fix: back off after Reddit access denials

src/utils/logger.ts

@@ -1,5 +1,6 @@
 import winston from 'winston';
 import Transport from 'winston-transport';
+import { toJsonSafe } from './json-safe.js';
 
 export type Logger = winston.Logger;
 
@@ -37,27 +38,35 @@ export function attachLogSink(logger: Logger, sink: LogSink): void {
 }
 
 function safeStringify(value: unknown): string {
-  const seen = new WeakSet<object>();
   try {
-    return JSON.stringify(value, (_key, val) => {
-      if (typeof val === 'object' && val !== null) {
-        if (seen.has(val)) return '[Circular]';
-        seen.add(val);
-      }
-      if (typeof val === 'bigint') return val.toString();
-      return val;
-    });
+    return JSON.stringify(toJsonSafe(value));
   } catch (err) {
     return `[Unserializable: ${(err as Error).message}]`;
   }
 }
 
+/** Strip credentials and network internals before either console or file output. */
+const redactLogMetadata = winston.format((info) => {
+  const record = info as Record<string, unknown>;
+  const { level, message, timestamp, ...metadata } = record;
+  const safeMetadata = toJsonSafe(metadata);
+  for (const key of Object.keys(metadata)) delete record[key];
+  if (safeMetadata && !Array.isArray(safeMetadata) && typeof safeMetadata === 'object') {
+    Object.assign(record, safeMetadata);
+  }
+  record.level = level;
+  record.message = message;
+  if (timestamp !== undefined) record.timestamp = timestamp;
+  return info;
+});
+
 export function createLogger(): Logger {
   return winston.createLogger({
     level: process.env.LOG_LEVEL || 'info',
     format: winston.format.combine(
       winston.format.timestamp(),
       winston.format.errors({ stack: true }),
+      redactLogMetadata(),
       winston.format.json()
     ),
     transports: [