fix: preserve Linear publication evidence for recovery

sdk/typescript/src/errors.ts

@@ -9,7 +9,7 @@ export function errorMessage(error: unknown): string {
 export function safeErrorMessage(error: unknown): string {
   const message = errorMessage(error);
   const recognizableCredential =
-    /(?:\b(?:sk-(?:proj-)?|github_pat_|gh[pousr]_|npm_)\S+|\b(?:bearer|basic|token)(?:\s|%20|\+)+\S+|:\/\/[^\s/@]+@|-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)/iu.test(
+    /(?:\b(?:sk-(?:proj-)?|github_pat_|gh[pousr]_|npm_)\S+|\b(?:bearer|basic)(?:\s|%20|\+)+\S+|(?:^|[:="'\r\n])\s*token(?:\s|%20|\+)+\S+|:\/\/[^\s/@]+@|-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)/iu.test(
       message,
     );
   const assignments = message.matchAll(

sdk/typescript/src/publish.ts

@@ -25,7 +25,6 @@ import {
 import {
   CodexSecurityError,
   ConfigurationError,
-  errorMessage,
   safeErrorMessage,
 } from "./errors.js";
 import {
@@ -504,7 +503,7 @@ export async function publishScanInternal(
         dependencies.recordPublishedIssues ?? recordPublishedIssues
       )(preparedScan, handoffResults.created, environment);
     } catch (cause) {
-      persistenceFailure = { cause, detail: errorMessage(cause) };
+      persistenceFailure = { cause, detail: safeErrorMessage(cause) };
     }
   }
   result.counts.created = result.created.length;
@@ -538,7 +537,7 @@ export async function publishScanInternal(
     try {
       await saveReceipt(result, environment);
     } catch (error) {
-      const detail = errorMessage(error);
+      const detail = safeErrorMessage(error);
       throw new CodexSecurityError(
         `${reason} and its partial receipt could not be saved: ${detail}. ${recoveryDetails}`,
         { cause: error },

sdk/typescript/tests-ts/errors.test.ts

@@ -72,6 +72,9 @@ describe("error messages", () => {
   test("omits credential-bearing messages at output boundaries", () => {
     for (const message of [
       "request failed: token=SYNTHETIC_TOKEN",
+      "token SYNTHETIC_TOKEN",
+      "request failed: token SYNTHETIC_TOKEN",
+      '{"message":"token SYNTHETIC_TOKEN"}',
       "Authorization: Bearer sk-proj-SYNTHETIC_KEY_123",
       'upstream failed: {"clientSecret":"correct horse battery staple"}',
       JSON.stringify(JSON.stringify({ clientSecret: "SYNTHETIC_SECRET" })),
@@ -98,6 +101,9 @@ describe("error messages", () => {
     );
     expect(safeErrorMessage("author=Michael")).toBe("author=Michael");
     expect(safeErrorMessage("signal=active")).toBe("signal=active");
+    expect(safeErrorMessage("Synthetic token cache unavailable")).toBe(
+      "Synthetic token cache unavailable",
+    );
     expect(safeErrorMessage("design=complete")).toBe("design=complete");
     expect(safeErrorMessage('worker 1: rg -n "password" src/login.ts')).toBe(
       'worker 1: rg -n "password" src/login.ts',

sdk/typescript/tests-ts/publication-integration.test.ts

@@ -907,6 +907,100 @@ describe("database-backed Linear publication integration", () => {
     expect(await artifactDigests(completed.scanDirectory)).toEqual(sealed);
   });
 
+  test("retains uncertain mutations when events.jsonl already exists without losing verified SQLite publications", async () => {
+    const completed = await fixture(2);
+    const sealed = await artifactDigests(completed.scanDirectory);
+    const stdout = capture();
+    const stderr = capture();
+    const cli = dependencies({ environment: completed.environment });
+    let handoffFile = "";
+    let events = "";
+
+    cli.publishScan = async (directory, options) =>
+      publishScanInternal(directory, options, {
+        environment: completed.environment,
+        resolveCodex: () => ({ command: "synthetic-codex" }),
+        runCodex: async (_command, _args, prompt) => {
+          const payload = await publicationPayload(prompt);
+          handoffFile = payload.handoffFile;
+          await writeFile(
+            join(dirname(handoffFile), "events.jsonl"),
+            "Existing event log\n",
+            { flag: "wx", mode: 0o600 },
+          );
+          events = payload.batches[0]!.map((finding, index) =>
+            JSON.stringify({
+              type: "item.completed",
+              item: {
+                id: `tool-${index}`,
+                type: "mcp_tool_call",
+                server: "codex_apps",
+                tool: "linear.save_issue",
+                arguments:
+                  index === 0
+                    ? finding.arguments
+                    : { ...finding.arguments, priority: 4 },
+                status: "completed",
+                result: {
+                  content: [],
+                  structured_content: { identifier: `SEC-${901 + index}` },
+                },
+              },
+            }),
+          ).join("\n");
+          return { exitCode: 0, stdout: events, stderr: "" };
+        },
+      });
+
+    expect(
+      await main(
+        [
+          "publish",
+          "scan",
+          completed.scanDirectory,
+          "--to",
+          "linear",
+          "--linear-team",
+          OPTIONS.teamId,
+          "--project",
+          OPTIONS.projectId,
+          "--json",
+        ],
+        stdout.stream,
+        stderr.stream,
+        cli,
+      ),
+    ).toBe(2);
+
+    expect(stdout.text()).toBe("");
+    expect(stderr.text()).toContain(
+      "could not verify every completed mutation",
+    );
+    expect(stderr.text()).toContain(handoffFile);
+    expect(
+      storedPublications(completed).map(({ external_id }) => external_id),
+    ).toEqual(["SEC-901"]);
+    const receipt = JSON.parse(
+      await readFile(receiptPath(completed), "utf8"),
+    ) as PublishScanResult;
+    expect(receipt.indeterminate).toBe(true);
+    expect(receipt.counts).toEqual({ findings: 2, created: 1, failed: 1 });
+    expect(receipt.created[0]?.issueIdentifier).toBe("SEC-901");
+    const eventFiles = (await readdir(dirname(handoffFile))).filter(
+      (name) => name.startsWith("events-") && name.endsWith(".jsonl"),
+    );
+    expect(eventFiles).toHaveLength(1);
+    const eventsFile = join(dirname(handoffFile), eventFiles[0]!);
+    expect(await readFile(eventsFile, "utf8")).toBe(`${events}\n`);
+    expect(receipt.warnings).toContainEqual(
+      expect.stringContaining(eventsFile),
+    );
+    expect(
+      await readFile(join(dirname(handoffFile), "events.jsonl"), "utf8"),
+    ).toBe("Existing event log\n");
+    expect(await artifactDigests(completed.scanDirectory)).toEqual(sealed);
+  });
+
   test.each([false, true])(
     "keeps conflicting connector identities out of CLI history and retains recovery evidence with skipExisting=%s",
     async (skipExisting) => {
@@ -1218,7 +1312,6 @@ for (;;) Atomics.wait(waiter, 0, 0, 1000);`,
       killTestProcess(descendantPid);
     }
   }, 30_000);
-
   test("recovers verified SQLite publications before an interrupted CLI exits", async () => {
     const completed = await fixture(3);
     const sealed = await artifactDigests(completed.scanDirectory);