elanous 0.2.43 → 0.2.44

package/scripts/rhythm/daily.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { Database } from 'bun:sqlite';
 import { dirname, join } from 'node:path';
@@ -537,6 +538,7 @@ function sendNewsAfterReview(delivery: DeliveryResult, file: string, markdown: s
 }
 
 export type DailyDeps = { now?: () => Date; root?: string; vaultRoot?: string | null; sendEnabled?: boolean; repoRoot?: string; repoName?: string;
+  runId?: string;
   landings?: (now: Date) => Promise<Landing[]>; release?: () => Promise<Release>; loops?: () => Promise<Loop[]>;
   grid?: () => Promise<Seat[]>; decisions?: () => Promise<Pending[]>; news?: () => Promise<News[]>;
   cooAdmin?: (now: Date) => Promise<string>;
@@ -569,6 +571,7 @@ function copyToVault(markdown: string, now: Date, deps: DailyDeps): { vaultError
 
 export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; stage?: 'collect' | 'compose' | 'deliver' } = {}, deps: DailyDeps = {}) {
   const now = (deps.now ?? (() => new Date()))();
+  const runId = deps.runId ?? randomUUID();
   const receiptKey = `RHYTHM-DAILY:${kstDay(now)}`;
   if (options.stage === 'compose' || options.stage === 'deliver') {
     const file = join(deps.root ?? effectiveInstanceRoot(), 'rhythm', 'daily', `${kstDay(now)}.md`);
@@ -628,7 +631,7 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
             if (deps.log) deps.log('loop.rhythm-daily', 'linear-progress-config-blocked', { reason: 'issue-allowlist-missing' });
             else loopEvent('rhythm-daily', 'linear-progress-config-blocked', { reason: 'issue-allowlist-missing' });
           } else {
-            linearProgress = await (deps.linearProgressSync ?? runLinearProgressSync)({ version: checklistDevVersion(devVersion()), now, root: deps.root,
+            linearProgress = await (deps.linearProgressSync ?? runLinearProgressSync)({ version: checklistDevVersion(devVersion()), now, root: deps.root, runId,
               apply: true, allowIssueIdentifiers,
               log: (event, data) => deps.log ? deps.log('loop.rhythm-daily.linear-progress', event, data)
                 : loopEvent('rhythm-daily.linear-progress', event, data) });

package/scripts/rhythm/linear-progress-sync.ts

@@ -11,6 +11,8 @@ import { acquireLockAsync } from '../../src/storage/file-lock.js';
 
 export type ProgressIssue = {
   id: string; identifier: string; title: string; url: string; description: string; state: string;
+  /** Verified Linear team key; live writes fail closed unless this is DEMO. */
+  teamKey: string;
 };
 export type ProgressLink = { issue: ProgressIssue; cells: ChecklistItem[]; decisions: DecisionEntry[]; sources: Array<{ cellId: string; field: string }> };
 export type ProgressPreview = { identifier: string; body: string; sources: Array<{ cellId: string; field: string }> };
@@ -107,10 +109,10 @@ export function renderProgressPreview(link: ProgressLink, checklist: Checklist,
   return { identifier: link.issue.identifier, body, sources: link.sources };
 }
 
-async function fetchTeamIssues(apiKey: string, teamKey: string): Promise<ProgressIssue[]> {
+async function fetchTeamIssues(apiKey: string, teamKey: string, fetchFn: typeof fetch = fetch): Promise<ProgressIssue[]> {
   const query = `query LinearProgressIssues($teamKey: String!, $after: String) {
     issues(filter: { team: { key: { eq: $teamKey } } }, first: 100, after: $after) {
-      nodes { id identifier title url description state { name } }
+      nodes { id identifier title url description state { name } team { key } }
       pageInfo { hasNextPage endCursor }
     }
   }`;
@@ -118,7 +120,7 @@ async function fetchTeamIssues(apiKey: string, teamKey: string): Promise<Progres
   const cursors = new Set<string>();
   let after: string | null = null;
   do {
-    const response = await fetch('https://api.linear.app/graphql', {
+    const response = await fetchFn('https://api.linear.app/graphql', {
       method: 'POST', headers: { Authorization: apiKey, 'Content-Type': 'application/json' },
       body: JSON.stringify({ query, variables: { teamKey, after } }),
     });
@@ -129,8 +131,10 @@ async function fetchTeamIssues(apiKey: string, teamKey: string): Promise<Progres
     for (const node of page.nodes) {
       if (typeof node.id !== 'string' || typeof node.identifier !== 'string' || typeof node.title !== 'string' || typeof node.url !== 'string') continue;
       const state = node.state && typeof node.state === 'object' ? (node.state as { name?: unknown }).name : undefined;
+      const team = node.team && typeof node.team === 'object' ? (node.team as { key?: unknown }).key : undefined;
       issues.push({ id: node.id, identifier: node.identifier, title: node.title, url: node.url,
-        description: typeof node.description === 'string' ? node.description : '', state: typeof state === 'string' ? state : 'unknown' });
+        description: typeof node.description === 'string' ? node.description : '', state: typeof state === 'string' ? state : 'unknown',
+        teamKey: typeof team === 'string' ? team : '' });
     }
     const info = page.pageInfo;
     if (info?.hasNextPage && (!info.endCursor || cursors.has(info.endCursor))) throw new Error(`Linear ${teamKey} cursor missing or repeated`);
@@ -140,11 +144,11 @@ async function fetchTeamIssues(apiKey: string, teamKey: string): Promise<Progres
   return issues;
 }
 
-async function fetchAllowlistedIssue(apiKey: string, identifier: string): Promise<ProgressIssue | null> {
+async function fetchAllowlistedIssue(apiKey: string, identifier: string, fetchFn: typeof fetch = fetch): Promise<ProgressIssue | null> {
   const query = `query LinearAllowlistedProgressIssue($identifier: String!) {
-    issue(id: $identifier) { id identifier title url description state { name } }
+    issue(id: $identifier) { id identifier title url description state { name } team { key } }
   }`;
-  const response = await fetch('https://api.linear.app/graphql', {
+  const response = await fetchFn('https://api.linear.app/graphql', {
     method: 'POST', headers: { Authorization: apiKey, 'Content-Type': 'application/json' },
     body: JSON.stringify({ query, variables: { identifier } }),
   });
@@ -154,11 +158,13 @@ async function fetchAllowlistedIssue(apiKey: string, identifier: string): Promis
   if (result.errors?.length) throw new Error(`Linear ${identifier} lookup failed`);
   if (!node || typeof node.id !== 'string' || typeof node.identifier !== 'string' || typeof node.title !== 'string' || typeof node.url !== 'string') return null;
   const state = node.state && typeof node.state === 'object' ? (node.state as { name?: unknown }).name : undefined;
+  const team = node.team && typeof node.team === 'object' ? (node.team as { key?: unknown }).key : undefined;
   return { id: node.id, identifier: node.identifier, title: node.title, url: node.url,
-    description: typeof node.description === 'string' ? node.description : '', state: typeof state === 'string' ? state : 'unknown' };
+    description: typeof node.description === 'string' ? node.description : '', state: typeof state === 'string' ? state : 'unknown',
+    teamKey: typeof team === 'string' ? team : '' };
 }
 
-async function countMarker(apiKey: string, issueId: string, marker: string): Promise<number> {
+async function countMarker(apiKey: string, issueId: string, marker: string, fetchFn: typeof fetch = fetch): Promise<number> {
   const query = `query LinearProgressComments($id: String!, $after: String) {
     issue(id: $id) { comments(first: 100, after: $after) { nodes { body } pageInfo { hasNextPage endCursor } } }
   }`;
@@ -166,7 +172,7 @@ async function countMarker(apiKey: string, issueId: string, marker: string): Pro
   let after: string | null = null;
   let count = 0;
   do {
-    const response = await fetch('https://api.linear.app/graphql', {
+    const response = await fetchFn('https://api.linear.app/graphql', {
       method: 'POST', headers: { Authorization: apiKey, 'Content-Type': 'application/json' },
       body: JSON.stringify({ query, variables: { id: issueId, after } }),
     });
@@ -184,10 +190,11 @@ async function countMarker(apiKey: string, issueId: string, marker: string): Pro
 }
 
 export async function runLinearProgressSync(options: {
-  version: string; now?: Date; root?: string; apply?: boolean;
+  version: string; now?: Date; root?: string; runId?: string; apply?: boolean;
   allowIssueIdentifiers?: readonly string[];
   checklist?: Checklist; issues?: readonly ProgressIssue[]; decisions?: readonly DecisionEntry[];
   getApiKey?: (id: string) => Promise<string | undefined>;
+  fetch?: typeof fetch;
   countMarker?: (issue: ProgressIssue, marker: string) => Promise<number>;
   postComment?: (issue: ProgressIssue, body: string) => Promise<void>;
   log?: (event: string, data: Record<string, unknown>) => void;
@@ -199,6 +206,7 @@ export async function runLinearProgressSync(options: {
   const decisions = options.decisions ?? new DecisionLedger({ stateDir: root }).list({ status: 'all' });
   const apiKey = (options.getApiKey ?? getSecretAsync)('connector.linear.apiKey');
   const resolvedKey = await apiKey;
+  const fetchFn = options.fetch ?? fetch;
   if (!resolvedKey) throw new Error('connector.linear.apiKey missing');
   const allowedIdentifiers = [...new Set(options.allowIssueIdentifiers ?? [])];
   const lookupFailures: Array<{ identifier: string; reason: string }> = [];
@@ -207,7 +215,7 @@ export async function runLinearProgressSync(options: {
   else if (options.apply) {
     const lookups = await Promise.all(allowedIdentifiers.map(async identifier => {
       try {
-        const issue = await fetchAllowlistedIssue(resolvedKey, identifier);
+        const issue = await fetchAllowlistedIssue(resolvedKey, identifier, fetchFn);
         if (!issue) lookupFailures.push({ identifier, reason: 'allowlisted issue not found' });
         return issue;
       } catch (error) {
@@ -216,7 +224,7 @@ export async function runLinearProgressSync(options: {
       }
     }));
     issues = lookups.filter((issue): issue is ProgressIssue => issue !== null);
-  } else issues = (await Promise.all(['ELA', 'DEMO'].map(key => fetchTeamIssues(resolvedKey, key)))).flat();
+  } else issues = await fetchTeamIssues(resolvedKey, 'DEMO', fetchFn);
   const links = resolveExplicitProgressLinks(issues, checklist, decisions);
   const previews = links.map(link => renderProgressPreview(link, checklist, day));
   const linkedIdentifiers = new Set(links.map(link => link.issue.identifier));
@@ -229,16 +237,21 @@ export async function runLinearProgressSync(options: {
   const unresolvedApproved = [...lookupFailures, ...missingApproved, ...unlinkedApproved];
   const result: ProgressSyncResult = { day, candidates: previews, posted: [], alreadyPresent: [], skipped: [], failures: unresolvedApproved };
   const log = (event: string, data: Record<string, unknown>) => {
-    const enriched = { day, ...data };
+    const enriched = { day, ...data, ...(options.runId ? { runId: options.runId } : {}) };
     if (options.log) options.log(event, enriched);
     else debug.log('loop.rhythm-daily.linear-progress', event, enriched);
   };
-  const check = options.countMarker ?? ((issue: ProgressIssue, marker: string) => countMarker(resolvedKey, issue.id, marker));
+  const check = options.countMarker ?? ((issue: ProgressIssue, marker: string) => countMarker(resolvedKey, issue.id, marker, fetchFn));
   const post = options.postComment ?? ((issue: ProgressIssue, body: string) => commentLinearIssue({ apiKey: resolvedKey, issueId: issue.id, body }));
   for (const failure of unresolvedApproved) log('approved-issue-unresolved', failure);
   for (const preview of previews) {
     const issue = links.find(link => link.issue.identifier === preview.identifier)!.issue;
     const marker = `<!-- elanous-linear-progress:${day}:${issue.identifier} -->`;
+    if (issue.teamKey !== 'DEMO') {
+      result.skipped.push(issue.identifier);
+      log('not-demo-team', { identifier: issue.identifier, teamKey: issue.teamKey || 'unknown', sources: preview.sources });
+      continue;
+    }
     let release: (() => void) | undefined;
     let stillHeld: (() => boolean) | undefined;
     try {

package/scripts/ux-sim.ts

@@ -21,10 +21,11 @@
 //   bun scripts/ux-sim.ts emit child-error-long --json # 사건 주입(L0): 격리 우주 원장에 주입 줄 → 소비자 목록
 //
 // catalog list/show 는 재사용 장치의 참조를 보여 준다. 선언된 TUI 장면은 실제 위젯 render() 를 부른다 — 흉내 렌더러가 아니다.
+// catalog devices 는 장치별 진입 명령·logs/event·최근 사용 메타데이터를 읽기 전용으로 출력한다.
 import { simRenderLogFrame } from '../src/ux-sim/render-frame.js';
 import { simTypeaheadState, type TurnPhase, type TurnSimSpec } from '../src/ux-sim/turn-states.js';
 import { renderTurnTypeaheadQueueRow, renderTurnTypeaheadEcho } from '../src/chat/turn-typeahead.js';
-import { loadMockScenarioCatalog, renderMockScenarioDetails, renderMockScenarioList } from '../src/ux-sim/mock-scenario-catalog.js';
+import { loadMockScenarioCatalog, renderMockScenarioDetails, renderMockScenarioDevices, renderMockScenarioList } from '../src/ux-sim/mock-scenario-catalog.js';
 
 const PHASES: TurnPhase[] = [
   'idle', 'thinking', 'streaming', 'streaming-with-subagents', 'harness-child', 'interrupted',
@@ -37,6 +38,11 @@ if (argv[0] === 'list') {
   console.log(renderMockScenarioList(loadMockScenarioCatalog()).join('\n'));
   process.exit(0);
 }
+if (argv[0] === 'devices') {
+  if (argv.length !== 1) { console.error('usage: bun scripts/ux-sim.ts devices'); process.exit(2); }
+  console.log(renderMockScenarioDevices(loadMockScenarioCatalog()).join('\n'));
+  process.exit(0);
+}
 if (argv[0] === 'show') {
   if (argv.length !== 2) { console.error('usage: bun scripts/ux-sim.ts show <MS-id>'); process.exit(2); }
   try {

package/scripts/warm-pool-provider-config.ts

@@ -16,6 +16,7 @@ type JsonObject = Record<string, unknown>;
 
 export interface WarmPoolProviderConfig {
   candidates: WarmWorkerCandidate[];
+  expandPoolTemplatesToQuota: boolean;
   poolTemplates: Array<{
     host: string;
     tier: 'lite' | 'standard';
@@ -137,6 +138,9 @@ export function assembleWarmPoolProviderConfig(input: AssembleWarmPoolProviderCo
   const imageRepository = text(pool.imageRepository, 'pod.warmPool.imageRepository').replace(/\/$/, '');
   const imageDigest = text(pool.imageDigest, 'pod.warmPool.imageDigest');
   if (!DIGEST.test(imageDigest)) throw new Error('pod.warmPool.imageDigest must be a sha256 digest');
+  const expandPoolTemplatesToQuota = pool.expandPoolTemplatesToQuota;
+  if (expandPoolTemplatesToQuota !== undefined && typeof expandPoolTemplatesToQuota !== 'boolean')
+    throw new Error('pod.warmPool.expandPoolTemplatesToQuota must be a boolean');
   const lockHash = text(pool.lockHash, 'pod.warmPool.lockHash');
   if (!LOCK_HASH.test(lockHash)) throw new Error('pod.warmPool.lockHash must be a 64-character SHA-256');
   const architecture = text(pool.architecture, 'pod.warmPool.architecture');
@@ -170,7 +174,8 @@ export function assembleWarmPoolProviderConfig(input: AssembleWarmPoolProviderCo
       },
     };
   });
-  return { candidates: [], poolTemplates, profileConfig: { pod: { warmPoolProfile: profile } },
+  return { candidates: [], expandPoolTemplatesToQuota: expandPoolTemplatesToQuota === true,
+    poolTemplates, profileConfig: { pod: { warmPoolProfile: profile } },
     controlUrl: controlUrl(input.controlUrl), memberToken: token(input.memberToken, 'member token'), machineTokens };
 }
 

package/src/agent-mission/grok-auth-status.ts

@@ -2,46 +2,106 @@ import { spawn } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 
-export interface GrokLoginProbeResult { ok: boolean; reason?: string }
-export type GrokAuthProbe = (timeoutMs: number) => Promise<{ status: number | null; stdout?: string; stderr?: string; error?: Error }> | { status: number | null; stdout?: string; stderr?: string; error?: Error };
+export type GrokProbeStage = 'spawn' | 'first-byte' | 'auth' | 'connect' | 'response' | 'exit';
+export interface GrokLoginProbeResult { ok: boolean; reason?: string; stage?: GrokProbeStage; durationMs?: number }
+export interface GrokAuthProbeResult { status: number | null; stdout?: string; stderr?: string; error?: Error; stage?: GrokProbeStage; durationMs?: number }
+export type GrokAuthProbe = (timeoutMs: number) => Promise<GrokAuthProbeResult> | GrokAuthProbeResult;
 
-const runAuthProbe: GrokAuthProbe = (timeoutMs) => new Promise((resolve) => {
+type ProbeChild = ReturnType<typeof spawn>;
+type ProbeSpawner = typeof spawn;
+
+export const runAuthProbe: (timeoutMs: number, spawnProcess?: ProbeSpawner) => Promise<GrokAuthProbeResult> = (timeoutMs, spawnProcess = spawn) => new Promise((resolve) => {
+  const startedAt = Date.now();
+  let stage: GrokProbeStage = 'spawn';
   let stdout = '';
   let stderr = '';
+  let pendingStderrLine = '';
+  let discardStderrLine = false;
   let settled = false;
-  const finish = (result: { status: number | null; stdout?: string; stderr?: string; error?: Error }) => {
+  const capturedStderr = () => sanitizeStderr(`${stderr}${pendingStderrLine}`).slice(-8_000);
+  const appendStderr = (chunk: string) => {
+    let remaining = chunk;
+    if (discardStderrLine) {
+      const newline = remaining.indexOf('\n');
+      if (newline < 0) return;
+      remaining = remaining.slice(newline + 1);
+      discardStderrLine = false;
+    }
+    const lines = `${pendingStderrLine}${remaining}`.split('\n');
+    pendingStderrLine = lines.pop() ?? '';
+    if (lines.length) stderr = sanitizeStderr(`${stderr}${lines.join('\n')}`).slice(-8_000);
+    if (pendingStderrLine.length > 64_000) {
+      if (/(?:authorization\s*:\s*(?:basic|bearer|token|apikey|api[- ]key)|(?:api[_-]?key|api[_-]?token|access[_-]?key|secret|password|credential|auth[_-]?token|refresh[_-]?token))\s*[:=]/i.test(pendingStderrLine)) {
+        pendingStderrLine = '';
+        discardStderrLine = true;
+      } else {
+        pendingStderrLine = pendingStderrLine.slice(-8_000);
+      }
+    }
+  };
+  const finish = (result: GrokAuthProbeResult) => {
     if (settled) return;
     settled = true;
     clearTimeout(timer);
-    resolve(result);
+    resolve({ ...result, stderr: capturedStderr(), stage: result.stage ?? stage, durationMs: Date.now() - startedAt });
   };
-  const child = spawn(join(homedir(), '.grok', 'bin', 'grok'), ['-p', 'reply with just OK'], {
+  const child: ProbeChild = spawnProcess(join(homedir(), '.grok', 'bin', 'grok'), ['-p', 'reply with just OK'], {
     stdio: ['ignore', 'pipe', 'pipe'],
   });
+  child.once('spawn', () => { stage = 'first-byte'; });
   const timer = setTimeout(() => {
     child.kill('SIGTERM');
-    finish({ status: null, stdout, stderr, error: new Error('Grok subscribed-access probe timed out') });
+    finish({ status: null, stdout, stderr: capturedStderr(), stage: classifyStage(capturedStderr(), stdout, stage), error: new Error('Grok subscribed-access probe timed out') });
   }, Math.max(1, timeoutMs));
-  child.stdout?.setEncoding('utf8').on('data', (chunk: string) => { stdout = `${stdout}${chunk}`.slice(-8_000); });
-  child.stderr?.setEncoding('utf8').on('data', (chunk: string) => { stderr = `${stderr}${chunk}`.slice(-8_000); });
-  child.once('error', (error) => finish({ status: null, stdout, stderr, error }));
-  child.once('close', (status) => finish({ status, stdout, stderr }));
+  child.stdout?.setEncoding('utf8').on('data', (chunk: string) => { stage = 'response'; stdout = `${stdout}${chunk}`.slice(-8_000); });
+  child.stderr?.setEncoding('utf8').on('data', (chunk: string) => { appendStderr(chunk); stage = classifyStage(capturedStderr(), stdout, stage); });
+  child.once('error', (error) => finish({ status: null, stdout, stderr, stage, error }));
+  child.once('close', (status) => finish({ status, stdout, stderr, stage: classifyStage(stderr, stdout, 'exit') }));
 });
 
 /** Quick, credential-safe subscribed-access probe; whoami needs an interactive TTY in this CLI. */
 export async function probeGrokLogin(run: GrokAuthProbe = runAuthProbe, timeoutMs = 45_000): Promise<GrokLoginProbeResult> {
   const result = await run(timeoutMs);
+  const stage = result.stage ?? classifyStage(result.stderr ?? '', result.stdout ?? '', result.error ? 'first-byte' : 'exit');
+  const duration = result.durationMs === undefined ? {} : { durationMs: result.durationMs };
+  const details = formatDiagnostics(stage, result.durationMs, result.stderr);
   if (result.error?.name === 'TimeoutError' || /timed out|ETIMEDOUT/i.test(result.error?.message ?? '')) {
-    return { ok: false, reason: 'Grok subscribed-access probe timed out' };
+    return { ok: false, stage, ...duration, reason: `Grok subscribed-access probe timed out ${details}` };
   }
-  if (result.error) return { ok: false, reason: 'grok CLI could not be started' };
+  if (result.error) return { ok: false, stage, ...duration, reason: `grok CLI could not be started ${details}` };
   const output = `${result.stdout ?? ''}\n${result.stderr ?? ''}`.trim();
   if (result.status !== 0 || /login required|not authenticated|unauthori[sz]ed|authentication failed/i.test(output)) {
     const reason = /login required|not authenticated|unauthori[sz]ed|authentication failed/i.test(output)
-      ? 'Grok login unavailable; run grok login'
-      : `Grok subscribed-access probe exited ${result.status ?? 'without a status'}`;
-    return { ok: false, reason };
+      ? `Grok login unavailable; run grok login ${formatDiagnostics('auth', result.durationMs, result.stderr)}`
+      : `Grok subscribed-access probe exited ${result.status ?? 'without a status'} ${details}`;
+    return { ok: false, stage: /login required|not authenticated|unauthori[sz]ed|authentication failed/i.test(output) ? 'auth' : stage, ...duration, reason };
   }
-  if (!/^OK\s*$/i.test((result.stdout ?? '').trim())) return { ok: false, reason: 'Grok subscribed-access probe did not return the expected OK reply' };
-  return { ok: true };
+  if (!/^OK\s*$/i.test((result.stdout ?? '').trim())) return { ok: false, stage, ...duration, reason: `Grok subscribed-access probe did not return the expected OK reply ${details}` };
+  return { ok: true, stage, ...duration };
+}
+
+function classifyStage(stderr: string, stdout: string, fallback: GrokProbeStage): GrokProbeStage {
+  if (/login required|not authenticated|unauthori[sz]ed|authentication failed/i.test(stderr)) return 'auth';
+  if (/ECONN|ENOTFOUND|EHOST|network|connect(?:ion)? (?:refused|failed|timeout)|TLS|certificate/i.test(stderr)) return 'connect';
+  // Stderr can contain pre-response warnings; only stdout proves that a reply
+  // byte reached the caller.
+  if (stdout) return 'response';
+  return fallback;
+}
+
+function formatDiagnostics(stage: GrokProbeStage, durationMs?: number, stderr?: string): string {
+  const safeStderr = sanitizeStderr(stderr);
+  return `(${stage}${durationMs === undefined ? '' : ` after ${durationMs}ms`}${safeStderr ? `; stderr: ${safeStderr}` : '; stderr: <empty>'})`;
+}
+
+function sanitizeStderr(stderr?: string): string {
+  return (stderr ?? '')
+    .replace(/(authorization\s*:\s*(?:basic|bearer|token|apikey|api[- ]key)\s+)\S+/gi, '$1[redacted]')
+    .replace(/(?:[A-Z0-9_]*(?:api[_-]?key|access[_-]?key|secret|password|credential|auth[_-]?token|refresh[_-]?token))\s*[:=]\s*(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\r\n]*)/gi, '[redacted credential]')
+    .replace(/Bearer\s+\S+/gi, 'Bearer [redacted]')
+    .replace(/(?:sk|xai|gsk|gh[pousr])-[A-Za-z0-9_-]{8,}/g, '[redacted-token]')
+    .replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, '[redacted-email]')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(-500);
 }

package/src/agent-mission/mission-out.ts

@@ -6,7 +6,7 @@ import type { Command } from 'commander';
 import { debug, redactSecretText } from '../debug/log.js';
 import type { AsyncLockHandle } from '../storage/file-lock.js';
 import { stateDirSourceForChild } from '../agent/identity-env.js';
-import { createMissionLineStore, MissionLineHttpError, postMissionLineEvent, type MissionLineType } from './mission-line.js';
+import { createMissionLineStore, MissionLineHttpError, postMissionLineEvent, type MissionLineEvent, type MissionLineType } from './mission-line.js';
 import type { LinearMissionLink } from '../intake-plane/linear-mission-sync.js';
 
 const MISSION_CONTEXT_ENV = 'ELANOUS_MISSION_CONTEXT';
@@ -747,7 +747,7 @@ export function registerMissionOutCommand(program: Command, deps: {
             ...(opts.stop !== undefined ? { stop: opts.stop } : {}),
             ...(opts.priority !== undefined ? { priority: opts.priority } : {}),
           };
-          let event: MissionReplyEvent;
+          let event: MissionReplyEvent | MissionLineEvent;
           try {
             const lineEvent = await postMissionLineEvent({
               lineId, missionId, attemptId: lineAttemptId, agent: lineAgent,