@adhdev/daemon-core 0.9.82-rc.311 → 0.9.82-rc.312

package/dist/logging/log-redactor.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Log redactor — mask secrets before a raw daemon log line leaves the machine.
+ *
+ * Daemon logs can incidentally contain credentials: ADHDev API keys (adk_*),
+ * machine secrets (adm_*), provider keys (adp_*), bearer tokens, JWTs, TURN
+ * `username:credential` pairs, and `SECRET=...` style env dumps. The mesh
+ * `get_mesh_node_logs` command ships a log tail over P2P to the coordinator, so
+ * every line MUST pass through redactLogLine() first — otherwise a secret in a
+ * remote daemon's log is exfiltrated to whoever is driving the coordinator.
+ *
+ * Patterns are intentionally conservative: each masks the secret material while
+ * preserving enough surrounding shape that the line stays useful for debugging
+ * (e.g. `adk_••••1234`, `Bearer ••••redacted`). When in doubt, mask.
+ */
+/**
+ * Mask secrets in a single log line. Idempotent-ish: re-running over an
+ * already-masked line leaves the MASK token in place (it contains no secret
+ * shape). Never throws — a redaction failure must not crash the log path.
+ */
+export declare function redactLogLine(line: string): string;
+/** Redact an array of log lines in place-safe fashion (returns a new array). */
+export declare function redactLogLines(lines: string[]): string[];
+/** Exposed for tests/introspection: the rule names applied, in order. */
+export declare const LOG_REDACTION_RULE_NAMES: readonly string[];

package/dist/logging/log-tail-reader.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Daemon log tail reader — read the last N bytes of a daemon log file, newest
+ * bytes first, bounded so the result is safe to ship over a mesh P2P channel.
+ *
+ * Used by the mesh `get_mesh_node_logs` command: the coordinator asks a (possibly
+ * remote) daemon for its recent log tail instead of having to open a session and
+ * grep the file by hand. Because the mesh RPC envelope is sent as a single
+ * datachannel message (~256KB SCTP ceiling, no chunking), the returned tail is
+ * HARD-bounded by `tailBytes` (default 64KB, capped at MAX_TAIL_BYTES=128KB) and
+ * flags `truncated:true` when the file was larger.
+ *
+ * Boundary-safe: lines are cut on the newline byte (0x0A) only, which never
+ * appears inside a multibyte UTF-8 sequence, so decoding each complete byte
+ * segment never splits a multibyte char.
+ */
+export declare const DEFAULT_TAIL_BYTES: number;
+export declare const MAX_TAIL_BYTES: number;
+export interface ReadDaemonLogTailArgs {
+    /** Date of the log file to read (defaults to today). YYYY-MM-DD string or Date. */
+    date?: string | Date;
+    /** Max bytes of tail to return. Clamped to (0, MAX_TAIL_BYTES]. Default 64KB. */
+    tailBytes?: number;
+    /** Optional regex source string; only lines matching (case-insensitive) are kept. */
+    grep?: string;
+    /** Optional epoch-ms floor; only lines whose leading [HH:MM:SS...] / ISO ts >= this are kept. */
+    sinceMs?: number;
+}
+export interface DaemonLogTailResult {
+    success: boolean;
+    error?: string;
+    lines: string[];
+    truncated: boolean;
+    logPath: string;
+    platform: NodeJS.Platform;
+    bytesReturned: number;
+    /** True when a grep/since filter dropped lines from the raw tail window. */
+    filtered: boolean;
+    /** The grep source actually applied (echoed back for clarity). */
+    grep?: string;
+}
+/**
+ * Read the daemon log tail for `date` (default today), bounded to `tailBytes`,
+ * with optional grep (regex source) and sinceMs filters. Falls back to the
+ * size-rotation backup (`*.1.log`) when the primary file does not exist.
+ */
+export declare function readDaemonLogTail(args?: ReadDaemonLogTailArgs): DaemonLogTailResult;

package/dist/repo-mesh-types.d.ts

@@ -500,6 +500,12 @@ export interface RepoMeshPeerConnectionStatus {
     transport: RepoMeshPeerConnectionTransport;
     reported: boolean;
     reason?: string;
+    /**
+     * Round-trip time in ms for the selected candidate pair, as sampled by the
+     * coordinator daemon when connected. Optional — older daemons and not_reported
+     * fallbacks omit it; the dashboard must treat it as best-effort telemetry.
+     */
+    rttMs?: number;
     lastStateChangeAt?: string;
     lastConnectedAt?: string;
     lastCommandAt?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.311",
+  "version": "0.9.82-rc.312",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.311",
+    "@adhdev/mesh-shared": "0.9.82-rc.312",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/router.ts

@@ -40,6 +40,8 @@ import { logCommand } from '../logging/command-log.js';
 import type { CommandLogEntry } from '../logging/command-log.js';
 import * as yaml from 'js-yaml';
 import { getRecentLogs, LOG_PATH } from '../logging/logger.js';
+import { readDaemonLogTail, MAX_TAIL_BYTES } from '../logging/log-tail-reader.js';
+import { redactLogLines } from '../logging/log-redactor.js';
 import { createInteractionId, getRecentDebugTrace, recordDebugTrace } from '../logging/debug-trace.js';
 import { getSessionHostSurfaceKind, partitionSessionHostRecords } from '../session-host/runtime-surface.js';
 import { createHermesManualMeshCoordinatorSetup, resolveMeshCoordinatorSetup } from './mesh-coordinator.js';
@@ -513,6 +515,21 @@ function readInlineMeshNodeId(node: any): string {
     return normalizeMeshNodeId(node) ?? '';
 }
 
+// A local worktree node whose workspace directory has been deleted from disk.
+// The worktree was removed (or the machine pruned it) but the node still lingers
+// in the inline mesh cache. Such a node has no live truth to confirm and must
+// never be probed or counted toward direct-peer-truth — doing so blocks the
+// graph with a permanent `direct_peer_truth_unavailable`. Deliberately narrow:
+// it only fires for `isLocalWorktree === true` nodes with a recorded workspace
+// that does not exist. Remote nodes and nodes whose workspace is present on disk
+// are never matched, so a slow remote peer is still classified unavailable.
+function isDeadLocalWorktreeNode(node: any): boolean {
+    if (node?.isLocalWorktree !== true) return false;
+    const workspace = readStringValue(node?.workspace);
+    if (!workspace) return false;
+    return !fs.existsSync(workspace);
+}
+
 // Boundary normalization: reconcile a node's identity so `id` and `nodeId` both
 // carry the same canonical value (any incoming form — id / nodeId / node_id — is
 // absorbed by normalizeMeshNodeId, and the SQLite `node_id` leak is dropped).
@@ -1152,6 +1169,7 @@ async function hydrateInlineMeshDirectTruth(args: {
     peerConfirmedCount: number;
     standingEvidenceCount: number;
     unavailableNodeIds: string[];
+    deadNodeIds: string[];
 }> {
     const nodes = Array.isArray(args.mesh?.nodes) ? args.mesh.nodes : [];
     if (!nodes.length) {
@@ -1162,6 +1180,7 @@ async function hydrateInlineMeshDirectTruth(args: {
             peerConfirmedCount: 0,
             standingEvidenceCount: 0,
             unavailableNodeIds: [],
+            deadNodeIds: [],
         };
     }
 
@@ -1176,6 +1195,7 @@ async function hydrateInlineMeshDirectTruth(args: {
     let peerConfirmedCount = 0;
     let standingEvidenceCount = 0;
     const unavailableNodeIds: string[] = [];
+    const deadNodeIds: string[] = [];
 
     for (const [nodeIndex, node] of nodes.entries()) {
         const nodeId = normalizeMeshNodeId(node) || `node_${nodeIndex}`;
@@ -1187,6 +1207,22 @@ async function hydrateInlineMeshDirectTruth(args: {
             daemonId && (daemonId === args.localMachineId || daemonId === args.statusInstanceId),
         ) || Boolean(args.meshSource !== 'local_config' && nodeIndex === 0);
 
+        // A dead local worktree owned by this coordinator (isLocalWorktree, the
+        // node's daemon is us, workspace path gone) has no live truth and cannot
+        // be probed — the directory it would self-probe no longer exists. Exclude
+        // it entirely from direct-peer-truth accounting: do not probe it, do not
+        // attempt it, do not push it to unavailableNodeIds (which would otherwise
+        // wedge the graph in a permanent direct_peer_truth_unavailable). This is
+        // strictly self + isLocalWorktree + absent-path; remote peers and nodes
+        // whose workspace still exists are unaffected and stay classifiable.
+        const isSelfDaemonNode = Boolean(
+            daemonId && (daemonId === args.localMachineId || daemonId === args.statusInstanceId),
+        );
+        if ((isSelfNode || isSelfDaemonNode) && isDeadLocalWorktreeNode(node)) {
+            deadNodeIds.push(nodeId);
+            continue;
+        }
+
         if (!workspace) {
             if (!isSelfNode && daemonId) unavailableNodeIds.push(nodeId);
             continue;
@@ -1269,6 +1305,7 @@ async function hydrateInlineMeshDirectTruth(args: {
         peerConfirmedCount,
         standingEvidenceCount,
         unavailableNodeIds,
+        deadNodeIds,
     };
 }
 
@@ -3233,6 +3270,15 @@ export class DaemonCommandRouter {
      *  Allows the MCP server to query mesh data via get_mesh even when
      *  the mesh doesn't exist in the local meshes.json file. */
     private inlineMeshCache = new Map<string, any>();
+    /** Tombstones for inline mesh nodes removed via remove_mesh_node, keyed by
+     *  meshId → set of removed nodeIds. The dashboard keeps echoing the removed
+     *  node in the inlineMesh it attaches to every command; without a tombstone,
+     *  reconcileInlineMeshCache MERGEs it straight back (resurrection). A
+     *  tombstoned node is skipped during reconcile only while its workspace is
+     *  absent from disk — a genuine re-registration (same nodeId, workspace back
+     *  on disk) clears the tombstone and merges normally, preserving clone
+     *  worktree visibility and legitimate node re-creation. */
+    private removedInlineMeshNodeIds = new Map<string, Set<string>>();
     /** Coordinator-owned whole-mesh aggregate status snapshots. Browser callers read this by default. */
     private aggregateMeshStatusCache = new Map<string, { builtAt: number; snapshot: any; queueRevision: string }>();
     /** Shared per-peer git_status probe dedup + recently-probed reuse gate.
@@ -3270,10 +3316,33 @@ export class DaemonCommandRouter {
         const unavailableNodeIds = new Set<string>();
         const sourceOfTruth = readObjectRecord(snapshot.sourceOfTruth);
         const directPeerTruth = readObjectRecord(sourceOfTruth.directPeerTruth);
+        // Dead local worktree nodes (isLocalWorktree, workspace deleted from disk)
+        // carry no live truth and must never gate the aggregate as unavailable.
+        // A cached snapshot built before the worktree was removed can still list
+        // such a node in unavailableNodeIds, which would wedge the graph in a
+        // permanent direct_peer_truth_unavailable; drop them here so the held
+        // standing-state truth for the surviving nodes satisfies the aggregate.
+        const deadNodeIds = new Set<string>();
+        for (const node of mesh.nodes) {
+            if (!isDeadLocalWorktreeNode(node)) continue;
+            const deadId = readInlineMeshNodeId(node);
+            if (deadId) deadNodeIds.add(deadId);
+        }
+        let droppedDeadUnavailable = false;
         for (const entry of Array.isArray(directPeerTruth.unavailableNodeIds) ? directPeerTruth.unavailableNodeIds : []) {
             const nodeId = readStringValue(entry);
-            if (nodeId) unavailableNodeIds.add(nodeId);
+            if (!nodeId) continue;
+            if (deadNodeIds.has(nodeId)) {
+                droppedDeadUnavailable = true;
+                continue;
+            }
+            unavailableNodeIds.add(nodeId);
         }
+        // Force a rewrite when a dead worktree was filtered out of a previously
+        // built unavailable set, even if no live git was re-hydrated this pass —
+        // otherwise the early-return below would hand back the stale snapshot that
+        // still says direct_peer_truth_unavailable.
+        if (droppedDeadUnavailable) changed = true;
 
         const nodes = snapshot.nodes.map((statusNode: any) => {
             const nodeId = normalizeMeshNodeId(statusNode);
@@ -3407,7 +3476,10 @@ export class DaemonCommandRouter {
         // Save-boundary node-id normalization: reconcile each node's identity so
         // `id` and `nodeId` agree before it enters the cache, so reconcile keys
         // and the round-trip through the status serializer stay form-stable.
-        const sanitizedInlineMesh = sanitizeInlineMesh(normalizeInlineMeshNodeIdentity(inlineMesh as any));
+        const sanitizedInlineMesh = this.applyInlineMeshNodeTombstones(
+            meshId,
+            sanitizeInlineMesh(normalizeInlineMeshNodeIdentity(inlineMesh as any)),
+        );
         const cached = this.inlineMeshCache.get(meshId);
         if (cached) {
             const merged = reconcileInlineMeshCache(cached, sanitizedInlineMesh);
@@ -3428,7 +3500,10 @@ export class DaemonCommandRouter {
             const cached = this.getCachedInlineMesh(meshId);
             if (cached) {
                 if (inlineMeshCarriesTransientNodeTruth(inlineMesh)) {
-                    const merged = reconcileInlineMeshCache(cached, inlineMesh as any);
+                    const merged = reconcileInlineMeshCache(
+                        cached,
+                        this.applyInlineMeshNodeTombstones(meshId, inlineMesh as any),
+                    );
                     this.inlineMeshCache.set(meshId, sanitizeInlineMesh(normalizeInlineMeshNodeIdentity(merged)));
                     return { mesh: merged, inline: true, source: 'inline_cache' };
                 }
@@ -3488,13 +3563,56 @@ export class DaemonCommandRouter {
         if (!mesh || !Array.isArray(mesh.nodes)) return false;
         const idx = mesh.nodes.findIndex((entry: any) => meshNodeIdMatches(entry, nodeId));
         if (idx === -1) return false;
+        const canonicalNodeId = readInlineMeshNodeId(mesh.nodes[idx]) || nodeId;
         mesh.nodes.splice(idx, 1);
         mesh.updatedAt = new Date().toISOString();
         this.inlineMeshCache.set(meshId, mesh);
+        // Tombstone the removed node so the dashboard's stale inlineMesh echo does
+        // not MERGE it back on the next command (see removedInlineMeshNodeIds).
+        this.tombstoneRemovedInlineMeshNode(meshId, canonicalNodeId);
+        if (canonicalNodeId !== nodeId) this.tombstoneRemovedInlineMeshNode(meshId, nodeId);
         this.invalidateAggregateMeshStatus(meshId);
         return true;
     }
 
+    private tombstoneRemovedInlineMeshNode(meshId: string, nodeId: string): void {
+        if (!nodeId) return;
+        let set = this.removedInlineMeshNodeIds.get(meshId);
+        if (!set) {
+            set = new Set<string>();
+            this.removedInlineMeshNodeIds.set(meshId, set);
+        }
+        set.add(nodeId);
+    }
+
+    /** Filter an incoming inline mesh against this mesh's tombstones before it is
+     *  reconciled into the cache. A tombstoned node is dropped only while its
+     *  workspace is still absent from disk; if the workspace is back (genuine
+     *  re-registration), the tombstone is cleared and the node merges normally. */
+    private applyInlineMeshNodeTombstones(meshId: string, incoming: any): any {
+        const tombstones = this.removedInlineMeshNodeIds.get(meshId);
+        if (!tombstones?.size || !incoming || typeof incoming !== 'object' || !Array.isArray(incoming.nodes)) {
+            return incoming;
+        }
+        let dropped = false;
+        const nodes = incoming.nodes.filter((node: any) => {
+            const nodeId = readInlineMeshNodeId(node);
+            if (!nodeId || !tombstones.has(nodeId)) return true;
+            const workspace = readStringValue(node?.workspace);
+            // Genuine re-registration: same nodeId, workspace back on disk →
+            // clear the tombstone and let the node merge normally.
+            if (workspace && fs.existsSync(workspace)) {
+                tombstones.delete(nodeId);
+                return true;
+            }
+            dropped = true;
+            return false;
+        });
+        if (tombstones.size === 0) this.removedInlineMeshNodeIds.delete(meshId);
+        if (!dropped) return incoming;
+        return { ...incoming, nodes };
+    }
+
     private normalizeMeshSessionCleanupMode(value: unknown): RepoMeshSessionCleanupMode {
         return value === 'stop'
             || value === 'delete_stopped'
@@ -7370,6 +7488,68 @@ export class DaemonCommandRouter {
                 return result as CommandRouterResult;
             }
 
+            case 'get_mesh_node_logs': {
+                // Coordinator-driven remote log fetch: read a (possibly remote)
+                // daemon's recent log tail over P2P instead of opening a session
+                // and grepping the file by hand. Mirrors fast_forward_mesh_node's
+                // forward pattern — resolve the node, forward to its owning daemon
+                // when remote, otherwise read locally. The reply tail is HARD
+                // byte-bounded and secret-redacted before it leaves the machine.
+                const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
+                const nodeId = typeof args?.nodeId === 'string' ? args.nodeId.trim() : '';
+                let nodeDaemonId: string | undefined;
+                if (meshId && nodeId) {
+                    const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
+                    const node = meshRecord?.mesh?.nodes?.find((n: any) => meshNodeIdMatches(n, nodeId));
+                    nodeDaemonId = typeof node?.daemonId === 'string' ? node.daemonId.trim() : undefined;
+                }
+                // _meshDirectDispatch prevents re-forwarding (and P2P self-dial)
+                // once the call lands on the owning daemon — that daemon then reads
+                // its own logs even if the stored daemonId uses a legacy form.
+                const selfDaemonId = this.deps.statusInstanceId;
+                const isRemote = nodeDaemonId && selfDaemonId && nodeDaemonId !== selfDaemonId;
+                if (isRemote && this.deps.dispatchMeshCommand && !args?._meshDirectDispatch) {
+                    const forwarded = await this.deps.dispatchMeshCommand(nodeDaemonId!, 'get_mesh_node_logs', {
+                        ...(typeof args === 'object' && args !== null ? args as Record<string, unknown> : {}),
+                        _meshDirectDispatch: true,
+                    });
+                    return (forwarded ?? { success: false, error: 'no response from remote node' }) as CommandRouterResult;
+                }
+
+                // Local read on the owning daemon.
+                const rawTailBytes = Number(args?.tailBytes);
+                const tail = readDaemonLogTail({
+                    date: typeof args?.date === 'string' ? args.date : undefined,
+                    tailBytes: Number.isFinite(rawTailBytes) ? Math.min(rawTailBytes, MAX_TAIL_BYTES) : undefined,
+                    grep: typeof args?.grep === 'string' ? args.grep : undefined,
+                    sinceMs: Number.isFinite(Number(args?.sinceMs)) ? Number(args?.sinceMs) : undefined,
+                });
+                if (!tail.success) {
+                    return {
+                        success: false,
+                        error: tail.error || 'failed to read daemon log tail',
+                        nodeId,
+                        logPath: tail.logPath,
+                        platform: tail.platform,
+                    } as CommandRouterResult;
+                }
+                // SECURITY: redact secrets from every line before returning over P2P.
+                const redactedLines = redactLogLines(tail.lines);
+                return {
+                    success: true,
+                    nodeId,
+                    daemonId: selfDaemonId,
+                    logPath: tail.logPath,
+                    platform: tail.platform,
+                    lines: redactedLines,
+                    lineCount: redactedLines.length,
+                    truncated: tail.truncated,
+                    filtered: tail.filtered,
+                    bytesReturned: tail.bytesReturned,
+                    ...(tail.grep ? { grep: tail.grep } : {}),
+                } as CommandRouterResult;
+            }
+
             case 'refine_mesh_node': {
                 const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
                 const nodeId = typeof args?.nodeId === 'string' ? args.nodeId.trim() : '';
@@ -8642,6 +8822,7 @@ export class DaemonCommandRouter {
                             peerConfirmedCount: 0,
                             standingEvidenceCount: 0,
                             unavailableNodeIds: [] as string[],
+                            deadNodeIds: [] as string[],
                         };
                     // Default/cached loads may not attempt a remote peer probe yet; do not surface that as
                     // a direct mesh truth failure until an explicit probe attempt actually fails.

package/src/index.ts

@@ -122,6 +122,9 @@ export type {
   LocalMeshNodeEntry,
   RepoMeshStatus,
   RepoMeshNodeStatus,
+  RepoMeshPeerConnectionStatus,
+  RepoMeshPeerConnectionState,
+  RepoMeshPeerConnectionTransport,
   RepoMeshSessionStatus,
   RepoMeshQueueTask,
   RepoMeshQueueTaskStatus,

package/src/logging/log-redactor.ts

@@ -0,0 +1,100 @@
+/**
+ * Log redactor — mask secrets before a raw daemon log line leaves the machine.
+ *
+ * Daemon logs can incidentally contain credentials: ADHDev API keys (adk_*),
+ * machine secrets (adm_*), provider keys (adp_*), bearer tokens, JWTs, TURN
+ * `username:credential` pairs, and `SECRET=...` style env dumps. The mesh
+ * `get_mesh_node_logs` command ships a log tail over P2P to the coordinator, so
+ * every line MUST pass through redactLogLine() first — otherwise a secret in a
+ * remote daemon's log is exfiltrated to whoever is driving the coordinator.
+ *
+ * Patterns are intentionally conservative: each masks the secret material while
+ * preserving enough surrounding shape that the line stays useful for debugging
+ * (e.g. `adk_••••1234`, `Bearer ••••redacted`). When in doubt, mask.
+ */
+
+const MASK = '••••redacted';
+
+/** Keep the last 4 chars of a token so logs stay correlatable without leaking it. */
+function maskKeepTail(token: string): string {
+    if (token.length <= 8) return MASK;
+    return `${MASK}${token.slice(-4)}`;
+}
+
+interface RedactionRule {
+    readonly name: string;
+    readonly pattern: RegExp;
+    readonly replace: (match: string, ...groups: string[]) => string;
+}
+
+// NOTE: order matters — more specific rules (key=value, Bearer, TURN) run before
+// the bare-token rules so the structured forms aren't half-masked by a greedy
+// generic rule.
+const RULES: RedactionRule[] = [
+    // `JWT_SECRET=...`, `TOKEN=...`, `API_KEY=...`, `password: ...` env/config dumps.
+    // Captures the key + delimiter and masks only the value.
+    {
+        name: 'key_value_secret',
+        pattern: /\b([A-Z0-9_]*(?:SECRET|TOKEN|API[_-]?KEY|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL|CLIENT[_-]?SECRET)[A-Z0-9_]*)(\s*[:=]\s*)(["']?)([^\s"',;]+)\3/gi,
+        replace: (_m, key: string, delim: string, quote: string) => `${key}${delim}${quote}${MASK}${quote}`,
+    },
+    // Authorization: Bearer <token>
+    {
+        name: 'bearer_token',
+        pattern: /\b(Bearer\s+)([A-Za-z0-9._\-+/=]{8,})/g,
+        replace: (_m, prefix: string, token: string) => `${prefix}${maskKeepTail(token)}`,
+    },
+    // ADHDev credential prefixes: API key (adk_), machine secret (adm_), provider key (adp_).
+    {
+        name: 'adhdev_prefixed_secret',
+        pattern: /\b(ad[kmp]_)([A-Za-z0-9]{6,})/g,
+        replace: (_m, prefix: string, token: string) => `${prefix}${maskKeepTail(prefix + token)}`,
+    },
+    // JWT: three base64url segments separated by dots, header starts with eyJ.
+    {
+        name: 'jwt',
+        pattern: /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g,
+        replace: () => MASK,
+    },
+    // TURN credential: a long credential value following a `credential` key in
+    // any common shape — `credential: x`, `credential=x`, or `credential "x"`.
+    // Mask the credential value only, preserving the key + delimiter/quote.
+    {
+        name: 'turn_credential',
+        pattern: /\b(credential["']?\s*(?:[:=]\s*)?["']?)([^\s"',;]{6,})/gi,
+        replace: (_m, prefix: string) => `${prefix}${MASK}`,
+    },
+    // TURN REST username:credential of the form `<expiry-ts>:<base64hmac>`,
+    // where the hmac part is long base64. Mask the hmac.
+    {
+        name: 'turn_rest_pair',
+        pattern: /\b(\d{10,}:)([A-Za-z0-9+/]{20,}={0,2})\b/g,
+        replace: (_m, prefix: string) => `${prefix}${MASK}`,
+    },
+];
+
+/**
+ * Mask secrets in a single log line. Idempotent-ish: re-running over an
+ * already-masked line leaves the MASK token in place (it contains no secret
+ * shape). Never throws — a redaction failure must not crash the log path.
+ */
+export function redactLogLine(line: string): string {
+    if (!line) return line;
+    let out = line;
+    for (const rule of RULES) {
+        try {
+            out = out.replace(rule.pattern, rule.replace as (substring: string, ...args: any[]) => string);
+        } catch {
+            // A pathological line must never break log shipping — skip this rule.
+        }
+    }
+    return out;
+}
+
+/** Redact an array of log lines in place-safe fashion (returns a new array). */
+export function redactLogLines(lines: string[]): string[] {
+    return lines.map((line) => redactLogLine(line));
+}
+
+/** Exposed for tests/introspection: the rule names applied, in order. */
+export const LOG_REDACTION_RULE_NAMES: readonly string[] = RULES.map((r) => r.name);