Commit 0cd0ed1a3dc3280cf0be6128b377abc095ba806f | the-knife

apps/mobile/src/state/use-thread-composer-state.ts+7-1

 @@ -2,6 +2,7 @@ import { useAtomValue } from "@effect/atom-react";
 import { useCallback, useEffect, useMemo } from "react";
 import { CommandId, MessageId, type EnvironmentId, type ThreadId } from "@t3tools/contracts";
+import { safeErrorLogAttributes } from "@t3tools/client-runtime/errors";
 import { deriveActiveWorkStartedAt } from "@t3tools/shared/orchestrationTiming";
 import { makeQueuedMessageMetadata } from "../lib/commandMetadata";
 @@ -231,7 +232,12 @@ export function useThreadComposerState() {
           appendComposerDraftAttachments(threadKey, images);
         }
       } catch (error) {
-        console.error("[native paste] error converting images", error);
+        console.error("[native paste] error converting images", {
+          environmentId: selectedThreadShell.environmentId,
+          threadId: selectedThreadShell.id,
+          uriCount: uris.length,
+          ...safeErrorLogAttributes(error),
+        });
       }
     },
     [composerDrafts, selectedThreadShell],

apps/web/src/components/DiffPanel.tsx+11-1

 @@ -4,6 +4,7 @@ import {
   isAtomCommandInterrupted,
   squashAtomCommandFailure,
 } from "@t3tools/client-runtime/state/runtime";
+import { safeErrorLogAttributes } from "@t3tools/client-runtime/errors";
 import type { ScopedThreadRef, TurnId } from "@t3tools/contracts";
 import {
   ArrowRightIcon,
 @@ -452,7 +453,16 @@ export default function DiffPanel({ mode = "inline", composerDraftTarget }: Diff
           void (async () => {
             const result = await openInPreferredEditor(targetPath);
             if (result._tag === "Failure" && !isAtomCommandInterrupted(result)) {
-              console.warn("Failed to open diff file in editor.", squashAtomCommandFailure(result));
+              console.warn("Failed to open diff file in editor.", {
+                operation: "open-diff-file",
+                ...(routeThreadRef
+                  ? {
+                      environmentId: routeThreadRef.environmentId,
+                      threadId: routeThreadRef.threadId,
+                    }
+                  : {}),
+                ...safeErrorLogAttributes(squashAtomCommandFailure(result)),
+              });
             }
           })();
         },

apps/web/src/components/Sidebar.tsx+3-2

...	@@ -55,6 +55,7 @@ import {	...	@@ -55,6 +55,7 @@ import {
55	scopeProjectRef,	55	scopeProjectRef,
56	scopeThreadRef,	56	scopeThreadRef,
57	} from "@t3tools/client-runtime/environment";	57	} from "@t3tools/client-runtime/environment";
		58	import { safeErrorLogAttributes } from "@t3tools/client-runtime/errors";
58	import {	59	import {
59	isAtomCommandInterrupted,	60	isAtomCommandInterrupted,
60	settlePromise,	61	settlePromise,
...	@@ -1523,7 +1524,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec	...	@@ -1523,7 +1524,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
1523	console.error("Failed to remove project", {	1524	console.error("Failed to remove project", {
1524	projectId: member.id,	1525	projectId: member.id,
1525	environmentId: member.environmentId,	1526	environmentId: member.environmentId,
1526	error,	1527	...safeErrorLogAttributes(error),
1527	});	1528	});
1528	toastManager.add(	1529	toastManager.add(
1529	stackedThreadToast({	1530	stackedThreadToast({
...	@@ -1558,7 +1559,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec	...	@@ -1558,7 +1559,7 @@ const SidebarProjectItem = memo(function SidebarProjectItem(props: SidebarProjec
1558	console.error("Failed to remove project", {	1559	console.error("Failed to remove project", {
1559	projectId: member.id,	1560	projectId: member.id,
1560	environmentId: member.environmentId,	1561	environmentId: member.environmentId,
1561	error,	1562	...safeErrorLogAttributes(error),
1562	});	1563	});
1563	toastManager.add(	1564	toastManager.add(
1564	stackedThreadToast({	1565	stackedThreadToast({

apps/web/src/components/settings/SettingsPanels.tsx+6-1

 @@ -12,6 +12,7 @@ import {
   type ScopedThreadRef,
 } from "@t3tools/contracts";
 import { scopeThreadRef } from "@t3tools/client-runtime/environment";
+import { safeErrorLogAttributes } from "@t3tools/client-runtime/errors";
 import {
   isAtomCommandInterrupted,
   settlePromise,
 @@ -1038,7 +1039,11 @@ export function ProviderSettingsPanel() {
       refreshingRef.current = false;
       setIsRefreshingProviders(false);
       if (result._tag === "Failure" && !isAtomCommandInterrupted(result)) {
-        console.warn("Failed to refresh providers", squashAtomCommandFailure(result));
+        console.warn("Failed to refresh providers", {
+          operation: "refresh-providers",
+          environmentId: primaryEnvironment.environmentId,
+          ...safeErrorLogAttributes(squashAtomCommandFailure(result)),
+        });
       }
     })();
   }, [primaryEnvironment, refreshServerProviders]);

apps/web/src/hooks/useSettings.ts+9-2

 @@ -23,6 +23,7 @@ import {
   DEFAULT_CLIENT_SETTINGS,
   type UnifiedSettings,
 } from "@t3tools/contracts/settings";
+import { safeErrorLogAttributes } from "@t3tools/client-runtime/errors";
 import { ensureLocalApi } from "~/localApi";
 import * as Struct from "effect/Struct";
 import { primaryServerSettingsAtom, serverEnvironment } from "~/state/server";
 @@ -106,7 +107,10 @@ async function hydrateClientSettings(): Promise<void> {
         replaceClientSettingsSnapshot({ ...DEFAULT_CLIENT_SETTINGS, ...persistedSettings });
       }
     } catch (error) {
-      console.error(`${CLIENT_SETTINGS_PERSISTENCE_ERROR_SCOPE} hydrate failed`, error);
+      console.error(`${CLIENT_SETTINGS_PERSISTENCE_ERROR_SCOPE} hydrate failed`, {
+        operation: "hydrate",
+        ...safeErrorLogAttributes(error),
+      });
     } finally {
       if (hydrationGeneration === clientSettingsHydrationGeneration) {
         setClientSettingsHydrated(true);
 @@ -129,7 +133,10 @@ function persistClientSettings(settings: ClientSettings): void {
   void ensureLocalApi()
     .persistence.setClientSettings(settings)
     .catch((error) => {
-      console.error(`${CLIENT_SETTINGS_PERSISTENCE_ERROR_SCOPE} persist failed`, error);
+      console.error(`${CLIENT_SETTINGS_PERSISTENCE_ERROR_SCOPE} persist failed`, {
+        operation: "persist",
+        ...safeErrorLogAttributes(error),
+      });
     });
 }

apps/web/src/observability/clientTracing.ts+8-10

 @@ -7,6 +7,7 @@ import { HttpClient } from "effect/unstable/http";
 import { OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
 import { settleAsyncResult, squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
+import { safeErrorLogAttributes } from "@t3tools/client-runtime/errors";
 import { resolvePrimaryEnvironmentHttpUrl } from "../environments/primary";
 import { primaryEnvironmentHttpLayer } from "../environments/primary/httpLayer";
 import { isElectron } from "../env";
 @@ -95,9 +96,14 @@ async function applyClientTracingConfig(config: ClientTracingConfig): Promise<vo
     await disposeTracerRuntime(runtime, scope);
     if (generation === configurationGeneration) {
+      const error = squashAtomCommandFailure(delegateResult);
+      const tracesUrl = new URL(otlpTracesUrl);
       console.warn("Failed to configure client tracing exporter", {
-        error: formatError(squashAtomCommandFailure(delegateResult)),
+        scheme: tracesUrl.protocol.replace(/:$/, ""),
-        otlpTracesUrl,
+        host: tracesUrl.hostname,
+        port: tracesUrl.port || undefined,
+        exportIntervalMs,
+        ...safeErrorLogAttributes(error),
       });
     }
     return;
 @@ -125,14 +131,6 @@ async function disposeTracerRuntime(
   runtime.dispose();
 }
-function formatError(error: unknown): string {
-  if (error instanceof Error && error.message.trim().length > 0) {
-    return error.message;
-  }
-  return String(error);
-}
 export async function __resetClientTracingForTests() {
   configurationGeneration++;
   activeConfigKey = null;

packages/client-runtime/src/connection/supervisor.ts+4-1

 @@ -26,6 +26,7 @@ import {
   type SupervisorConnectionState,
 } from "./model.ts";
 import * as RpcSession from "../rpc/session.ts";
+import { safeErrorLogAttributes } from "../errors/safeLog.ts";
 import * as ConnectionWakeups from "./wakeups.ts";
 const RETRY_DELAYS_MS = [1_000, 2_000, 4_000, 8_000, 16_000] as const;
 @@ -503,11 +504,13 @@ export const make = Effect.fn("EnvironmentSupervisor.make")(function* (
         !establishment.exit.cause.reasons.some(Cause.isFailReason);
       const outcome = failureFromExit(target, establishment.exit, false, false);
       if (isUnexpectedDefect) {
+        const defect = establishment.exit.cause.reasons.find(Cause.isDieReason)?.defect;
         yield* Effect.logError("Connection attempt failed with an unexpected defect.").pipe(
           Effect.annotateLogs({
             "environment.id": target.environmentId,
             "environment.label": target.label,
-            cause: Cause.pretty(establishment.exit.cause),
+            "cause.reason_count": establishment.exit.cause.reasons.length,
+            ...safeErrorLogAttributes(defect),
           }),
         );
       }

packages/client-runtime/src/errors/index.ts+1

...	@@ -1,2 +1,3 @@	...	@@ -1,2 +1,3 @@
1	export * from "./errorTrace.ts";	1	export * from "./errorTrace.ts";
		2	export * from "./safeLog.ts";
2	export * from "./transport.ts";	3	export * from "./transport.ts";

packages/client-runtime/src/errors/safeLog.test.ts created+55

...	@@ -0,0 +1,55 @@
1	import { describe, expect, it } from "vite-plus/test";
2
3	import { safeErrorLogAttributes } from "./safeLog.ts";
4
5	describe("safeErrorLogAttributes", () => {
6	it("keeps correlation and stack frames without serializing messages or nested causes", () => {
7	const cause = Object.assign(new Error("nested-cause-secret-sentinel"), {
8	traceId: "trace-safe-123",
9	});
10	const error = Object.assign(new Error("outer-error-secret-sentinel", { cause }), {
11	_tag: "ProjectRemovalError",
12	});
13	error.stack = [
14	"ProjectRemovalError: outer-error-secret-sentinel",
15	" at removeProject (https://user:password@example.com/project.ts?token=secret#fragment)",
16	].join("\n");
17
18	const attributes = safeErrorLogAttributes(error);
19
20	expect(attributes).toMatchObject({
21	errorType: "error",
22	errorName: "Error",
23	errorTag: "ProjectRemovalError",
24	traceId: "trace-safe-123",
25	stack: " at removeProject (https://example.com/project.ts)",
26	});
27	const diagnosticText = Object.values(attributes).map(String).join("\n");
28	expect(diagnosticText).not.toContain("outer-error-secret-sentinel");
29	expect(diagnosticText).not.toContain("nested-cause-secret-sentinel");
30	expect(diagnosticText).not.toContain("user:password");
31	expect(diagnosticText).not.toContain("token=secret");
32	});
33
34	it("does not trust arbitrary object messages or tags", () => {
35	const attributes = safeErrorLogAttributes({
36	_tag: "payload-secret-sentinel",
37	message: "message-secret-sentinel",
38	cause: { traceId: "trace id with unsafe whitespace" },
39	});
40
41	expect(attributes).toEqual({ errorType: "object" });
42	});
43
44	it("skips an unsafe outer trace id when a nested safe trace id is available", () => {
45	const attributes = safeErrorLogAttributes({
46	traceId: "unsafe trace id",
47	cause: { traceId: "trace-safe-inner" },
48	});
49
50	expect(attributes).toEqual({
51	errorType: "object",
52	traceId: "trace-safe-inner",
53	});
54	});
55	});

packages/client-runtime/src/errors/safeLog.ts created+107

...	@@ -0,0 +1,107 @@
1	const SAFE_ERROR_LABEL =
2	/^(?:Error\|EvalError\|RangeError\|ReferenceError\|SyntaxError\|TypeError\|URIError\|AggregateError\|DOMException\|[A-Za-z][A-Za-z0-9]*(?:Error\|Failure))$/;
3	const SAFE_TRACE_ID = /^[A-Za-z0-9._:-]{1,128}$/;
4	const STACK_FRAME_LIMIT = 32;
5
6	export interface SafeErrorLogAttributes {
7	readonly errorType: "error" \| "array" \| "null" \| "object" \| "primitive";
8	readonly errorName?: string;
9	readonly errorTag?: string;
10	readonly traceId?: string;
11	readonly stack?: string;
12	}
13
14	function readSafeLabel(value: unknown): string \| undefined {
15	return typeof value === "string" && SAFE_ERROR_LABEL.test(value) ? value : undefined;
16	}
17
18	function sanitizeStackUrl(value: string): string {
19	try {
20	const url = new URL(value);
21	url.username = "";
22	url.password = "";
23	url.search = "";
24	url.hash = "";
25	return url.toString();
26	} catch {
27	return value;
28	}
29	}
30
31	function sanitizeStackFrame(frame: string): string {
32	return frame.replace(/(?:https?\|file):\/\/[^\s)]+/g, sanitizeStackUrl);
33	}
34
35	function readSafeStack(error: Error): string \| undefined {
36	try {
37	const frames = error.stack
38	?.split(/\r?\n/)
39	.filter((line) => /^\s*at\s+/.test(line) \|\| /^[^@\s]+@(?:https?\|file):\/\//.test(line))
40	.slice(0, STACK_FRAME_LIMIT)
41	.map(sanitizeStackFrame);
42	return frames && frames.length > 0 ? frames.join("\n") : undefined;
43	} catch {
44	return undefined;
45	}
46	}
47
48	function readErrorTag(error: unknown): string \| undefined {
49	try {
50	if (typeof error !== "object" \|\| error === null) {
51	return undefined;
52	}
53	return readSafeLabel((error as { readonly _tag?: unknown })._tag);
54	} catch {
55	return undefined;
56	}
57	}
58
59	function readTraceId(error: unknown): string \| undefined {
60	try {
61	const seen = new Set<object>();
62	let current: unknown = error;
63
64	while (typeof current === "object" && current !== null && !seen.has(current)) {
65	seen.add(current);
66	const record = current as { readonly cause?: unknown; readonly traceId?: unknown };
67	if (typeof record.traceId === "string" && SAFE_TRACE_ID.test(record.traceId)) {
68	return record.traceId;
69	}
70	current = record.cause;
71	}
72
73	return undefined;
74	} catch {
75	return undefined;
76	}
77	}
78
79	export function safeErrorLogAttributes(error: unknown): SafeErrorLogAttributes {
80	const errorTag = readErrorTag(error);
81	const traceId = readTraceId(error);
82
83	if (error instanceof Error) {
84	const errorName = readSafeLabel(error.name);
85	const stack = readSafeStack(error);
86	return {
87	errorType: "error",
88	...(errorName !== undefined ? { errorName } : {}),
89	...(errorTag !== undefined ? { errorTag } : {}),
90	...(traceId !== undefined ? { traceId } : {}),
91	...(stack !== undefined ? { stack } : {}),
92	};
93	}
94
95	return {
96	errorType:
97	error === null
98	? "null"
99	: Array.isArray(error)
100	? "array"
101	: typeof error === "object"
102	? "object"
103	: "primitive",
104	...(errorTag !== undefined ? { errorTag } : {}),
105	...(traceId !== undefined ? { traceId } : {}),
106	};
107	}

packages/client-runtime/src/state/archivedThreads.test.ts+26-1

...	@@ -1,7 +1,10 @@	...	@@ -1,7 +1,10 @@
1	import { EnvironmentId } from "@t3tools/contracts";	1	import { EnvironmentId, type OrchestrationShellSnapshot } from "@t3tools/contracts";
		2	import * as Cause from "effect/Cause";
		3	import { AsyncResult, Atom, AtomRegistry } from "effect/unstable/reactivity";
2	import { expect, it } from "vite-plus/test";	4	import { expect, it } from "vite-plus/test";
3		5
4	import {	6	import {
		7	createArchivedThreadSnapshotsAtomFamily,
5	makeArchivedThreadsEnvironmentKey,	8	makeArchivedThreadsEnvironmentKey,
6	parseArchivedThreadsEnvironmentKey,	9	parseArchivedThreadsEnvironmentKey,
7	} from "./archivedThreads.ts";	10	} from "./archivedThreads.ts";
...	@@ -13,3 +16,25 @@ it("round-trips environment keys in sorted order", () => {	...	@@ -13,3 +16,25 @@ it("round-trips environment keys in sorted order", () => {
13		16
14	expect(parseArchivedThreadsEnvironmentKey(key)).toEqual([envA, envB]);	17	expect(parseArchivedThreadsEnvironmentKey(key)).toEqual([envA, envB]);
15	});	18	});
		19
		20	it("does not expose an archived snapshot failure message", () => {
		21	const environmentId = EnvironmentId.make("env-sensitive");
		22	const snapshotsAtom = createArchivedThreadSnapshotsAtomFamily<Error>({
		23	getSnapshotAtom: () =>
		24	Atom.make(
		25	AsyncResult.failure<OrchestrationShellSnapshot, Error>(
		26	Cause.fail(new Error("credential=secret-value")),
		27	),
		28	),
		29	labelPrefix: "test:archived-thread-snapshots",
		30	});
		31	const registry = AtomRegistry.make();
		32
		33	expect(registry.get(snapshotsAtom(makeArchivedThreadsEnvironmentKey([environmentId])))).toEqual({
		34	snapshots: [],
		35	error: "Failed to load archived threads.",
		36	isLoading: false,
		37	});
		38
		39	registry.dispose();
		40	});

packages/client-runtime/src/state/archivedThreads.ts+1-6

...	@@ -1,6 +1,5 @@	...	@@ -1,6 +1,5 @@
1	import { EnvironmentId, type OrchestrationShellSnapshot } from "@t3tools/contracts";	1	import { EnvironmentId, type OrchestrationShellSnapshot } from "@t3tools/contracts";
2	import * as Arr from "effect/Array";	2	import * as Arr from "effect/Array";
3	import * as Cause from "effect/Cause";
4	import { pipe } from "effect/Function";	3	import { pipe } from "effect/Function";
5	import * as Option from "effect/Option";	4	import * as Option from "effect/Option";
6	import * as Order from "effect/Order";	5	import * as Order from "effect/Order";
...	@@ -60,11 +59,7 @@ export function createArchivedThreadSnapshotsAtomFamily<E>(options: {	...	@@ -60,11 +59,7 @@ export function createArchivedThreadSnapshotsAtomFamily<E>(options: {
60	}	59	}
61		60
62	if (error === null && result._tag === "Failure") {	61	if (error === null && result._tag === "Failure") {
63	const cause = Cause.squash(result.cause);	62	error = "Failed to load archived threads.";
64	error =
65	cause instanceof Error && cause.message.trim().length > 0
66	? cause.message
67	: "Failed to load archived threads.";
68	}	63	}
69	}	64	}
70		65

packages/client-runtime/src/state/session.ts+5-3

...	@@ -8,6 +8,7 @@ import { AsyncResult, Atom } from "effect/unstable/reactivity";	...	@@ -8,6 +8,7 @@ import { AsyncResult, Atom } from "effect/unstable/reactivity";
8	import { EnvironmentRegistry } from "../connection/registry.ts";	8	import { EnvironmentRegistry } from "../connection/registry.ts";
9	import type { PreparedConnection } from "../connection/model.ts";	9	import type { PreparedConnection } from "../connection/model.ts";
10	import { EnvironmentSupervisor } from "../connection/supervisor.ts";	10	import { EnvironmentSupervisor } from "../connection/supervisor.ts";
		11	import { safeErrorLogAttributes } from "../errors/safeLog.ts";
11	import { followStreamInEnvironment } from "./runtime.ts";	12	import { followStreamInEnvironment } from "./runtime.ts";
12		13
13	export function initialConfigOption<E>(	14	export function initialConfigOption<E>(
...	@@ -16,9 +17,10 @@ export function initialConfigOption<E>(	...	@@ -16,9 +17,10 @@ export function initialConfigOption<E>(
16	return initialConfig.pipe(	17	return initialConfig.pipe(
17	Effect.map(Option.some),	18	Effect.map(Option.some),
18	Effect.catch((error) =>	19	Effect.catch((error) =>
19	Effect.logWarning("Could not load the initial environment configuration.", {	20	Effect.logWarning("Could not load the initial environment configuration.").pipe(
20	error,	21	Effect.annotateLogs({ ...safeErrorLogAttributes(error) }),
21	}).pipe(Effect.as(Option.none<ServerConfig>())),	22	Effect.as(Option.none<ServerConfig>()),
		23	),
22	),	24	),
23	);	25	);
24	}	26	}

packages/client-runtime/src/state/shell.ts+17-12

 @@ -16,6 +16,7 @@ import { AsyncResult, Atom } from "effect/unstable/reactivity";
 import { EnvironmentRegistry } from "../connection/registry.ts";
 import { connectionProjectionPhase } from "../connection/model.ts";
 import { EnvironmentSupervisor } from "../connection/supervisor.ts";
+import { safeErrorLogAttributes } from "../errors/safeLog.ts";
 import { EnvironmentCacheStore } from "../platform/persistence.ts";
 import { subscribe } from "../rpc/client.ts";
 import { applyShellStreamEvent } from "./shellReducer.ts";
 @@ -42,11 +43,7 @@ function shellStatusForSnapshot(
   return Option.isSome(snapshot) ? "cached" : "empty";
 }
-function formatShellError(error: unknown): string {
+const SHELL_SYNCHRONIZATION_ERROR_MESSAGE = "Could not synchronize environment data.";
-  return error instanceof Error && error.message.trim().length > 0
-    ? error.message
-    : "Could not synchronize environment data.";
-}
 export const makeEnvironmentShellState = Effect.fn("EnvironmentShellState.make")(function* () {
   const supervisor = yield* EnvironmentSupervisor;
 @@ -57,7 +54,7 @@ export const makeEnvironmentShellState = Effect.fn("EnvironmentShellState.make")
       Effect.logWarning("Could not load cached environment shell.").pipe(
         Effect.annotateLogs({
           environmentId,
-          error: error.message,
+          ...safeErrorLogAttributes(error),
         }),
         Effect.as(Option.none<OrchestrationShellSnapshot>()),
       ),
 @@ -78,7 +75,7 @@ export const makeEnvironmentShellState = Effect.fn("EnvironmentShellState.make")
         Effect.logWarning("Could not persist environment shell cache.").pipe(
           Effect.annotateLogs({
             environmentId,
-            error: error.message,
+            ...safeErrorLogAttributes(error),
           }),
         ),
       ),
 @@ -110,11 +107,19 @@ export const makeEnvironmentShellState = Effect.fn("EnvironmentShellState.make")
         },
   );
   const setStreamError = (error: unknown) =>
-    SubscriptionRef.update(state, (current) => ({
+    Effect.logWarning("Could not synchronize the environment shell.").pipe(
-      ...current,
+      Effect.annotateLogs({
-      status: shellStatusForSnapshot(current.snapshot),
+        environmentId,
-      error: Option.some(formatShellError(error)),
+        ...safeErrorLogAttributes(error),
-    }));
+      }),
+      Effect.andThen(
+        SubscriptionRef.update(state, (current) => ({
+          ...current,
+          status: shellStatusForSnapshot(current.snapshot),
+          error: Option.some(SHELL_SYNCHRONIZATION_ERROR_MESSAGE),
+        })),
+      ),
+    );
   const applyItem = Effect.fn("EnvironmentShellState.applyItem")(function* (
     item: OrchestrationShellStreamItem,

author	Julius Marminge <julius0216@outlook.com> 2026-06-20 11:50:46-07:00
committer	GitHub <noreply@github.com> 2026-06-20 11:50:46-07:00
log	0cd0ed1a3dc3280cf0be6128b377abc095ba806f
tree	659d3656059781ce8a89ab90c0b59298d5fa530e
parent	d53237cbd14cbdc7fe6b1f1ec2f8aa224a3f7aff
signature	Signed by PGP key B5690EEEBB952194

[codex] Sanitize client error log diagnostics (#3405)