e2e 0.16.0 → 0.18.0

package/dist/locator/screen.js

@@ -12,7 +12,7 @@ import { obj } from '../internal/objects.js';
 import { isTextMatch, normalizeText } from '../internal/text.js';
 import { attributeOf, denySecureRead, isNodeVisible, locatorDetails } from './engine.js';
 import { describeExpression, filterExpression, indexExpression, roleQuery, testIdQuery, textQuery, } from './expression.js';
-import { POLL_INTERVAL_MS, pollCondition, sleep } from '../internal/time.js';
+import { cutOffAtDeadline, POLL_INTERVAL_MS, pollCondition, sleep } from '../internal/time.js';
 /**
  * Internals hang off the locator object itself under a global symbol so that
  * an expect() imported in an isolated test-module realm can still reach them.
@@ -55,6 +55,27 @@ const TEXT_OPTION_KEYS = ['exact', 'visible'];
 const ROLE_FILTER_KEYS = [...TEXT_OPTION_KEYS, 'checked', 'disabled', 'selected', 'expanded', 'pressed', 'level'];
 /** The keys of `RoleOptions`: the accessible name and the filters. */
 const ROLE_OPTION_KEYS = ['name', ...ROLE_FILTER_KEYS];
+/** The states `locator.waitFor` waits for, Playwright's four. */
+const WAIT_FOR_STATES = ['attached', 'detached', 'visible', 'hidden'];
+/** The states absence satisfies: a frame missing from the document reads as zero matches for them. */
+const ABSENCE_STATES = new Set(['detached', 'hidden']);
+/**
+ * Whether the one match, or its absence, is in `state`: `attached` is any
+ * match, `detached` none, `visible` a match that is not hidden, and `hidden`
+ * a hidden match or none.
+ */
+function inWaitForState(node, state) {
+    switch (state) {
+        case 'attached':
+            return node !== null;
+        case 'detached':
+            return node === null;
+        case 'visible':
+            return isNodeVisible(node);
+        case 'hidden':
+            return !isNodeVisible(node);
+    }
+}
 class ScreenImpl {
     context;
     scope;
@@ -106,10 +127,15 @@ class ScreenImpl {
     }
     async swipe(options) {
         if (isSwipePath(options)) {
-            rejectUnknownOptions('swipe', options, ['from', 'to']);
+            rejectUnknownOptions('swipe', options, ['from', 'to', 'duration']);
             const from = requirePoint(options.from, 'swipe from');
             const to = requirePoint(options.to, 'swipe to');
-            await this.context.steps.run('screen', 'screen.swipe', `${describePoint(from)} → ${describePoint(to)}`, () => this.context.engine.performAt(from, { kind: 'swipeTo', target: to }));
+            const durationMs = validateSwipeDuration(options.duration);
+            await this.context.steps.run('screen', 'screen.swipe', `${describePoint(from)} → ${describePoint(to)}`, () => this.context.engine.performAt(from, obj({
+                kind: 'swipeTo',
+                target: to,
+                durationMs,
+            })));
             return;
         }
         rejectUnknownOptions('swipe', options, ['direction', 'momentum']);
@@ -139,8 +165,19 @@ class ScreenImpl {
                 details: locatorDetails(internals.expression, Date.now() - startedMs),
                 ...(cause === undefined ? {} : { cause }),
             });
+            let sampled = false;
             for (;;) {
-                const { node } = await engine.tryRead(internals.expression, deadline);
+                const startedWithMs = deadline.remaining();
+                let node;
+                try {
+                    ({ node } = await engine.tryRead(internals.expression, deadline));
+                }
+                catch (cause) {
+                    if (sampled && cutOffAtDeadline(cause, startedWithMs))
+                        throw notVisible(cause);
+                    throw cause;
+                }
+                sampled = true;
                 if (isNodeVisible(node))
                     return;
                 if (deadline.expired())
@@ -361,7 +398,11 @@ class LocatorImpl extends ScreenImpl {
         return nodes.map((node) => normalizeText(node.text ?? ''));
     }
     async waitFor(options) {
-        const state = options?.state ?? 'visible';
+        rejectUnknownOptions('waitFor', options, ['state', 'timeout']);
+        const state = options?.state === undefined ? 'visible' : options.state;
+        if (!WAIT_FOR_STATES.includes(state)) {
+            throw new TestError('INVALID_ARGUMENT', `waitFor state must be one of ${WAIT_FOR_STATES.join(', ')}, got ${JSON.stringify(state)}`);
+        }
         await this.context.steps.run('locator', 'locator.waitFor', `${this.label} → ${state}`, async () => {
             const { engine } = this.context;
             const deadline = engine.deadline(options?.timeout);
@@ -371,12 +412,12 @@ class LocatorImpl extends ScreenImpl {
                 signal: engine.signal,
                 negated: false,
                 evaluate: async () => {
-                    const { node } = await engine.tryRead(this.expression, deadline);
-                    const visible = isNodeVisible(node);
-                    return state === 'visible' ? visible : !visible;
+                    const { node } = await engine.tryRead(this.expression, deadline, ABSENCE_STATES.has(state) ? 'empty' : 'wait');
+                    return inWaitForState(node, state);
                 },
-                onTimeout: () => new TestError('LOCATOR_NOT_FOUND', `locator did not become ${state}: ${this.label}`, {
+                onTimeout: (cause) => new TestError('LOCATOR_NOT_FOUND', `locator did not become ${state}: ${this.label}`, {
                     details: locatorDetails(this.expression, Date.now() - startedMs),
+                    ...(cause === undefined ? {} : { cause }),
                 }),
             });
         }, { verifies: true });
@@ -461,6 +502,15 @@ function validateLongPress(durationMs) {
     }
     return durationMs;
 }
+/** Validates the shared swipe duration bound; none named leaves the gesture to the engine's default. */
+function validateSwipeDuration(duration) {
+    if (duration === undefined)
+        return undefined;
+    if (!Number.isInteger(duration) || duration < 16 || duration > 10_000) {
+        throw new TestError('INVALID_ARGUMENT', `swipe duration must be an integer from 16 through 10000, got ${String(duration)}`);
+    }
+    return duration;
+}
 /**
  * The `modifiers` of a click, validated: a list of distinct key modifiers,
  * spread into the action only when it names one.

package/dist/mcp/catalog.d.ts

@@ -12,6 +12,7 @@
  */
 import type { ToolSet } from 'ai';
 import type { StepExecutorContext } from '../agent/executor.ts';
+import { type NodeRedaction } from '../agent/observation.ts';
 import type { ScreenPresenter } from '../agent/screen-update.ts';
 import type { LocatorExpression, SemanticNode, TargetSession } from '../engine/surface.ts';
 import type { LocatorEngine } from '../locator/engine.ts';
@@ -35,7 +36,7 @@ export interface CatalogOptions {
     /** The agent's project tools (`agents.<name>.tools`), served beside the built-in ones. */
     readonly tools: Readonly<Record<string, AgentTool>>;
     /** The attempt's secret ledger: what `locate` shows of a node passes through it, as `observe` does. */
-    readonly redact: (text: string) => string;
+    readonly redaction: NodeRedaction;
     /** The session's recorder, when the engine records video. */
     readonly recorder: SessionRecorder | undefined;
     readonly warn: (message: string) => void;
@@ -60,4 +61,4 @@ export interface LocateQuery {
 /** Builds the expression and the matching `screen.*` call from the tool arguments. */
 export declare function locateQuery(args: LocateArgs): LocateQuery;
 /** Renders a locate result: the count, the verdict a test would get, and the nodes, each through the attempt's redactor. */
-export declare function describeLocate(query: LocateQuery, count: number, nodes: readonly SemanticNode[], redact: (text: string) => string): string;
+export declare function describeLocate(query: LocateQuery, count: number, nodes: readonly SemanticNode[], redaction: NodeRedaction): string;

package/dist/mcp/catalog.js

@@ -12,7 +12,7 @@
  */
 import { z } from 'zod';
 import { projectTools } from '../agent/default-agent.js';
-import { projectTree } from '../agent/observation.js';
+import { projectTree, redactNode } from '../agent/observation.js';
 import { GRAMMAR_TOOL_NAMES } from '../agent/action-names.js';
 import { createGrammarTools } from '../agent/primitives.js';
 import { ConfigurationError } from '../internal/errors.js';
@@ -34,7 +34,7 @@ export function createSessionCatalog(options) {
     const builtIn = {
         observe: fullObserveTool(context, screen),
         ...verbs,
-        locate: locateTool(options.locator, options.session, options.redact),
+        locate: locateTool(options.locator, options.session, options.redaction),
         ...recording,
     };
     const defined = options.tools;
@@ -65,7 +65,7 @@ function fullObserveTool(context, screen) {
     };
 }
 /** The session's `locate`: a semantic locator tried against the live screen, with the verdict a test would get. */
-function locateTool(locator, session, redact) {
+function locateTool(locator, session, redaction) {
     return {
         description: 'Try a semantic locator against the live screen before writing it into a test: screen.getByRole(role, name), getByText, getByLabel, getByPlaceholder, or getByTestId. Returns how many nodes match and which, plus the test code to use. Exactly one of role, text, label, placeholder, or testId; name narrows a role query. Matching is exact unless exact is false.',
         inputSchema: z.object({
@@ -84,7 +84,7 @@ function locateTool(locator, session, redact) {
             for (const ref of refs.slice(0, MAX_LOCATE_NODES)) {
                 read.push(await session.read(ref, locator.operation()));
             }
-            return describeLocate(query, refs.length, read, redact);
+            return describeLocate(query, refs.length, read, redaction);
         },
     };
 }
@@ -115,7 +115,7 @@ export function locateQuery(args) {
     return { expression: textQuery('placeholder', placeholder, { exact }, undefined), code: `screen.getByPlaceholder(${JSON.stringify(placeholder)}${options})` };
 }
 /** Renders a locate result: the count, the verdict a test would get, and the nodes, each through the attempt's redactor. */
-export function describeLocate(query, count, nodes, redact) {
+export function describeLocate(query, count, nodes, redaction) {
     const lines = [`${count === 1 ? '1 node matches' : `${count} nodes match`} ${describeExpression(query.expression)}.`];
     if (count === 1)
         lines.push(`Use: ${query.code}`);
@@ -124,7 +124,7 @@ export function describeLocate(query, count, nodes, redact) {
     else
         lines.push(`A test action on ${query.code} would fail with LOCATOR_AMBIGUOUS. Narrow it with a name, getByRole(role, name), .filter({ hasText }), .first(), or .nth(i), or scope it under a container.`);
     for (const node of nodes)
-        lines.push(`- ${describeNode(projectTree(node, redact))}`);
+        lines.push(`- ${describeNode(projectTree(redactNode(node, redaction)))}`);
     if (count > nodes.length)
         lines.push(`- and ${count - nodes.length} more`);
     return lines.join('\n');

package/dist/mcp/output.d.ts

@@ -0,0 +1,59 @@
+/**
+ * What the `e2e mcp` process prints besides the protocol. User code runs in
+ * this process (the config's top-level code, project tools, engines), and
+ * what it writes to stdout or stderr reaches the operator's stderr redacted
+ * with every secret value the process knows, as a test's output leaves an
+ * `e2e run` worker. The server's own diagnostics are redacted where they are
+ * written and pass as they are.
+ */
+import { type SecretLedger } from '../internal/redact.ts';
+export type OutputStream = 'stdout' | 'stderr';
+/** Writes text to the operator's stderr; the callback fires once the stream took it. Answers false while the stream is backed up, like `Writable.write`. */
+export type OutputSink = (text: string, callback?: () => void) => boolean;
+export declare class McpOutput {
+    private readonly sink;
+    /** Each stream's bytes decoded on their own, so a character split across writes stays whole. */
+    private readonly decoders;
+    /** One redactor for both streams: they land on one stderr, where a value split across them reads whole. */
+    private readonly redactor;
+    /** Config loads in flight: until each ends, what anyone prints is held. */
+    private loading;
+    /** Whether a load in flight failed, so its secrets are unknown and what is held cannot be redacted. */
+    private loadFailed;
+    /** Tool calls in flight: a held tail is released only once none is, since any of them may be partway through a value. */
+    private calls;
+    private held;
+    /** Whether the last text passed on ended its line. */
+    private atLineStart;
+    constructor(sink: OutputSink, ledger: SecretLedger);
+    /**
+     * One write of user code to `stream`, redacted across writes: the tail a
+     * later write could complete into a value waits for it, or for the end of
+     * the tool calls in flight. Held while a config loads. Answers what the
+     * sink did.
+     */
+    write(stream: OutputStream, chunk: string | Uint8Array, callback?: () => void): boolean;
+    /** One line of the server's own, already redacted where it was written; on a line of its own even when user code left one unfinished. */
+    log(line: string): void;
+    /** A line of the server's that carries user text (an error nobody caught): redacted and held like what user code writes. */
+    report(line: string): void;
+    /**
+     * Runs `load`, a config load that registers the config's secrets, holding
+     * what anyone prints until it ends: the config's top-level code may print
+     * a value before the process knows it is one. Released redacted once every
+     * load in flight succeeded; withheld when one failed, since the secrets of
+     * a config that did not load are unknown.
+     */
+    withholdDuring<T>(load: () => Promise<T>): Promise<T>;
+    /**
+     * Runs one tool call. Once no call is in flight, the tail held for a later
+     * write is released, redacted: user code that printed without a newline is
+     * seen when its call ends, not when the server exits.
+     */
+    duringCall<T>(call: () => Promise<T>): Promise<T>;
+    /** Releases what is still held, redacted; nothing more will follow. Output held for a load still in flight is withheld. */
+    end(): void;
+    private releaseHeld;
+    private withhold;
+    private emit;
+}

package/dist/mcp/output.js

@@ -0,0 +1,129 @@
+/**
+ * What the `e2e mcp` process prints besides the protocol. User code runs in
+ * this process (the config's top-level code, project tools, engines), and
+ * what it writes to stdout or stderr reaches the operator's stderr redacted
+ * with every secret value the process knows, as a test's output leaves an
+ * `e2e run` worker. The server's own diagnostics are redacted where they are
+ * written and pass as they are.
+ */
+import { StringDecoder } from 'node:string_decoder';
+import { StreamRedactor } from '../internal/redact.js';
+export class McpOutput {
+    sink;
+    /** Each stream's bytes decoded on their own, so a character split across writes stays whole. */
+    decoders = {
+        stdout: new StringDecoder('utf8'),
+        stderr: new StringDecoder('utf8'),
+    };
+    /** One redactor for both streams: they land on one stderr, where a value split across them reads whole. */
+    redactor;
+    /** Config loads in flight: until each ends, what anyone prints is held. */
+    loading = 0;
+    /** Whether a load in flight failed, so its secrets are unknown and what is held cannot be redacted. */
+    loadFailed = false;
+    /** Tool calls in flight: a held tail is released only once none is, since any of them may be partway through a value. */
+    calls = 0;
+    held = [];
+    /** Whether the last text passed on ended its line. */
+    atLineStart = true;
+    constructor(sink, ledger) {
+        this.sink = sink;
+        this.redactor = new StreamRedactor(ledger);
+    }
+    /**
+     * One write of user code to `stream`, redacted across writes: the tail a
+     * later write could complete into a value waits for it, or for the end of
+     * the tool calls in flight. Held while a config loads. Answers what the
+     * sink did.
+     */
+    write(stream, chunk, callback) {
+        const text = typeof chunk === 'string' ? chunk : this.decoders[stream].write(chunk);
+        if (this.loading > 0) {
+            this.held.push(text);
+            if (callback !== undefined)
+                process.nextTick(callback);
+            return true;
+        }
+        return this.emit(this.redactor.push(text), callback);
+    }
+    /** One line of the server's own, already redacted where it was written; on a line of its own even when user code left one unfinished. */
+    log(line) {
+        this.emit(`${this.atLineStart ? '' : '\n'}${line}\n`);
+    }
+    /** A line of the server's that carries user text (an error nobody caught): redacted and held like what user code writes. */
+    report(line) {
+        this.write('stderr', `${this.atLineStart ? '' : '\n'}${line}\n`);
+    }
+    /**
+     * Runs `load`, a config load that registers the config's secrets, holding
+     * what anyone prints until it ends: the config's top-level code may print
+     * a value before the process knows it is one. Released redacted once every
+     * load in flight succeeded; withheld when one failed, since the secrets of
+     * a config that did not load are unknown.
+     */
+    async withholdDuring(load) {
+        this.loading += 1;
+        try {
+            return await load();
+        }
+        catch (cause) {
+            this.loadFailed = true;
+            throw cause;
+        }
+        finally {
+            this.loading -= 1;
+            if (this.loading === 0)
+                this.releaseHeld();
+        }
+    }
+    /**
+     * Runs one tool call. Once no call is in flight, the tail held for a later
+     * write is released, redacted: user code that printed without a newline is
+     * seen when its call ends, not when the server exits.
+     */
+    async duringCall(call) {
+        this.calls += 1;
+        try {
+            return await call();
+        }
+        finally {
+            this.calls -= 1;
+            if (this.calls === 0 && this.loading === 0)
+                this.emit(this.redactor.flush());
+        }
+    }
+    /** Releases what is still held, redacted; nothing more will follow. Output held for a load still in flight is withheld. */
+    end() {
+        this.write('stdout', this.decoders.stdout.end());
+        this.write('stderr', this.decoders.stderr.end());
+        if (this.loading > 0)
+            this.withhold();
+        this.emit(this.redactor.flush());
+    }
+    releaseHeld() {
+        if (this.loadFailed) {
+            this.withhold();
+            return;
+        }
+        const held = this.held;
+        this.held = [];
+        for (const text of held)
+            this.emit(this.redactor.push(text));
+    }
+    withhold() {
+        const bytes = this.held.reduce((total, text) => total + Buffer.byteLength(text), 0);
+        this.held = [];
+        this.loadFailed = false;
+        if (bytes > 0)
+            this.log(`e2e mcp: [warning] withheld ${bytes} bytes of output printed while a config failed to load: its secrets are unknown, so the output cannot be redacted`);
+    }
+    emit(text, callback) {
+        if (text === '') {
+            if (callback !== undefined)
+                process.nextTick(callback);
+            return true;
+        }
+        this.atLineStart = text.endsWith('\n');
+        return this.sink(text, callback);
+    }
+}

package/dist/mcp/server.d.ts

@@ -7,6 +7,7 @@
  * it the process's and a test hands it pipes.
  */
 import type { Readable, Writable } from 'node:stream';
+import type { McpOutput } from './output.ts';
 import type { McpSessionSummary } from './usage.ts';
 /** The client as it named itself in `initialize`. */
 export interface McpClient {
@@ -19,6 +20,7 @@ export interface ServeOptions {
     readonly configPath?: string | undefined;
     /** The target every session opens on; otherwise a call names one, or the only one is used. */
     readonly target?: string | undefined;
+    /** Whether a session shows its UI when `open_session` does not set `headed`. */
     readonly headed: boolean;
     /** How many sessions may be open at once, from `--max-sessions`. */
     readonly maxSessions?: number | undefined;
@@ -29,6 +31,8 @@ export interface ServeOptions {
     readonly stdout: Writable;
     /** Diagnostics for the operator, normally stderr. */
     readonly log: (line: string) => void;
+    /** What user code in this process prints: held while a config loads, and its unfinished lines released once no tool call is in flight. */
+    readonly output?: Pick<McpOutput, 'withholdDuring' | 'duringCall'> | undefined;
     /** Ends the server from outside: a process signal. */
     readonly signal?: AbortSignal | undefined;
     /** Told once per `open_session`, when its session closes or its open fails, with the client that asked; undefined before `initialize`. */

package/dist/mcp/server.js

@@ -10,11 +10,11 @@ import { McpServer, ResourceTemplate } from '@modelcontextprotocol/server';
 import { StdioServerTransport } from '@modelcontextprotocol/server/stdio';
 import { readGuide, skillTopics } from '../cli/skill.js';
 import { ConfigurationError, errorMessage } from '../internal/errors.js';
+import { processSecrets } from '../run/secrecy.js';
 import { loadProjectConfig, locateProjectConfig } from './config.js';
 import { SessionHost } from './session.js';
-import { errorResult } from './tools.js';
 const INSTRUCTIONS = `e2e is a local-first end-to-end test runner; this server drives an e2e project's app (its e2e.config.ts) live.
-Call open_session (optionally with a target and a config path) to get a session, its tool catalog, and the first observation. Then call {tool, args} runs any catalog tool: observe, the grammar its engine honors, type_secret, locate, screenshot, start_recording and stop_recording when the engine records video (a video of the app for a pull request), and the project's own tools; tools lists them, tools {tool} shows one tool's arguments. close_session when done.
+Call open_session (optionally with a target, a config path, and headed: true when the user wants to watch) to get a session, its tool catalog, and the first observation. Then call {tool, args} runs any catalog tool: observe, the grammar its engine honors, type_secret, locate, screenshot, start_recording and stop_recording when the engine records video (a video of the app for a pull request), and the project's own tools; tools lists them, tools {tool} shows one tool's arguments. close_session when done.
 Several sessions can be open at once, each with its own browser or device, so parallel agents (subagents) each open their own: pass the session id from open_session to every tools, call, and close_session.
 Write deterministic tests (tests/*.e2e.ts) from what you saw and run them with the CLI: npx e2e run <file>. Resources e2e://guide and e2e://guide/{topic} hold the writing guide.`;
 /** Serves until the client disconnects or `signal` aborts; resolves with the exit code. */
@@ -26,9 +26,11 @@ export async function serveMcp(options) {
         if (!disconnected && server.isConnected())
             void server.sendLoggingMessage({ level, logger: 'e2e', data: message }).catch(() => undefined);
     };
+    const output = options.output;
     const host = new SessionHost({
         locateConfig: (configPath) => locateProjectConfig({ cwd: options.cwd, configPath: configPath ?? options.configPath }),
         loadConfig: (configPath) => loadProjectConfig(configPath, options.env),
+        withholdOutput: output === undefined ? undefined : (load) => output.withholdDuring(load),
         env: options.env,
         headed: options.headed,
         maxSessions: options.maxSessions,
@@ -44,14 +46,9 @@ export async function serveMcp(options) {
             description: spec.description,
             inputSchema: spec.inputSchema,
             annotations: { readOnlyHint: spec.readOnly, openWorldHint: false },
-        }, async (args, ctx) => {
-            // A failure is a result the agent can react to, never a protocol error.
-            try {
-                return await spec.call(args, { signal: ctx.mcpReq.signal });
-            }
-            catch (cause) {
-                return errorResult(cause);
-            }
+        }, (args, ctx) => {
+            const call = () => spec.call(args, { signal: ctx.mcpReq.signal });
+            return output === undefined ? call() : output.duringCall(call);
         });
     }
     registerGuide(server);
@@ -84,9 +81,9 @@ export async function serveMcp(options) {
             options.log(summary);
     }
     catch (cause) {
-        options.log(`session teardown failed: ${errorMessage(cause)}`);
+        options.log(`session teardown failed: ${processSecrets.redact(errorMessage(cause))}`);
     }
-    await server.close().catch((cause) => options.log(`server close failed: ${errorMessage(cause)}`));
+    await server.close().catch((cause) => options.log(`server close failed: ${processSecrets.redact(errorMessage(cause))}`));
     return 0;
 }
 /** The skill as resources, for clients that read context without a tool call. */

package/dist/mcp/session.d.ts

@@ -25,13 +25,18 @@ export interface OpenSessionOptions {
     readonly target?: string | undefined;
     /** A config file to load instead of the server's default, relative to the server's directory. */
     readonly config?: string | undefined;
+    /** Whether this session shows its UI; otherwise the server's `headed`. */
+    readonly headed?: boolean | undefined;
 }
 export interface SessionHostOptions {
     /** The absolute path of the config a session loads, without evaluating it; `configPath` overrides the server's default. */
     readonly locateConfig: (configPath: string | undefined) => string;
     /** Loads the config at an absolute path fresh for each session, so an edited config applies without a restart. */
     readonly loadConfig: (configPath: string) => Promise<LoadedConfig>;
+    /** Holds what the process prints while `load` evaluates a config and registers its secrets; by default nothing is held. */
+    readonly withholdOutput?: (<T>(load: () => Promise<T>) => Promise<T>) | undefined;
     readonly env: NodeJS.ProcessEnv;
+    /** Whether a session shows its UI when `open_session` does not say, from `--headed`. */
     readonly headed: boolean;
     /** The target every session opens on, from `--target`; a call may still name one. */
     readonly defaultTarget?: string | undefined;
@@ -54,8 +59,10 @@ export declare class SessionHost {
     constructor(options: SessionHostOptions);
     get isOpen(): boolean;
     private get maxSessions();
-    /** The server's tools: the same four whatever the project, the config, or the target. */
+    /** The server's tools: the same four whatever the project, the config, or the target, each redacting what it returns. */
     toolSpecs(): readonly McpToolSpec[];
+    /** Logs a line for the operator and the client, redacted with every secret value the process knows. */
+    private log;
     /**
      * Opens a session and returns its opening text: the summary, the catalog,
      * and the first screen. `signal` is the request's: a client that cancels