@teamvibe/poller 0.8.0 → 0.8.2-rc.1

package/dist/auth-provider.d.ts

@@ -9,6 +9,12 @@ interface AuthConfig {
     sessionsTable: string;
     region: string;
 }
+export declare class AuthHttpError extends Error {
+    readonly status: number;
+    constructor(status: number, _body?: string);
+}
+export declare class StartupConfigurationError extends Error {
+}
 export declare function initAuth(apiUrl: string, token: string): Promise<void>;
 export declare function getCredentials(): AuthCredentials;
 export declare function getAuthConfig(): AuthConfig;

package/dist/auth-provider.js

@@ -1,6 +1,17 @@
-import { POLLER_VERSION } from './config.js';
+import { config, POLLER_VERSION } from './config.js';
 import { logger } from './logger.js';
 import { emitError } from './event-queue.js';
+import { getBaseBrainCommitSha } from './base-brain-metadata.js';
+export class AuthHttpError extends Error {
+    status;
+    constructor(status, _body) {
+        super(`Auth failed (${status})`);
+        this.status = status;
+        this.name = 'AuthHttpError';
+    }
+}
+export class StartupConfigurationError extends Error {
+}
 let currentCredentials = null;
 let currentConfig = null;
 let currentPollerId = null;
@@ -13,13 +24,16 @@ const REFRESH_INTERVAL_MS = 50 * 60 * 1000; // 50 minutes (before 1hr expiry)
 const HEARTBEAT_INTERVAL_MS = 60 * 1000; // 1 minute
 async function sendHeartbeat(apiUrl, token, version) {
     try {
+        const baseBrainSha = await getBaseBrainCommitSha(config.BASE_BRAIN_PATH);
+        if (!baseBrainSha)
+            logger.warn('[Heartbeat] Could not read base-brain HEAD for pin readback');
         const response = await fetch(`${apiUrl}/heartbeat`, {
             method: 'POST',
             headers: {
                 Authorization: `Bearer ${token}`,
                 'Content-Type': 'application/json',
             },
-            body: JSON.stringify({ version }),
+            body: JSON.stringify({ version, baseBrainSha, baseBrainBranch: config.BASE_BRAIN_BRANCH }),
         });
         if (!response.ok) {
             logger.warn(`Heartbeat failed (${response.status})`);
@@ -31,25 +45,56 @@ async function sendHeartbeat(apiUrl, token, version) {
         emitError('auth', `Heartbeat error: ${error instanceof Error ? error.message : String(error)}`, { severity: 'warn' });
     }
 }
-async function fetchCredentials(apiUrl, token) {
+async function fetchCredentials(apiUrl, token, signal) {
     const response = await fetch(`${apiUrl}/auth`, {
         method: 'POST',
+        signal,
         headers: {
             Authorization: `Bearer ${token}`,
             'Content-Type': 'application/json',
         },
     });
     if (!response.ok) {
-        const body = await response.text();
-        throw new Error(`Auth failed (${response.status}): ${body}`);
+        throw new AuthHttpError(response.status);
+    }
+    try {
+        return await response.json();
     }
-    return response.json();
+    catch {
+        throw new StartupConfigurationError('Auth response is not valid JSON');
+    }
+}
+function validateStartupAuthResponse(auth) {
+    const value = auth;
+    const authRecord = value;
+    const credentials = authRecord?.credentials;
+    const authConfig = authRecord?.config;
+    if (typeof authRecord?.pollerId !== 'string' || !authRecord.pollerId ||
+        typeof credentials?.accessKeyId !== 'string' || !credentials.accessKeyId ||
+        typeof credentials?.secretAccessKey !== 'string' || !credentials.secretAccessKey ||
+        typeof credentials?.sessionToken !== 'string' || !credentials.sessionToken ||
+        typeof credentials?.expiration !== 'string' || !credentials.expiration ||
+        typeof authConfig?.sqsQueueUrl !== 'string' || !authConfig.sqsQueueUrl ||
+        typeof authConfig?.sessionsTable !== 'string' || !authConfig.sessionsTable ||
+        typeof authConfig?.region !== 'string' || !authConfig.region)
+        throw new StartupConfigurationError('Auth response is missing or has malformed credentials/config');
 }
 export async function initAuth(apiUrl, token) {
+    if (!token.trim())
+        throw new StartupConfigurationError('TEAMVIBE_POLLER_TOKEN is missing or empty');
+    try {
+        const url = new URL(apiUrl);
+        if (!['http:', 'https:'].includes(url.protocol))
+            throw new Error('unsupported protocol');
+    }
+    catch {
+        throw new StartupConfigurationError('TEAMVIBE_API_URL is malformed');
+    }
     logger.info('Authenticating with TeamVibe API...');
     storedApiUrl = apiUrl;
     storedToken = token;
-    const auth = await fetchCredentials(apiUrl, token);
+    const auth = await fetchCredentials(apiUrl, token, AbortSignal.timeout(15_000));
+    validateStartupAuthResponse(auth);
     currentCredentials = auth.credentials;
     currentConfig = auth.config;
     currentPollerId = auth.pollerId;

package/dist/base-brain-metadata.js

@@ -3,6 +3,7 @@ import { join } from 'path';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 const execFileAsync = promisify(execFile);
+const GIT_HEAD_TIMEOUT_MS = 2_000;
 /**
  * Read the current HEAD commit SHA of a git repo. Returns null on any error
  * (not a git repo, git missing, dir missing, etc.) so callers can attach a
@@ -10,7 +11,11 @@ const execFileAsync = promisify(execFile);
  */
 export async function getBaseBrainCommitSha(repoDir) {
     try {
-        const { stdout } = await execFileAsync('git', ['rev-parse', 'HEAD'], { cwd: repoDir });
+        const { stdout } = await execFileAsync('git', ['rev-parse', 'HEAD'], {
+            cwd: repoDir,
+            timeout: GIT_HEAD_TIMEOUT_MS,
+            killSignal: 'SIGKILL',
+        });
         const sha = stdout.trim();
         return sha || null;
     }

package/dist/brain-manager.js

@@ -6,6 +6,7 @@ import { join, basename } from 'path';
 import { config } from './config.js';
 import { logger } from './logger.js';
 import { emitError } from './event-queue.js';
+import { startupFailureDetail } from './startup-auth.js';
 const execAsync = promisify(exec);
 // Clean env for git commands:
 // - npm/npx sets GIT_ASKPASS which prevents credential helpers from working
@@ -257,7 +258,7 @@ async function updateBrainLocked(brainDir, brainId, branch) {
     catch (error) {
         // Pre-check itself failed (e.g. brainDir not a git repo). Fail-safe to skip;
         // the next iteration will retry.
-        const errorMessage = error instanceof Error ? error.message : String(error);
+        const errorMessage = startupFailureDetail(error, 'BaseBrain', [config.TEAMVIBE_POLLER_TOKEN ?? '', config.BASE_BRAIN_REPO]);
         logger.warn(`Brain ${brainId} pre-check failed, skipping update: ${errorMessage}`);
         return;
     }
@@ -271,7 +272,7 @@ async function updateBrainLocked(brainDir, brainId, branch) {
         logger.info(`Brain ${brainId} updated successfully`);
     }
     catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
+        const errorMessage = startupFailureDetail(error, 'BaseBrain', [config.TEAMVIBE_POLLER_TOKEN ?? '', config.BASE_BRAIN_REPO]);
         logger.error(`Failed to update brain ${brainId}: ${errorMessage}`);
         emitError('brain', `Failed to update brain ${brainId}: ${errorMessage}`, { context: { brainId, brainDir } });
     }
@@ -283,7 +284,7 @@ async function updateBrainLocked(brainDir, brainId, branch) {
 export async function ensureBaseBrain() {
     const brainDir = config.BASE_BRAIN_PATH;
     if (!existsSync(brainDir)) {
-        logger.info(`Cloning base brain from ${config.BASE_BRAIN_REPO} (branch: ${config.BASE_BRAIN_BRANCH})...`);
+        logger.info(`Cloning base brain (branch: ${config.BASE_BRAIN_BRANCH})...`);
         await gitExec(`git clone --recurse-submodules --branch ${config.BASE_BRAIN_BRANCH} ${config.BASE_BRAIN_REPO} ${brainDir}`);
         lastUpdateTimes.set('__base_brain__', Date.now());
         logger.info('Base brain cloned successfully');

package/dist/claude-spawner.d.ts

@@ -212,6 +212,7 @@ export interface SpawnStdinPlan {
 export declare function buildSpawnStdinPlan(prompt: string, inlineImages: TeamVibeQueueMessage['inlineImages'], now?: number): SpawnStdinPlan;
 export declare function extractAssistantText(event: any): string | undefined;
 export declare function assistantCalledTool(event: any, toolName: string): boolean;
+export declare function resolveTypingStatus(event: any, assistantText?: string): string | null;
 /**
  * Decides whether a spawn attempt should report its session ID back to the
  * caller (poller.ts) for persistence to DynamoDB via updateSessionId().

package/dist/claude-spawner.js

@@ -699,6 +699,44 @@ export function assistantCalledTool(event, toolName) {
     }
     return event.message.content.some((c) => c?.type === 'tool_use' && c.name === toolName);
 }
+// Status text is a one-line UI label, not a chat message — cap it well short
+// of a full sentence.
+const TYPING_STATUS_MAX_LEN = 100;
+function oneLineStatus(text) {
+    const oneLine = text.replace(/\s+/g, ' ').trim();
+    return oneLine.length > TYPING_STATUS_MAX_LEN
+        ? oneLine.slice(0, TYPING_STATUS_MAX_LEN - 1) + '…'
+        : oneLine;
+}
+function resolveTypingStatusDetail(event, assistantText) {
+    if (event?.type !== 'assistant' || !Array.isArray(event.message?.content)) {
+        return null;
+    }
+    // The caller clears the indicator when this tool sends a reply. Do not
+    // restore a status from that same event, even if it also contains narration.
+    if (assistantCalledTool(event, 'mcp__slack__send_message'))
+        return null;
+    const text = assistantText ?? extractAssistantText(event);
+    if (text) {
+        // Collapse newlines/whitespace runs so a multi-line narration doesn't
+        // land a literal `\n` in the one-line status surface.
+        return { text: oneLineStatus(text), source: 'comment' };
+    }
+    for (const block of event.message.content) {
+        if (block?.type !== 'tool_use' || typeof block.name !== 'string')
+            continue;
+        const status = getStatusForTool(block.name);
+        if (status) {
+            const safeToolName = /^(?:Bash|Read|Edit|Write|WebFetch|WebSearch|Grep|Glob|Agent)$/.test(block.name)
+                ? block.name : 'other';
+            return { text: oneLineStatus(status), source: `tool:${safeToolName}` };
+        }
+    }
+    return { text: 'Thinking...', source: 'default' };
+}
+export function resolveTypingStatus(event, assistantText) {
+    return resolveTypingStatusDetail(event, assistantText)?.text ?? null;
+}
 async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirstMessage = true, lastMessageTs, onMessageSent, typingIndicator) {
     const slackContext = msg.response_context.slack;
     const isCronMessage = msg.source === 'cron';
@@ -1004,18 +1042,11 @@ async function runClaudeCode(msg, sessionLog, cwd, brainPath, sessionId, isFirst
                             scheduleProgressNotifications(progressNotificationMarks(minutes));
                         }
                     }
-                    // Auto-update typing indicator status based on tool usage
+                    // Auto-update typing indicator status based on tool usage (tv#369, tv#291)
                     if (typingIndicator) {
-                        if (event.type === 'tool_use' && event.name) {
-                            const status = getStatusForTool(event.name);
-                            if (status !== null && status !== '') {
-                                typingIndicator.updateStatus(status);
-                            }
-                            // When status is '' (e.g. set_status tool), don't override — Claude is managing it
-                        }
-                        else if (event.type === 'assistant') {
-                            // Reset to "Thinking..." when Claude is reasoning between tool calls
-                            typingIndicator.updateStatus('Thinking...');
+                        const status = resolveTypingStatusDetail(event, assistantText);
+                        if (status) {
+                            typingIndicator.updateStatus(status.text, status.source);
                         }
                     }
                 }

package/dist/maintenance-reporter.d.ts

@@ -1,3 +1,11 @@
+/** Best-effort runtime identity, sampled when each report is posted. */
+export declare function collectReportProvenance(brainPath: string): Promise<{
+    pollerId: string | null;
+    pollerVersion: string;
+    baseBrainSha: string | null;
+    baseBrainBranch: string;
+    brainSha: string | null;
+}>;
 /**
  * Scan for JSON maintenance reports in the brain's reports/ directory
  * and POST each to the /events endpoint. Fire-and-forget — never throws.

package/dist/maintenance-reporter.js

@@ -3,10 +3,29 @@ import { join } from 'path';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { config, POLLER_VERSION } from './config.js';
+import { getPollerId } from './auth-provider.js';
 import { logger } from './logger.js';
 import { emitError } from './event-queue.js';
 import { getBaseBrainCommitSha, getBaseBrainAgeHours, } from './base-brain-metadata.js';
 const execFileAsync = promisify(execFile);
+/** Best-effort runtime identity, sampled when each report is posted. */
+export async function collectReportProvenance(brainPath) {
+    const [baseBrainSha, brainSha] = await Promise.all([
+        getBaseBrainCommitSha(config.BASE_BRAIN_PATH),
+        getBaseBrainCommitSha(brainPath),
+    ]);
+    if (!baseBrainSha)
+        logger.warn('[MaintenanceReporter] Could not read base-brain HEAD for report provenance');
+    if (!brainSha)
+        logger.warn('[MaintenanceReporter] Could not read channel-brain HEAD for report provenance');
+    return {
+        pollerId: getPollerId(),
+        pollerVersion: POLLER_VERSION,
+        baseBrainSha,
+        baseBrainBranch: config.BASE_BRAIN_BRANCH,
+        brainSha,
+    };
+}
 const OPERATION_TO_EVENT_TYPE = {
     consolidation: 'maintenance.consolidation',
     reflection: 'maintenance.reflection',
@@ -131,7 +150,7 @@ export async function postMaintenanceReports(brainPath, channelId) {
                     const payload = {
                         eventType,
                         channelId,
-                        pollerVersion: POLLER_VERSION,
+                        ...(await collectReportProvenance(brainPath)),
                         baseBrainCommitSha,
                         baseBrainAgeHours,
                         metadata: report,

package/dist/poller.js

@@ -9,6 +9,7 @@ import { getBrainPath, ensureDirectories, ensureBaseBrain, pushBrainChanges } fr
 import { cleanupOrphanWorktreesForAllBrains, isWorktreeIsolationEnabled } from './worktree-manager.js';
 import { postMaintenanceReports } from './maintenance-reporter.js';
 import { initAuth, stopRefresh, getPollerId } from './auth-provider.js';
+import { retryStartupAuth, retryStartupOperation, startupFailureDetail } from './startup-auth.js';
 import { registerBrain, startMaintenanceLoop, stopMaintenanceLoop } from './maintenance-cron.js';
 import { bootstrapTrackedBrains } from './brains-bootstrap.js';
 import { startEventQueue, stopEventQueue, flush as flushEventQueue, emitEvent, emitError } from './event-queue.js';
@@ -219,6 +220,14 @@ export function describeFailureReason(killedByPoller, exitCode) {
 // content an agent forgot to send via send_message) still delivers as
 // before, so this can't silently drop a forgotten reply.
 export const END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL = 'NO_FURTHER_RESPONSE_NEEDED';
+// tv#358 (revised): the sentinel agents emit and the guard matches is
+// unchanged — still the exact ALL_CAPS literal above, still an exact-match
+// suppression. What changes is purely cosmetic: poller-brain#428's leak
+// failure mode (a sentence written before the sentinel breaks the exact
+// match, so the whole thing delivers as-is) showed the raw literal reads as
+// jarring when it does surface. Swap it for a quieter display token
+// wherever it appears in text that's actually being delivered.
+const END_OF_TURN_SENTINEL_DISPLAY = '[silent]';
 export function endOfTurnFallbackText(hasSlackContext, result) {
     if (!hasSlackContext || !result.success || result.sawSendMessageCall) {
         return undefined;
@@ -227,7 +236,7 @@ export function endOfTurnFallbackText(hasSlackContext, result) {
     if (!text || text === END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL) {
         return undefined;
     }
-    return text;
+    return text.split(END_OF_TURN_NO_FURTHER_RESPONSE_SENTINEL).join(END_OF_TURN_SENTINEL_DISPLAY);
 }
 export async function runInboxLoop(threadId, kbPath, queueMessage, sessionLog) {
     if (activeLoops.has(threadId)) {
@@ -862,8 +871,9 @@ export async function startPoller() {
     logger.info(`TeamVibe Poller v${POLLER_VERSION} starting...`);
     logger.info(`   Max concurrent: ${config.MAX_CONCURRENT_SESSIONS}`);
     logger.info(`   Brains path: ${config.BRAINS_PATH}`);
-    process.on('SIGINT', () => shutdown('SIGINT'));
-    process.on('SIGTERM', () => shutdown('SIGTERM'));
+    const startupAbort = new AbortController();
+    process.on('SIGINT', () => { startupAbort.abort(); void shutdown('SIGINT'); });
+    process.on('SIGTERM', () => { startupAbort.abort(); void shutdown('SIGTERM'); });
     // Last-resort handlers so a hard crash produces one tagged ERROR line (+ a
     // best-effort event flush) instead of an untagged default Node stack trace —
     // these are exactly the failures that never reach /events on their own.
@@ -891,7 +901,15 @@ export async function startPoller() {
     });
     // Token-based auth: fetch credentials before starting
     if (config.TEAMVIBE_API_URL && config.TEAMVIBE_POLLER_TOKEN) {
-        await initAuth(config.TEAMVIBE_API_URL, config.TEAMVIBE_POLLER_TOKEN);
+        try {
+            const ready = await retryStartupAuth(() => initAuth(config.TEAMVIBE_API_URL, config.TEAMVIBE_POLLER_TOKEN), startupAbort.signal, logger, Math.random, [config.TEAMVIBE_POLLER_TOKEN ?? '', config.BASE_BRAIN_REPO]);
+            if (!ready)
+                return;
+        }
+        catch (error) {
+            logger.error(`Startup authentication failed permanently: ${startupFailureDetail(error, 'StartupAuth', [config.TEAMVIBE_POLLER_TOKEN ?? '', config.BASE_BRAIN_REPO])}`);
+            process.exit(1);
+        }
         const pollerId = getPollerId();
         if (pollerId) {
             setLogContext({ pollerId });
@@ -902,9 +920,19 @@ export async function startPoller() {
         logger.info(`   Queue: ${config.SQS_QUEUE_URL}`);
         logger.info(`   Sessions table: ${config.SESSIONS_TABLE}`);
     }
+    if (startupAbort.signal.aborted)
+        return;
     startEventQueue();
     await ensureDirectories();
-    await ensureBaseBrain();
+    try {
+        const ready = await retryStartupOperation('BaseBrain', ensureBaseBrain, startupAbort.signal, logger, Math.random, [config.TEAMVIBE_POLLER_TOKEN ?? '', config.BASE_BRAIN_REPO]);
+        if (!ready)
+            return;
+    }
+    catch (error) {
+        logger.error(`Startup base brain failed permanently: ${startupFailureDetail(error, 'BaseBrain', [config.TEAMVIBE_POLLER_TOKEN ?? '', config.BASE_BRAIN_REPO])}`);
+        process.exit(1);
+    }
     reconcileBgTasksOnBoot();
     if (config.IDLE_RESTART_ENABLED) {
         // Defaults off (tv#317 follow-up, DevGuru review): a silent disabled gate and an

package/dist/slack-client.d.ts

@@ -7,11 +7,13 @@ export declare function sendSlackMessage(msg: TeamVibeQueueMessage, text: string
 export declare function sendSlackError(msg: TeamVibeQueueMessage, error: string): Promise<void>;
 export declare function addReaction(msg: TeamVibeQueueMessage, emoji: string): Promise<void>;
 export declare function setThreadStatus(msg: TeamVibeQueueMessage, status: string): Promise<void>;
+type TypingStatusSource = 'comment' | 'default' | `tool:${string}`;
 export interface TypingIndicator {
     /** Update the displayed status text */
-    updateStatus: (newStatus: string) => void;
+    updateStatus: (newStatus: string, source?: TypingStatusSource) => void;
     /** Stop the typing indicator and clear the status */
     stop: () => void;
 }
 export declare function startTypingIndicator(msg: TeamVibeQueueMessage, statusText?: string): TypingIndicator;
 export declare function removeReaction(msg: TeamVibeQueueMessage, emoji: string): Promise<void>;
+export {};

package/dist/slack-client.js

@@ -94,21 +94,35 @@ export async function setThreadStatus(msg, status) {
         return;
     const { channel, thread_ts } = msg.response_context.slack;
     const slack = getSlackClient(msg.teamvibe.botToken);
+    const safeStatus = neutralizeSlackMarkup(status);
     try {
         await slack.apiCall('assistant.threads.setStatus', {
             channel_id: channel,
             thread_ts,
-            status,
+            status: safeStatus,
+            ...(safeStatus ? { loading_messages: [safeStatus] } : {}),
         });
     }
-    catch (error) {
-        logger.warn(`Failed to set thread status: ${error}`);
+    catch {
+        // API errors may echo request fields; status can contain private narration.
+        logger.warn('Failed to set thread status');
         emitError('slack', `Failed to set thread status`, { severity: 'warn' });
     }
 }
-export function startTypingIndicator(msg, statusText = 'is thinking...') {
+function neutralizeSlackMarkup(text) {
+    return text.replace(/[<>&]/g, (character) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;' })[character]);
+}
+export function startTypingIndicator(msg, statusText = 'Thinking...') {
     let currentStatus = statusText;
+    let stopped = false;
+    const logStatus = (status, source) => {
+        if (!status)
+            logger.info('[Typing] status cleared');
+        else
+            logger.info(`[Typing] status -> ${source} (${status.length} chars)`);
+    };
     // Set initial status
+    logStatus(currentStatus, statusText === 'Thinking...' ? 'default' : 'comment');
     setThreadStatus(msg, currentStatus);
     // Keepalive every 3 seconds (Slack clears after ~2 min timeout)
     let failures = 0;
@@ -125,14 +139,22 @@ export function startTypingIndicator(msg, statusText = 'is thinking...') {
         }
     }, 3000);
     return {
-        updateStatus: (newStatus) => {
+        updateStatus: (newStatus, source = 'comment') => {
+            if (stopped)
+                return;
             if (newStatus !== currentStatus) {
                 currentStatus = newStatus;
+                logStatus(currentStatus, source);
                 setThreadStatus(msg, currentStatus);
             }
         },
         stop: () => {
+            if (stopped)
+                return;
+            stopped = true;
             clearInterval(interval);
+            if (currentStatus)
+                logStatus('', 'default');
             setThreadStatus(msg, '');
         },
     };

package/dist/startup-auth.d.ts

@@ -0,0 +1,15 @@
+export interface StartupAuthLogger {
+    warn(message: string): void;
+    error(message: string): void;
+}
+export declare class UnknownStartupFailureError extends Error {
+    readonly attempts: number;
+    constructor(attempts: number);
+}
+/** The only formatter used for startup retry and terminal failure logs. */
+export declare function redactStartupText(text: string, configuredTokens?: readonly string[]): string;
+export declare function startupFailureDetail(error: unknown, operation: string, configuredTokens?: readonly string[]): string;
+export declare function isPermanentStartupFailure(error: unknown): boolean;
+/** Returns false when shutdown cancels startup. Permanent errors propagate to the caller. */
+export declare function retryStartupOperation(operation: string, run: () => Promise<void>, signal: AbortSignal, log: StartupAuthLogger, random?: () => number, configuredTokens?: readonly string[]): Promise<boolean>;
+export declare function retryStartupAuth(authenticate: () => Promise<void>, signal: AbortSignal, log: StartupAuthLogger, random?: () => number, configuredTokens?: readonly string[]): Promise<boolean>;

package/dist/startup-auth.js

@@ -0,0 +1,137 @@
+import { AuthHttpError, StartupConfigurationError } from './auth-provider.js';
+export class UnknownStartupFailureError extends Error {
+    attempts;
+    constructor(attempts) {
+        super(`unclassified startup failure after ${attempts} attempts`);
+        this.attempts = attempts;
+        this.name = 'UnknownStartupFailureError';
+    }
+}
+const NETWORK_CODES = new Set([
+    'EAI_AGAIN', 'ENOTFOUND', 'ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT',
+    'EHOSTUNREACH', 'ENETUNREACH', 'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT',
+]);
+function isTransient(error) {
+    if (error instanceof AuthHttpError)
+        return error.status === 429 || error.status >= 500;
+    if (error instanceof StartupConfigurationError)
+        return false;
+    if (!(error instanceof Error))
+        return false;
+    if (error.name === 'AbortError' || error.name === 'TimeoutError')
+        return true;
+    if (error instanceof TypeError && /fetch failed|network|timeout/i.test(error.message))
+        return true;
+    if (/could not resolve host|could not resolve hostname|temporary failure in name resolution|failed to connect|connection (timed out|refused|reset)|network is unreachable|(?:HTTP|response|returned error:?)\s*(?:429|5\d\d)\b/i.test(error.message))
+        return true;
+    let cause = error;
+    for (let depth = 0; depth < 4 && cause && typeof cause === 'object'; depth++) {
+        const code = cause.code;
+        if (typeof code === 'string' && NETWORK_CODES.has(code))
+            return true;
+        cause = cause.cause;
+    }
+    return false;
+}
+/** The only formatter used for startup retry and terminal failure logs. */
+export function redactStartupText(text, configuredTokens = []) {
+    let safe = text
+        .replace(/https?:\/\/[^\s/@]+@/gi, 'https://[REDACTED]@')
+        .replace(/\b(?:Authorization\s*:\s*)?Bearer\s+[^\s,;]+/gi, 'Bearer [REDACTED]')
+        .replace(/\bx-access-token\s*:\s*[^\s/@,;]+/gi, 'x-access-token:[REDACTED]');
+    for (const token of configuredTokens) {
+        if (token)
+            safe = safe.split(token).join('[REDACTED]');
+    }
+    return safe;
+}
+export function startupFailureDetail(error, operation, configuredTokens = []) {
+    let detail;
+    if (error instanceof AuthHttpError)
+        detail = `HTTP ${error.status}`;
+    else if (error instanceof StartupConfigurationError)
+        detail = 'invalid startup configuration';
+    else if (error instanceof UnknownStartupFailureError)
+        detail = error.message;
+    else if (operation === 'BaseBrain') {
+        const code = error && typeof error === 'object' ? error.code : undefined;
+        const exit = typeof code === 'number' ? code : 'unknown';
+        const message = error instanceof Error ? error.message : '';
+        const category = /could not resolve|name resolution|ENOTFOUND|EAI_AGAIN/i.test(message) ? 'DNS failure'
+            : /timed out|timeout|ETIMEDOUT/i.test(message) ? 'connection timeout'
+                : /failed to connect|connection refused|ECONNREFUSED/i.test(message) ? 'connection failure'
+                    : /authentication failed|permission denied|403|401/i.test(message) ? 'authentication failure'
+                        : 'git failure';
+        detail = `${category} (exit ${exit})`;
+    }
+    else {
+        let code = error;
+        for (let depth = 0; depth < 4 && code && typeof code === 'object'; depth++) {
+            const value = code.code;
+            if (typeof value === 'string' && NETWORK_CODES.has(value)) {
+                detail = value;
+                break;
+            }
+            code = code.cause;
+        }
+        detail ??= error instanceof TypeError && /fetch failed/i.test(error.message) ? 'fetch failed'
+            : error instanceof Error && ['AbortError', 'TimeoutError'].includes(error.name) ? error.name
+                : 'unclassified error';
+    }
+    return redactStartupText(detail ?? 'unclassified error', configuredTokens);
+}
+export function isPermanentStartupFailure(error) {
+    return error instanceof StartupConfigurationError ||
+        (error instanceof AuthHttpError && error.status !== 429 && error.status < 500);
+}
+function waitForBackoff(ms, signal) {
+    if (signal.aborted)
+        return Promise.resolve(false);
+    return new Promise((resolve) => {
+        const finish = (ready) => {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', onAbort);
+            resolve(ready);
+        };
+        const onAbort = () => finish(false);
+        const timer = setTimeout(() => finish(true), ms);
+        signal.addEventListener('abort', onAbort, { once: true });
+        if (signal.aborted)
+            onAbort();
+    });
+}
+/** Returns false when shutdown cancels startup. Permanent errors propagate to the caller. */
+export async function retryStartupOperation(operation, run, signal, log, random = Math.random, configuredTokens = []) {
+    let attempt = 0;
+    while (!signal.aborted) {
+        attempt++;
+        try {
+            await run();
+            return !signal.aborted;
+        }
+        catch (error) {
+            if (signal.aborted)
+                return false;
+            if (isPermanentStartupFailure(error))
+                throw error;
+            const transient = isTransient(error);
+            if (!transient && attempt >= 5) {
+                log.error(`[${operation}] attempt ${attempt} failed: ${startupFailureDetail(error, operation, configuredTokens)}; unclassified failure limit reached`);
+                throw new UnknownStartupFailureError(attempt);
+            }
+            const baseMs = Math.min(1000 * 2 ** Math.min(attempt - 1, 6), 60_000);
+            const delayMs = Math.min(60_000, Math.round(baseMs * (1 + 0.2 * random())));
+            const message = `[${operation}] attempt ${attempt} failed: ${startupFailureDetail(error, operation, configuredTokens)}; retrying in ${delayMs}ms`;
+            if (transient)
+                log.warn(message);
+            else
+                log.error(message);
+            if (!await waitForBackoff(delayMs, signal))
+                return false;
+        }
+    }
+    return false;
+}
+export function retryStartupAuth(authenticate, signal, log, random = Math.random, configuredTokens = []) {
+    return retryStartupOperation('StartupAuth', authenticate, signal, log, random, configuredTokens);
+}