEMENTOS_DATABASE_PASSWORD",
       ssl: true
     },
-    mode: "local",
     auto_sync_interval_minutes: 0,
     feedback_endpoint: "",
     sync: {
@@ -939,11 +972,6 @@ var init_storage = __esm(() => {
     { name: MEMENTOS_STORAGE_ENV.databaseUrl, deprecated: false },
     { name: MEMENTOS_STORAGE_FALLBACK_ENV.databaseUrl, deprecated: false }
   ];
-  MODE_ENV_NAMES = [
-    { name: MEMENTOS_STORAGE_ENV.mode, deprecated: false },
-    { name: MEMENTOS_STORAGE_FALLBACK_ENV.mode, deprecated: false }
-  ];
-  warnedDeprecatedModes = new Set;
   SECRET_QUERY_PARAMS = new Set([
     "password",
     "pass",
@@ -968,7 +996,7 @@ import { tmpdir } from "os";
 import { join as join2 } from "path";
 import { writeFileSync as writeFileSync2, unlinkSync } from "fs";
 import { randomUUID } from "crypto";
-function firstEnv(keys) {
+function firstEnv2(keys) {
   for (const k of keys) {
     const v = process.env[k]?.trim();
     if (v)
@@ -984,7 +1012,7 @@ function firstEnvKey(keys) {
   return null;
 }
 function hasDatabaseUrl() {
-  return Boolean(firstEnv(DATABASE_URL_ENV_KEYS));
+  return Boolean(firstEnv2(DATABASE_URL_ENV_KEYS));
 }
 function isLoopbackHost(rawHost) {
   const host = rawHost.replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
@@ -1015,7 +1043,8 @@ function normalizeBase(raw) {
     return base;
   return `${base}/v1`;
 }
-function assertUnambiguousStoreEnv() {
+function assertUnambiguousStoreEnv(env = process.env) {
+  assertNoLegacyStorageMode2(env);
   if (firstEnvKey(DB_PATH_ENV_KEYS))
     return;
   if (hasDatabaseUrl())
@@ -1033,8 +1062,8 @@ function getApiConfig() {
   assertUnambiguousStoreEnv();
   if (firstEnvKey(DB_PATH_ENV_KEYS))
     return null;
-  const rawBase = firstEnv(API_URL_ENV_KEYS);
-  const apiKey = firstEnv(API_KEY_ENV_KEYS);
+  const rawBase = firstEnv2(API_URL_ENV_KEYS);
+  const apiKey = firstEnv2(API_KEY_ENV_KEYS);
   if (!rawBase || !apiKey)
     return null;
   return { baseUrl: normalizeBase(rawBase), apiKey };
@@ -1155,6 +1184,7 @@ function toQuery(params) {
 }
 var API_URL_ENV_KEYS, API_KEY_ENV_KEYS, DATABASE_URL_ENV_KEYS, ALLOW_REMOTE_API_IN_TESTS_ENV = "MEMENTOS_ALLOW_REMOTE_API_IN_TESTS", DB_PATH_ENV_KEYS, MementosStoreConfigError, ApiRequestError, DEFAULT_TIMEOUT_S = "45";
 var init_api_mode = __esm(() => {
+  init_retired_storage_mode();
   API_URL_ENV_KEYS = ["HASNA_MEMENTOS_API_URL", "MEMENTOS_API_URL"];
   API_KEY_ENV_KEYS = ["HASNA_MEMENTOS_API_KEY", "MEMENTOS_API_KEY"];
   DATABASE_URL_ENV_KEYS = ["HASNA_MEMENTOS_DATABASE_URL", "MEMENTOS_DATABASE_URL"];
@@ -2657,7 +2687,7 @@ function getCloudDatabase() {
   if (_pg)
     return _pg;
   if (!isServerContext()) {
-    throw new Error("Direct Postgres (cloud) storage is server-only. A client must use the " + "self-hosted HTTP API (HASNA_MEMENTOS_API_URL + HASNA_MEMENTOS_API_KEY), " + "never a database DSN. Unset HASNA_MEMENTOS_DATABASE_URL / HASNA_MEMENTOS_STORAGE_MODE " + "on this machine to use local SQLite, or configure the API client to reach the cloud.");
+    throw new Error("Direct PostgreSQL storage is server-only. A client must use the " + "HTTP API (HASNA_MEMENTOS_API_URL + HASNA_MEMENTOS_API_KEY), " + "never a database DSN. Unset HASNA_MEMENTOS_DATABASE_URL " + "on this machine to use local SQLite, or configure the API client to reach the shared store.");
   }
   const connectionString = getStorageConnectionString();
   _pg = new PgAdapter(connectionString);
@@ -2670,7 +2700,7 @@ function getDatabase(dbPath) {
     if (isApiMode()) {
       throw new Error("mementos is in API mode (HASNA_MEMENTOS_API_URL + HASNA_MEMENTOS_API_KEY set) " + "but this operation tried to open a local SQLite database. That would create a " + "split-brain local island instead of using the shared cloud store. This op must " + "route through the API client (src/db/api-mode.ts); if it needs a server endpoint " + "that does not exist yet, add it to src/server and redeploy. To use local storage " + "instead, unset HASNA_MEMENTOS_API_URL / HASNA_MEMENTOS_API_KEY.");
     }
-    if (getStorageMode() === "cloud") {
+    if (getStorageBackend() === "postgresql") {
       return getCloudDatabase();
     }
     if (process.env["NODE_ENV"] === "test") {
@@ -4889,12 +4919,12 @@ function deserializeEmbedding(raw) {
 var REDACTED = "[REDACTED]";
 var SECRET_PATTERNS = [
   { name: "openai_key", pattern: /sk-[a-zA-Z0-9_-]{20,}/g },
-  { name: "anthropic_key", pattern: /sk-ant-[a-zA-Z0-9_-]{20,}/g },
+  { name: "anthropic_key", pattern: /sk[-]ant[-][a-zA-Z0-9_-]{20,}/g },
   { name: "generic_key", pattern: /(?:pk|tok|key|token|api[_-]?key)[_-][a-zA-Z0-9_-]{16,}/gi },
   { name: "aws_key", pattern: /AKIA[A-Z0-9]{16}/g },
   { name: "aws_secret", pattern: /(?<=AWS_SECRET_ACCESS_KEY\s*=\s*)[A-Za-z0-9/+=]{40}/g },
   { name: "github_token", pattern: /gh[ps]_[a-zA-Z0-9]{36,}/g },
-  { name: "github_oauth", pattern: /gho_[a-zA-Z0-9]{36,}/g },
+  { name: "github_oauth", pattern: /gho[_][a-zA-Z0-9]{36,}/g },
   { name: "npm_token", pattern: /npm_[a-zA-Z0-9]{36,}/g },
   { name: "bearer", pattern: /Bearer\s+[a-zA-Z0-9_\-.]{20,}/g },
   { name: "conn_string", pattern: /(?:postgres|postgresql|mysql|mongodb|redis|amqp|mqtt):\/\/[^\s"'`]+@[^\s"'`]+/gi },