Logs and traces

Every agent action can leave three records: an ordered event, a log line and a span. All three carry the run ID, so one read returns the whole story of a run.

overlane observe trace --run run-12
overlane observe logs --run run-12 --limit 50

observe trace returns the run’s summary (agent, status, cost, tokens, review outcome), its events in sequence order, its spans and its log lines, and nothing from another run or another team. observe logs lists a project’s lines, newest first, or one run’s, oldest first.

Redaction happens first

A key in a tool’s output must never reach storage. The ingest route builds the redacted record in memory and writes only after that, so the database, the log sink, the metrics sink, the event log and the console never see the original. The rules, in order:

1. provider-prefixed keys (GitHub, Stripe, AWS, Slack, Google, npm, Anthropic, OpenAI-style, Overlane tokens, JWTs and private key blocks);
2. Bearer and Basic values;
3. an assignment whose name says secret, such as API_KEY=... or "password": "...";
4. a base64 blob that decodes to something rule 1 matches;
5. a long mixed-case string with high entropy that is not a hash, a commit ID or a path.

Request headers are redacted by name (authorization, cookie, anything with token, secret or key in the name) and then by value. An environment dump is redacted the same way. Tool output is scanned as text. A replaced span reads [redacted:rule]. The record keeps redacted: true and a count; there is no field that holds the original text, and the result never reports the value.

Ordinary text is left alone: commit IDs, UUIDs, counts such as tokens: 1200, paths and prose.

// A log record has a redacted flag and a count, and no field for the raw text.
const names = Object.keys(LogRecord.shape);
assert.ok(names.includes("redacted") && names.includes("redactions"));
assert.equal(names.filter((name) => /raw|secret|token|original/i.test(name)).length, 0);

Why ingest is not refused

The platform refuses any API write whose body carries a provider key. The two ingest routes for events and telemetry are the exception: a log that quotes a key is exactly what to record, minus the key. They redact instead of refusing, and report how many spans they replaced.

Retries

A log, span or event ID sent twice is stored once. Spans and logs older than the plan keeps are removed by retention.

Command reference: observe trace and observe logs.