@blogic-cz/agent-tools 1.5.7 → 1.5.8

package/src/gh-tool/pr/review.ts

@@ -15,6 +15,7 @@ import type { REVIEW_EVENTS } from "#gh/config";
 
 import { GitHubCommandError } from "#gh/errors";
 import { GitHubService } from "#gh/service";
+import { validateOutboundText } from "#gh/text-input";
 
 import { viewPR } from "./core";
 
@@ -83,16 +84,39 @@ const RESOLVE_THREAD_MUTATION = `
 `;
 
 const PENDING_REVIEWS_QUERY = `
-  query($owner: String!, $name: String!, $pr: Int!) {
+  query($owner: String!, $name: String!, $pr: Int!, $after: String) {
     viewer { login }
     repository(owner: $owner, name: $name) {
       pullRequest(number: $pr) {
-        reviews(last: 100, states: [PENDING]) {
+        reviews(first: 100, after: $after, states: [PENDING]) {
           nodes {
             id
             state
             author { login }
           }
+          pageInfo { hasNextPage endCursor }
+        }
+      }
+    }
+  }
+`;
+
+const PENDING_REVIEW_CONTENT_QUERY = `
+  query($reviewId: ID!, $after: String) {
+    viewer { login }
+    node(id: $reviewId) {
+      ... on PullRequestReview {
+        id
+        state
+        body
+        author { login }
+        pullRequest {
+          number
+          repository { nameWithOwner }
+        }
+        comments(first: 100, after: $after) {
+          nodes { body }
+          pageInfo { hasNextPage endCursor }
         }
       }
     }
@@ -188,11 +212,27 @@ type PendingReviewsQueryResult = {
           state: string;
           author: { login: string };
         }>;
+        pageInfo: { hasNextPage: boolean; endCursor: string | null };
       };
     };
   };
 };
 
+type PendingReviewContentQueryResult = {
+  viewer: { login: string };
+  node: {
+    id: string;
+    state: string;
+    body: string | null;
+    author: { login: string };
+    pullRequest: { number: number; repository: { nameWithOwner: string } };
+    comments: {
+      nodes: Array<{ body: string }>;
+      pageInfo: { hasNextPage: boolean; endCursor: string | null };
+    };
+  } | null;
+};
+
 type SubmitReviewResult = {
   submitPullRequestReview: {
     pullRequestReview: { id: string; state: string };
@@ -1080,18 +1120,76 @@ export const submitPendingReview = Effect.fn("pr.submitPendingReview")(function*
   let targetReviewId = reviewId;
 
   if (targetReviewId === null) {
-    const pending = (yield* service.runGraphQL(PENDING_REVIEWS_QUERY, {
-      owner: repoInfo.owner,
-      name: repoInfo.name,
-      pr: resolvedPr,
-    })) as PendingReviewsQueryResult;
+    let after: string | null = null;
+    let hasNextPage = true;
+    let viewerLogin: string | null = null;
+    let ownPendingReviewId: string | null = null;
+    const seenPendingCursors = new Set<string>();
+
+    while (hasNextPage) {
+      const pending = (yield* service.runGraphQL(PENDING_REVIEWS_QUERY, {
+        owner: repoInfo.owner,
+        name: repoInfo.name,
+        pr: resolvedPr,
+        after,
+      })) as PendingReviewsQueryResult;
+
+      if (
+        typeof pending.viewer?.login !== "string" ||
+        !Array.isArray(pending.repository?.pullRequest?.reviews?.nodes) ||
+        typeof pending.repository.pullRequest.reviews?.pageInfo?.hasNextPage !== "boolean" ||
+        (pending.repository.pullRequest.reviews.pageInfo.endCursor !== null &&
+          typeof pending.repository.pullRequest.reviews.pageInfo.endCursor !== "string") ||
+        pending.repository.pullRequest.reviews.nodes.some(
+          (review) =>
+            typeof review?.id !== "string" ||
+            typeof review.state !== "string" ||
+            typeof review.author?.login !== "string",
+        )
+      ) {
+        return yield* Effect.fail(
+          new GitHubCommandError({
+            command: "gh-tool pr submit-review",
+            exitCode: 1,
+            message: "Could not verify pending reviews; refusing to submit",
+            stderr: "Pending review lookup returned incomplete data",
+          }),
+        );
+      }
 
-    const viewerLogin = pending.viewer.login;
-    const pendingReviews = pending.repository.pullRequest.reviews.nodes;
+      viewerLogin ??= pending.viewer.login;
+      const own = pending.repository.pullRequest.reviews.nodes.find(
+        (review) => review.author?.login === viewerLogin && review.state === "PENDING",
+      );
+      ownPendingReviewId ??= own?.id ?? null;
 
-    const ownPendingReview = pendingReviews.find((review) => review.author.login === viewerLogin);
+      const pageInfo = pending.repository.pullRequest.reviews.pageInfo;
+      hasNextPage = pageInfo.hasNextPage;
+      after = pageInfo.endCursor;
+      if (hasNextPage && (after === null || after.length === 0)) {
+        return yield* Effect.fail(
+          new GitHubCommandError({
+            command: "gh-tool pr submit-review",
+            exitCode: 1,
+            message: "Could not verify all pending reviews; refusing to submit",
+            stderr: "Pending review lookup returned an incomplete page cursor",
+          }),
+        );
+      }
+      if (hasNextPage && after !== null && seenPendingCursors.has(after)) {
+        return yield* Effect.fail(
+          new GitHubCommandError({
+            command: "gh-tool pr submit-review",
+            exitCode: 1,
+            message: "Could not verify all pending reviews; refusing to submit",
+            stderr: "Pending review lookup repeated a page cursor",
+          }),
+        );
+      }
+      if (hasNextPage && after !== null) seenPendingCursors.add(after);
+    }
 
-    if (!ownPendingReview) {
+    if (ownPendingReviewId === null) {
       return yield* Effect.fail(
         new GitHubCommandError({
           command: "gh-tool pr submit-review",
@@ -1102,7 +1200,96 @@ export const submitPendingReview = Effect.fn("pr.submitPendingReview")(function*
       );
     }
 
-    targetReviewId = ownPendingReview.id;
+    targetReviewId = ownPendingReviewId;
+  }
+
+  if (targetReviewId === null) {
+    return yield* Effect.fail(
+      new GitHubCommandError({
+        command: "gh-tool pr submit-review",
+        exitCode: 1,
+        message: "Could not identify pending review; refusing to submit",
+        stderr: "Pending review lookup returned no review ID",
+      }),
+    );
+  }
+
+  let afterComment: string | null = null;
+  let commentsHaveNextPage = true;
+  const seenCommentCursors = new Set<string>();
+  while (commentsHaveNextPage) {
+    const pendingReview = (yield* service.runGraphQL(PENDING_REVIEW_CONTENT_QUERY, {
+      reviewId: targetReviewId,
+      after: afterComment,
+    })) as PendingReviewContentQueryResult;
+
+    const review = pendingReview?.node;
+    if (
+      typeof pendingReview?.viewer?.login !== "string" ||
+      review === null ||
+      review === undefined ||
+      review.id !== targetReviewId ||
+      review.state !== "PENDING" ||
+      review.author?.login !== pendingReview.viewer.login ||
+      review.pullRequest?.number !== resolvedPr ||
+      typeof review.pullRequest.repository?.nameWithOwner !== "string" ||
+      review.pullRequest.repository.nameWithOwner.toLowerCase() !==
+        `${repoInfo.owner}/${repoInfo.name}`.toLowerCase() ||
+      typeof review.body !== "string" ||
+      !Array.isArray(review.comments?.nodes) ||
+      typeof review.comments.pageInfo?.hasNextPage !== "boolean" ||
+      (review.comments.pageInfo.endCursor !== null &&
+        typeof review.comments.pageInfo.endCursor !== "string")
+    ) {
+      return yield* Effect.fail(
+        new GitHubCommandError({
+          command: "gh-tool pr submit-review",
+          exitCode: 1,
+          message: "Could not verify pending review contents; refusing to submit",
+          stderr: "Pending review lookup returned incomplete or non-owned review data",
+        }),
+      );
+    }
+
+    yield* validateOutboundText(review.body, "gh-tool pr submit-review");
+    for (const comment of review.comments.nodes) {
+      if (typeof comment?.body !== "string") {
+        return yield* Effect.fail(
+          new GitHubCommandError({
+            command: "gh-tool pr submit-review",
+            exitCode: 1,
+            message: "Could not verify pending review comments; refusing to submit",
+            stderr: "Pending review lookup returned a comment without a body",
+          }),
+        );
+      }
+      yield* validateOutboundText(comment.body, "gh-tool pr submit-review");
+    }
+
+    const pageInfo = review.comments.pageInfo;
+    commentsHaveNextPage = pageInfo.hasNextPage;
+    afterComment = pageInfo.endCursor;
+    if (commentsHaveNextPage && (afterComment === null || afterComment.length === 0)) {
+      return yield* Effect.fail(
+        new GitHubCommandError({
+          command: "gh-tool pr submit-review",
+          exitCode: 1,
+          message: "Could not verify all pending review comments; refusing to submit",
+          stderr: "Pending review lookup returned an incomplete comment cursor",
+        }),
+      );
+    }
+    if (commentsHaveNextPage && afterComment !== null && seenCommentCursors.has(afterComment)) {
+      return yield* Effect.fail(
+        new GitHubCommandError({
+          command: "gh-tool pr submit-review",
+          exitCode: 1,
+          message: "Could not verify all pending review comments; refusing to submit",
+          stderr: "Pending review lookup repeated a comment cursor",
+        }),
+      );
+    }
+    if (commentsHaveNextPage && afterComment !== null) seenCommentCursors.add(afterComment);
   }
 
   const result = (yield* service.runGraphQL(SUBMIT_REVIEW_MUTATION, {

package/src/gh-tool/release.ts

@@ -2,7 +2,8 @@ import { Command, Flag } from "effect/unstable/cli";
 import { Effect, Option } from "effect";
 
 import { formatOption, logFormatted } from "#shared";
-import { resolveOptionalTextInput } from "#gh/text-input";
+import { resolveOptionalTextInput, validateOutboundText } from "#gh/text-input";
+import { GitHubCommandError } from "#gh/errors";
 import { GitHubService } from "./service";
 
 type ReleaseListItem = {
@@ -129,11 +130,36 @@ const viewRelease = Effect.fn("release.viewRelease")(function* (opts: {
   return yield* gh.runGhJson<ReleaseDetail>(args);
 });
 
-const createRelease = Effect.fn("release.createRelease")(function* (opts: {
+export const resolveCreateNotes = (opts: {
+  body: string | null;
+  bodyFile: string | null;
+  notesFile: string | null;
+}) => {
+  if (opts.bodyFile !== null && opts.notesFile !== null) {
+    return Effect.fail(
+      new GitHubCommandError({
+        command: "gh-tool release create",
+        exitCode: 1,
+        message: "Provide only one of --body-file or --notes-file",
+        stderr: "Provide only one of --body-file or --notes-file",
+      }),
+    );
+  }
+
+  return resolveOptionalTextInput({
+    command: "gh-tool release create",
+    value: opts.body,
+    fileValue: opts.bodyFile ?? opts.notesFile,
+    valueFlag: "--body",
+    fileFlag: opts.notesFile === null ? "--body-file" : "--notes-file",
+    label: "body",
+  });
+};
+
+export const createRelease = Effect.fn("release.createRelease")(function* (opts: {
   tag: string;
   title: string | null;
   body: string | null;
-  notesFile: string | null;
   draft: boolean;
   prerelease: boolean;
   generateNotes: boolean;
@@ -145,18 +171,59 @@ const createRelease = Effect.fn("release.createRelease")(function* (opts: {
 }) {
   const gh = yield* GitHubService;
 
-  const args = ["release", "create", opts.tag];
-
   if (opts.title !== null) {
-    args.push("--title", opts.title);
+    yield* validateOutboundText(opts.title, "gh-tool release create");
   }
 
-  if (opts.body !== null) {
-    args.push("--notes", opts.body);
+  let body = opts.body;
+  let title = opts.title;
+  if (opts.generateNotes) {
+    const generated = yield* gh.withRepoTarget(
+      opts.repo,
+      Effect.gen(function* () {
+        const repo = yield* gh.getRepoInfo();
+        const args = [
+          "api",
+          "--hostname",
+          new URL(repo.url).hostname,
+          "--method",
+          "POST",
+          `repos/${repo.owner}/${repo.name}/releases/generate-notes`,
+          "-f",
+          `tag_name=${opts.tag}`,
+        ];
+        if (opts.target !== null) args.push("-f", `target_commitish=${opts.target}`);
+        if (opts.notesStartTag !== null) args.push("-f", `previous_tag_name=${opts.notesStartTag}`);
+        return yield* gh.runGhJson<{ name: string; body: string }>(args);
+      }),
+    );
+    if (typeof generated?.body !== "string" || typeof generated.name !== "string") {
+      return yield* Effect.fail(
+        new GitHubCommandError({
+          command: "gh-tool release create",
+          exitCode: 1,
+          message: "Could not inspect generated release notes; refusing to create release",
+          stderr: "GitHub returned incomplete generated release notes",
+        }),
+      );
+    }
+    yield* validateOutboundText(generated.body, "gh-tool release create");
+    if (title === null || title === "") {
+      yield* validateOutboundText(generated.name, "gh-tool release create");
+      title = generated.name;
+    }
+    body = opts.body ? `${opts.body}\n${generated.body}` : generated.body;
+    yield* validateOutboundText(body, "gh-tool release create");
+  }
+
+  const args = ["release", "create", opts.tag];
+
+  if (title !== null) {
+    args.push("--title", title);
   }
 
-  if (opts.notesFile !== null) {
-    args.push("--notes-file", opts.notesFile);
+  if (body !== null) {
+    args.push("--notes", body);
   }
 
   if (opts.draft) {
@@ -167,14 +234,6 @@ const createRelease = Effect.fn("release.createRelease")(function* (opts: {
     args.push("--prerelease");
   }
 
-  if (opts.generateNotes) {
-    args.push("--generate-notes");
-  }
-
-  if (opts.notesStartTag !== null) {
-    args.push("--notes-start-tag", opts.notesStartTag);
-  }
-
   if (opts.target !== null) {
     args.push("--target", opts.target);
   }
@@ -203,7 +262,7 @@ const createRelease = Effect.fn("release.createRelease")(function* (opts: {
   const created: ReleaseCreateResult = {
     created: true,
     tagName: opts.tag,
-    name: opts.title ?? opts.tag,
+    name: title ?? opts.tag,
     url,
     isDraft: opts.draft,
     isPrerelease: opts.prerelease,
@@ -212,7 +271,7 @@ const createRelease = Effect.fn("release.createRelease")(function* (opts: {
   return created;
 });
 
-const editRelease = Effect.fn("release.editRelease")(function* (opts: {
+export const editRelease = Effect.fn("release.editRelease")(function* (opts: {
   tag: string;
   title: string | null;
   body: string | null;
@@ -223,6 +282,26 @@ const editRelease = Effect.fn("release.editRelease")(function* (opts: {
 }) {
   const gh = yield* GitHubService;
 
+  if (opts.title !== null) {
+    yield* validateOutboundText(opts.title, "gh-tool release edit");
+  }
+
+  if (opts.draft === false) {
+    const current = yield* viewRelease({ tag: opts.tag, repo: opts.repo });
+    if (typeof current.name !== "string" || typeof current.body !== "string") {
+      return yield* Effect.fail(
+        new GitHubCommandError({
+          command: "gh-tool release edit",
+          exitCode: 1,
+          message: "Could not inspect release content; refusing to publish",
+          stderr: "GitHub returned incomplete release content",
+        }),
+      );
+    }
+    yield* validateOutboundText(opts.title ?? current.name, "gh-tool release edit");
+    yield* validateOutboundText(opts.body ?? current.body, "gh-tool release edit");
+  }
+
   const args = ["release", "edit", opts.tag];
 
   if (opts.title !== null) {
@@ -370,7 +449,7 @@ export const releaseCreateCommand = Command.make(
       Flag.optional,
     ),
     notesFile: Flag.String("notes-file").pipe(
-      Flag.withDescription("Path to release notes file (passed to gh --notes-file)"),
+      Flag.withDescription("Read release notes from a file path or '-' for stdin"),
       Flag.optional,
     ),
     notesStartTag: Flag.String("notes-start-tag").pipe(
@@ -416,20 +495,16 @@ export const releaseCreateCommand = Command.make(
     verifyTag,
   }) =>
     Effect.gen(function* () {
-      const resolvedBody = yield* resolveOptionalTextInput({
-        command: "gh-tool release create",
-        value: Option.getOrNull(body),
-        fileValue: Option.getOrNull(bodyFile),
-        valueFlag: "--body",
-        fileFlag: "--body-file",
-        label: "body",
+      const resolvedBody = yield* resolveCreateNotes({
+        body: Option.getOrNull(body),
+        bodyFile: Option.getOrNull(bodyFile),
+        notesFile: Option.getOrNull(notesFile),
       });
 
       const result = yield* createRelease({
         tag,
         title: Option.getOrNull(title),
         body: resolvedBody,
-        notesFile: Option.getOrNull(notesFile),
         draft,
         prerelease,
         generateNotes,

package/src/gh-tool/text-input.ts

@@ -1,7 +1,10 @@
 import { Effect, Schema } from "effect";
+import { realpath } from "node:fs/promises";
 
 import { GitHubCommandError } from "#gh/errors";
-import { detectSecrets } from "#guard";
+import { unsafeOutboundTextReason } from "#shared/content-security";
+
+export { unsafeOutboundTextReason } from "#shared/content-security";
 
 const STDIN_SENTINEL = "-";
 const SENSITIVE_PATH_PATTERNS = [
@@ -17,33 +20,6 @@ const readTextFromStdin = () => Bun.stdin.text();
 export const isSensitivePath = (filePath: string) =>
   SENSITIVE_PATH_PATTERNS.some((pattern) => pattern.test(filePath));
 
-/** Inspect the final text, after shell expansion and after reading files or stdin. */
-export function unsafeOutboundTextReason(
-  text: string,
-  environment: Record<string, string | undefined> = process.env,
-): string | null {
-  if (detectSecrets(text)) return "a credential pattern";
-
-  const sensitiveName =
-    /(?:KEY|TOKEN|SECRET|PASS(?:WORD)?|PWD|CREDENTIAL|AUTH|COOKIE|SESSION|PSK)/i;
-  const isSensitiveName = (name: string) =>
-    name !== "PWD" && name !== "OLDPWD" && sensitiveName.test(name);
-  for (const [name, value] of Object.entries(environment)) {
-    if (isSensitiveName(name) && value && value.length >= 8 && text.includes(value)) {
-      return "a credential from the process environment";
-    }
-  }
-
-  const assignments = text.match(/^[A-Za-z_][A-Za-z0-9_]*=.*$/gm) ?? [];
-  if (
-    assignments.length >= 5 &&
-    assignments.some((line) => isSensitiveName(line.split("=", 1)[0] ?? ""))
-  ) {
-    return "an environment dump";
-  }
-  return null;
-}
-
 export const validateOutboundText = (text: string, command: string) => {
   const reason = unsafeOutboundTextReason(text);
   return reason === null
@@ -58,9 +34,9 @@ export const validateOutboundText = (text: string, command: string) => {
       );
 };
 
-export const validateOutboundFile = (filePath: string, command: string) =>
+export const readValidatedOutboundFile = (filePath: string, command: string) =>
   Effect.tryPromise({
-    try: () => readTextFile(filePath),
+    try: () => readAllowedFile(filePath),
     catch: () =>
       new GitHubCommandError({
         command,
@@ -68,17 +44,22 @@ export const validateOutboundFile = (filePath: string, command: string) =>
         stderr: `Refusing to publish unreadable or sensitive file: ${filePath}`,
         message: `Refusing to publish unreadable or sensitive file: ${filePath}`,
       }),
-  }).pipe(
-    Effect.flatMap((text) => validateOutboundText(text, command)),
-    Effect.asVoid,
-  );
+  }).pipe(Effect.tap(({ text }) => validateOutboundText(text, command)));
+
+export const validateOutboundFile = (filePath: string, command: string) =>
+  readValidatedOutboundFile(filePath, command).pipe(Effect.asVoid);
 
 const readTextFile = (filePath: string) => {
-  if (isSensitivePath(filePath)) {
-    return Promise.reject(new Error(`Refusing to read sensitive file: ${filePath}`));
-  }
+  return readAllowedFile(filePath).then(({ text }) => text);
+};
 
-  return Bun.file(filePath).text();
+const readAllowedFile = async (filePath: string) => {
+  if (isSensitivePath(filePath)) throw new Error(`Refusing to read sensitive file: ${filePath}`);
+  const resolvedPath = await realpath(filePath);
+  if (isSensitivePath(resolvedPath))
+    throw new Error(`Refusing to read sensitive file: ${resolvedPath}`);
+  const bytes = await Bun.file(resolvedPath).bytes();
+  return { bytes, text: new TextDecoder("utf-8", { fatal: true }).decode(bytes) };
 };
 
 const ensureResolvedText = (resolvedValue: string | null, context: string) => {

package/src/k8s-tool/main.ts

@@ -14,6 +14,7 @@ import {
   VERSION,
 } from "#shared";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { withRedactedOutput } from "#shared/output-boundary";
 import { K8sService, K8sServiceLayer } from "./service";
 import { ConfigService, ConfigServiceLayer, getDefaultEnvironment, getToolConfig } from "#config";
 import type { K8sConfig } from "#config";
@@ -471,6 +472,7 @@ const mainCommand = Command.make("k8s-tool", {}).pipe(
 
 const cli = Command.run(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
 
 const MainLayer = K8sServiceLayer.pipe(
@@ -479,7 +481,7 @@ const MainLayer = K8sServiceLayer.pipe(
   Layer.provideMerge(AuditServiceLayer),
 );
 
-const program = withAudit("k8s", cli).pipe(
+const program = withRedactedOutput(withAudit("k8s", cli)).pipe(
   Effect.provide(MainLayer),
   Effect.tapCause(renderCauseToStderr),
 );

package/src/k8s-tool/service.ts

@@ -22,6 +22,7 @@ import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
 import { isKubectlCommandAllowed, isSafeLogPath } from "./security";
 import { parseKubeConfigView, selectKubeContext } from "./context";
+import { unsafeOutboundTextReason } from "#shared/content-security";
 
 export class K8sService extends Context.Service<
   K8sService,
@@ -248,6 +249,14 @@ export class K8sService extends Context.Service<
           argv: readonly string[],
           profile?: string,
         ) {
+          const unsafeReason = unsafeOutboundTextReason(argv.join(" "));
+          if (unsafeReason !== null) {
+            return yield* new K8sDangerousCommandError({
+              message: `Refusing to send command containing ${unsafeReason}.`,
+              command: "[redacted]",
+            });
+          }
+
           const k8sConfig = yield* requireK8sConfig(profile);
           const timeoutMs = k8sConfig.timeoutMs ?? 60000;
           const apiProbeTimeoutMs = k8sConfig.apiProbeTimeoutMs ?? 2000;
@@ -338,6 +347,14 @@ export class K8sService extends Context.Service<
           _env: Environment,
           profile?: string,
         ) {
+          const unsafeReason = unsafeOutboundTextReason(cmd);
+          if (unsafeReason !== null) {
+            return yield* new K8sDangerousCommandError({
+              message: `Refusing to send command containing ${unsafeReason}.`,
+              command: "[redacted]",
+            });
+          }
+
           // Security: block dangerous commands before execution
           const securityCheck = isKubectlCommandAllowed(cmd);
           if (!securityCheck.allowed || !securityCheck.argv) {
@@ -369,6 +386,14 @@ export class K8sService extends Context.Service<
           dryRun: boolean,
           profile?: string,
         ) {
+          const unsafeReason = unsafeOutboundTextReason(cmd);
+          if (unsafeReason !== null) {
+            return yield* new K8sDangerousCommandError({
+              message: `Refusing to send command containing ${unsafeReason}.`,
+              command: "[redacted]",
+            });
+          }
+
           // Security: block dangerous commands before execution (even dry-run)
           const securityCheck = isKubectlCommandAllowed(cmd);
           if (!securityCheck.allowed || !securityCheck.argv) {

package/src/logs-tool/main.ts

@@ -29,6 +29,7 @@ import {
   VERSION,
 } from "#shared";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { withRedactedOutput } from "#shared/output-boundary";
 import { ConfigService, ConfigServiceLayer, getDefaultEnvironment } from "#config";
 import { LogsConfigError, LogsNotFoundError, LogsReadError, LogsTimeoutError } from "./errors";
 import { LogsService, LogsServiceLayer } from "./service";
@@ -227,11 +228,15 @@ const mainCommand = Command.make("logs-tool", {}).pipe(
 
 const cli = Command.run(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
 
-export const run = Command.runWith(mainCommand, {
+const runWithErrorsDisabled = Command.runWith(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
+export const run = (args: ReadonlyArray<string>) =>
+  withRedactedOutput(runWithErrorsDisabled(args)).pipe(Effect.tapCause(renderCauseToStderr));
 
 const MainLayer = LogsServiceLayer.pipe(
   Layer.provideMerge(ConfigServiceLayer),
@@ -239,7 +244,7 @@ const MainLayer = LogsServiceLayer.pipe(
   Layer.provideMerge(AuditServiceLayer),
 );
 
-const program = withAudit("logs", cli).pipe(
+const program = withRedactedOutput(withAudit("logs", cli)).pipe(
   Effect.provide(MainLayer),
   Effect.tapCause(renderCauseToStderr),
 );