refactor: extract duplicated code into shared utilities

[devin-ai-integration]

What Changed

Extracts widespread duplicated code patterns into two shared utility modules and updates all consumers to import from the canonical source.

New files:

• src/shared/strings.ts — escapeHtml, truncate, isRecord, errorMessage
• src/chat/page-tools.ts — page-tool normalization helpers (normalizePageToolName, normalizePageUrl, normalizePagePath, stringField, numberField, parseJsonRecord, urlFromPath, urlFromText, stripTrailingPunctuation, hasSensitiveQuery)

Deduplicated patterns (29 files touched, net -65 lines):

Pattern	Copies removed	Files affected
escapeHtml()	3 of 4	ui/html.ts, chat/util/escape.ts, core/health-page.ts, secrets/form-page.ts
truncate()	5 of 6	mcp/audit.ts, evolution/gate.ts, evolution/invariant-check.ts, agent/judge-query.ts, channels/slack/render-first-hour-dm.ts
isRecord()/isObject()	4 of 4	chat/sdk-to-wire.ts, chat/transcript-search.ts, chat/run-timeline.ts, agent/murph-context.ts
Page-tool helpers	~13 functions	chat/run-timeline.ts, chat/continuity-context.ts
err instanceof Error ? err.message : String(err)	~75 call sites	13 high-frequency files (index.ts, **/storage.ts, channels/*.ts, scheduler/service.ts, etc.)

Existing re-export modules (ui/html.ts, chat/util/escape.ts) are preserved as thin re-exports so no downstream import paths break.

Why

The codebase had identical utility functions copy-pasted across subsystems. This creates maintenance risk: a bugfix in one copy doesn't propagate, and slightly different implementations (e.g. escapeHtml in secrets/form-page.ts missing ' escaping) can introduce subtle inconsistencies. Centralizing these into src/shared/strings.ts and src/chat/page-tools.ts gives a single place to maintain each pattern.

How I Tested

bun test         # 2640 pass, 0 fail
bun run lint     # clean
bun run typecheck # clean

Checklist

• Tests pass (bun test)
• Lint passes (bun run lint)
• Typecheck passes (bun run typecheck)
• No secrets or .env files included
• Files stay under 300 lines
• No Cardinal Rule violations (TypeScript does plumbing only, the Agent SDK does reasoning)
• No default exports or barrel files added

Link to Devin session: https://app.devin.ai/sessions/5fa2d0c4926149aa9cd093df6997936a
Requested by: @mcheemaa

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring