fix(secrets): memory secret scanner token coverage

[fallintoplace]

Summary

• expand the persistent memory scanner's OpenAI token pattern to cover project keys with hyphens and underscores
• include Slack app-level xapp-* tokens in the Slack token pattern
• add regression tests for both token formats

Root cause

The persistent memory scanner kept its own high-confidence token regexes. Those regexes still only covered older OpenAI sk-* values with alphanumeric payloads and Slack xox* tokens, while the shared redaction patterns already covered sk-proj-* and xapp-* formats.

Validation

• npm test -- src/security/secret-scanner.test.ts
• npm run check
• npm test

Signed-off-by: Minh Vu vuhoangminh97@gmail.com

Summary by CodeRabbit

• Bug Fixes

  • Enhanced OpenAI API key detection to recognize additional character formats.
  • Improved Slack token detection to identify both classic and app-format tokens.

• Tests

  • Added test coverage for OpenAI and Slack token detection patterns.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR expands secret detection patterns in the scanner to recognize additional credential formats: OpenAI API keys now permit underscores and hyphens, and Slack tokens now detect both classic and app token variants. Test fixtures and cases are added to validate both pattern changes.

Changes

Secret Scanner Pattern Expansion

Layer / File(s)	Summary
OpenAI and Slack token pattern updates nemoclaw/src/security/secret-scanner.ts	OpenAI API key regex is broadened to allow _ and - characters while preserving prefix and exclusion logic. Slack token regex is updated to match both xox[bpas]-... and xapp-... formats.
Test fixtures and cases for expanded patterns nemoclaw/src/security/secret-scanner.test.ts	Test fixture FAKE gains synthetic OpenAI and Slack token values. Two new test cases assert detection and correct pattern naming for each token type.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🔐 A scanner stands guard with regex sight,
Catching secrets hiding left and right—
OpenAI keys with dashes now gleam,
Slack app tokens join the security stream,
Tests declare the patterns bright! 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately describes the main change: expanding secret scanner token pattern coverage for OpenAI and Slack tokens in the memory scanner.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[wscurran]

✨ Thanks for submitting this detailed PR about expanding the persistent memory scanner's OpenAI token pattern and including Slack app-level tokens, which improves the security posture of the agent. This proposes a bug fix for the security model that affects provider-specific behavior.