@automattic/vip 4.1.2 → 4.1.4

package/internal/update/github.go

@@ -64,24 +64,26 @@ func (g GitHub) Releases(ctx context.Context) ([]Release, error) {
 		}
 		releases = append(releases, batch...)
 		next := 0
-		for _, part := range strings.Split(resp.Header.Get("Link"), ",") {
-			if !strings.Contains(part, `rel="next"`) {
-				continue
+		for _, value := range resp.Header.Values("Link") {
+			for _, part := range strings.Split(value, ",") {
+				if !strings.Contains(part, `rel="next"`) {
+					continue
+				}
+				left, right := strings.Index(part, "<"), strings.Index(part, ">")
+				if left < 0 || right <= left {
+					return nil, fmt.Errorf("invalid release pagination")
+				}
+				u, err := url.Parse(part[left+1 : right])
+				if err != nil {
+					return nil, fmt.Errorf("invalid release pagination")
+				}
+				u = origin.ResolveReference(u)
+				n, err := strconv.Atoi(u.Query().Get("page"))
+				if err != nil || n <= page || u.Scheme != origin.Scheme || u.Host != origin.Host || !isReleasePaginationPath(u.EscapedPath()) || u.User != nil || next != 0 {
+					return nil, fmt.Errorf("invalid release pagination")
+				}
+				next = n
 			}
-			left, right := strings.Index(part, "<"), strings.Index(part, ">")
-			if left < 0 || right <= left {
-				return nil, fmt.Errorf("invalid release pagination")
-			}
-			u, err := url.Parse(part[left+1 : right])
-			if err != nil {
-				return nil, fmt.Errorf("invalid release pagination")
-			}
-			u = origin.ResolveReference(u)
-			n, err := strconv.Atoi(u.Query().Get("page"))
-			if err != nil || n <= page || u.Scheme != origin.Scheme || u.Host != origin.Host || u.Path != "/repos/"+Repository+"/releases" || u.User != nil || next != 0 {
-				return nil, fmt.Errorf("invalid release pagination")
-			}
-			next = n
 		}
 		if next == 0 {
 			return releases, nil
@@ -90,6 +92,23 @@ func (g GitHub) Releases(ctx context.Context) ([]Release, error) {
 	}
 	return nil, fmt.Errorf("GitHub release pagination limit exceeded")
 }
+
+func isReleasePaginationPath(path string) bool {
+	if path == "/repos/"+Repository+"/releases" {
+		return true
+	}
+	repositoryID, ok := strings.CutPrefix(path, "/repositories/")
+	if !ok {
+		return false
+	}
+	repositoryID, ok = strings.CutSuffix(repositoryID, "/releases")
+	if !ok {
+		return false
+	}
+	id, err := strconv.ParseUint(repositoryID, 10, 64)
+	return err == nil && id > 0
+}
+
 func readBounded(r io.Reader, max int64) ([]byte, error) {
 	b, err := io.ReadAll(io.LimitReader(r, max+1))
 	if err != nil {

package/internal/update/ownership.go

@@ -24,6 +24,28 @@ func inspectOwnership(ctx context.Context, l Layout, goos string, query ownershi
 	ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
 	defer cancel()
 	for _, target := range []string{l.CLI, l.Helper} {
+		if goos == "darwin" || goos == "windows" {
+			markerPath := filepath.Join(filepath.Dir(target), ".vip-next-installer.json")
+			if _, err := regularFile(markerPath); err == nil {
+				var marker struct {
+					Schema  int    `json:"schema"`
+					Manager string `json:"manager"`
+				}
+				if err := readJSON(markerPath, 4096, &marker); err != nil {
+					return Ownership{}, fmt.Errorf("read installer ownership: %w", err)
+				}
+				manager := "pkg"
+				if goos == "windows" {
+					manager = "msi"
+				}
+				if marker.Schema != 1 || marker.Manager != manager {
+					return Ownership{}, fmt.Errorf("invalid installer ownership record: %s", markerPath)
+				}
+				return Ownership{true, "This installation is managed by the VIP CLI installer. Download and run the latest ." + manager + " installer for your platform from " + ReleasesURL}, nil
+			} else if !os.IsNotExist(err) {
+				return Ownership{}, fmt.Errorf("inspect installer ownership: %w", err)
+			}
+		}
 		normalized := filepath.ToSlash(target)
 		switch goos {
 		case "darwin":

package/internal/update/ownership_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -38,6 +39,49 @@ func TestOwnershipUsesReceiptsAndFailsClosed(t *testing.T) {
 		t.Fatal("bare /usr/local/bin misclassified", o, err)
 	}
 }
+
+func TestNativeInstallerOwnership(t *testing.T) {
+	for _, platform := range []struct{ os, manager, extension string }{{"darwin", "pkg", ".pkg"}, {"windows", "msi", ".msi"}} {
+		t.Run(platform.os, func(t *testing.T) {
+			for _, helperMarker := range []bool{false, true} {
+				dir := t.TempDir()
+				helperDir := filepath.Join(dir, "bin")
+				if err := os.Mkdir(helperDir, 0755); err != nil {
+					t.Fatal(err)
+				}
+				l := Layout{filepath.Join(dir, "vip-next"), filepath.Join(helperDir, "go-search-replace")}
+				markerDir := dir
+				if helperMarker {
+					markerDir = helperDir
+				}
+				q := func(context.Context, string, ...string) ([]byte, error) {
+					t.Fatal("unexpected external query")
+					return nil, nil
+				}
+				o, err := inspectOwnership(context.Background(), l, platform.os, q)
+				if err != nil || o.Managed {
+					t.Fatal("portable install misclassified", o, err)
+				}
+				marker := filepath.Join(markerDir, ".vip-next-installer.json")
+				if err := os.WriteFile(marker, []byte(`{"schema":1,"manager":"`+platform.manager+`"}`), 0644); err != nil {
+					t.Fatal(err)
+				}
+				o, err = inspectOwnership(context.Background(), l, platform.os, q)
+				if err != nil || !o.Managed || !strings.Contains(o.Instructions, platform.extension) || !strings.Contains(o.Instructions, ReleasesURL) {
+					t.Fatal(o, err)
+				}
+				for _, contents := range []string{"{", `{"schema":2,"manager":"pkg"}`, `{"schema":1,"manager":"unknown"}`} {
+					if err := os.WriteFile(marker, []byte(contents), 0644); err != nil {
+						t.Fatal(err)
+					}
+					if _, err := inspectOwnership(context.Background(), l, platform.os, q); err == nil {
+						t.Fatal("invalid marker accepted", contents)
+					}
+				}
+			}
+		})
+	}
+}
 func TestResolveLayoutPreservesEntrypointSymlink(t *testing.T) {
 	l, _ := installFixture(t)
 	link := filepath.Join(t.TempDir(), "vip")

package/internal/update/release_test.go

@@ -87,33 +87,73 @@ func TestSelectRejectsIncompleteAndInconsistentReleases(t *testing.T) {
 	}
 }
 func TestGitHubPagination(t *testing.T) {
+	for _, tc := range []struct {
+		name, nextPath string
+	}{{"named repository", "/repos/Automattic/vip-cli/releases"}, {"numeric repository ID", "/repositories/116313791/releases"}} {
+		t.Run(tc.name, func(t *testing.T) {
+			calls := 0
+			s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				calls++
+				if r.Header.Get("Authorization") != "" {
+					t.Error("credentials")
+				}
+				if r.URL.Path != "/repos/Automattic/vip-cli/releases" {
+					t.Error(r.URL.Path)
+				}
+				if r.URL.Query().Get("page") == "1" {
+					w.Header().Set("Link", "<http://"+r.Host+tc.nextPath+"?per_page=100&page=2>; rel=\"next\"")
+					fmt.Fprint(w, `[{"tag_name":"4.9.0"}]`)
+				} else {
+					fmt.Fprint(w, `[{"tag_name":"5.0.0"}]`)
+				}
+			}))
+			defer s.Close()
+			rs, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
+			if err != nil || len(rs) != 2 || calls != 2 {
+				t.Fatal(rs, err, calls)
+			}
+		})
+	}
+}
+
+func TestGitHubRejectsDuplicateNextLinkHeaders(t *testing.T) {
 	calls := 0
 	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		calls++
-		if r.Header.Get("Authorization") != "" {
-			t.Error("credentials")
-		}
-		if r.URL.Path != "/repos/Automattic/vip-cli/releases" {
-			t.Error(r.URL.Path)
+		if r.URL.Query().Get("page") == "1" {
+			w.Header().Add("Link", "<http://"+r.Host+"/repositories/116313791/releases?page=2>; rel=\"next\"")
+			w.Header().Add("Link", "<http://"+r.Host+"/repositories/116313791/releases?page=3>; rel=\"next\"")
 		}
+		fmt.Fprint(w, `[]`)
+	}))
+	defer s.Close()
+	_, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
+	if err == nil || calls != 1 {
+		t.Fatal(err, calls)
+	}
+}
+
+func TestGitHubRejectsEncodedReleasePaginationSeparator(t *testing.T) {
+	calls := 0
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
 		if r.URL.Query().Get("page") == "1" {
-			w.Header().Set("Link", "<http://"+r.Host+"/repos/Automattic/vip-cli/releases?per_page=100&page=2>; rel=\"next\"")
-			fmt.Fprint(w, `[{"tag_name":"4.9.0"}]`)
-		} else {
-			fmt.Fprint(w, `[{"tag_name":"5.0.0"}]`)
+			w.Header().Set("Link", "<http://"+r.Host+"/repositories/116313791%2Freleases?page=2>; rel=\"next\"")
 		}
+		fmt.Fprint(w, `[]`)
 	}))
 	defer s.Close()
-	rs, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
-	if err != nil || len(rs) != 2 || calls != 2 {
-		t.Fatal(rs, err, calls)
+	_, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
+	if err == nil || calls != 1 {
+		t.Fatal(err, calls)
 	}
 }
+
 func TestGitHubErrors(t *testing.T) {
 	for _, tc := range []struct {
 		status     int
 		body, link string
-	}{{429, `{}`, ""}, {200, `broken`, ""}, {200, `[]`, `<https://evil.invalid/next>; rel="next"`}, {200, `[]`, `</repos/Automattic/vip-cli/releases?page=1>; rel="next"`}} {
+	}{{429, `{}`, ""}, {200, `broken`, ""}, {200, `[]`, `<https://evil.invalid/next>; rel="next"`}, {200, `[]`, `</repositories/not-a-number/releases?page=2>; rel="next"`}, {200, `[]`, `</repos/Automattic/vip-cli/releases?page=1>; rel="next"`}} {
 		s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			w.Header().Set("Link", tc.link)
 			w.WriteHeader(tc.status)

package/internal/update/service_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -28,6 +29,44 @@ func TestServiceCheckAndChannelPersistence(t *testing.T) {
 		t.Fatal("failed check changed channel")
 	}
 }
+
+func TestServiceNativeInstallerNeverDownloadsOrReplaces(t *testing.T) {
+	for _, manager := range []string{"pkg", "msi"} {
+		t.Run(manager, func(t *testing.T) {
+			l, _ := installFixture(t)
+			before, err := os.ReadFile(l.CLI)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(filepath.Join(filepath.Dir(l.CLI), ".vip-next-installer.json"), []byte(`{"schema":1,"manager":"`+manager+`"}`), 0644); err != nil {
+				t.Fatal(err)
+			}
+			s := Service{Installed: "5.0.0", Platform: Platform{"linux", "amd64"}, State: State{CacheDir: t.TempDir(), ConfigDir: t.TempDir()}, Executable: func() (string, error) { return l.CLI, nil }, Fetch: func(context.Context) ([]Release, error) { return []Release{release("5.0.1")}, nil }}
+			s.Installer.InspectOwnership = func(ctx context.Context, layout Layout) (Ownership, error) {
+				platform := "darwin"
+				if manager == "msi" {
+					platform = "windows"
+				}
+				return inspectOwnership(ctx, layout, platform, func(context.Context, string, ...string) ([]byte, error) { t.Fatal("unexpected query"); return nil, nil })
+			}
+			s.Stage = func(context.Context, Candidate, Platform, string) (Bundle, error) {
+				t.Fatal("installer-managed binaries must not be downloaded")
+				return Bundle{}, nil
+			}
+			out, err := s.Run(context.Background(), Request{}, nil)
+			if err != nil || out.Updated || !strings.Contains(out.Instructions, "."+manager) {
+				t.Fatal(out, err)
+			}
+			after, err := os.ReadFile(l.CLI)
+			if err != nil || string(before) != string(after) {
+				t.Fatal("installed bytes changed", err)
+			}
+			if _, err := os.Stat(markerPath(l)); !os.IsNotExist(err) {
+				t.Fatal("created an update recovery record", err)
+			}
+		})
+	}
+}
 func TestServiceStableAheadAndManagedInstall(t *testing.T) {
 	s := Service{Installed: "5.1.0-beta.1", Platform: Platform{"linux", "amd64"}, State: State{CacheDir: t.TempDir(), ConfigDir: t.TempDir()}, Now: time.Now, Fetch: func(context.Context) ([]Release, error) { return []Release{release("5.0.0")}, nil }}
 	out, err := s.Run(context.Background(), Request{Channel: Stable, ExplicitChannel: true}, nil)

package/internal/upload/debug_test.go

@@ -0,0 +1,76 @@
+package upload
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestUploadDebugSummarizesWithoutFileContentsOrCredentials(t *testing.T) {
+	for _, compress := range []bool{false, true} {
+		t.Run(map[bool]string{false: "plain", true: "compressed"}[compress], func(t *testing.T) {
+			c := stubPresignServer(t, func(w http.ResponseWriter, r *http.Request) {
+				_, _ = io.Copy(io.Discard, r.Body)
+				_, _ = w.Write([]byte("RESPONSE_SECRET"))
+			})
+			c.Token = "TOKEN_SECRET"
+			content := []byte("SQL_SECRET")
+			if compress {
+				content = bytes.Repeat(content, int(CompressThreshold)/len(content)+1)
+			}
+			meta, err := GetFileMeta(writeTemp(t, "PATH_SECRET.sql", content))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var logs bytes.Buffer
+			res, err := c.UploadImportFile(debuglog.WithLogger(context.Background(), "vip:lib/client-file-uploader", &logs), 1, 2, meta, "md5", nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if compress {
+				defer os.RemoveAll(filepath.Dir(res.Meta.FileName))
+			}
+			for _, want := range []string{"bytes=", "checksum", "PutObject", "Upload complete"} {
+				if !strings.Contains(logs.String(), want) {
+					t.Errorf("missing %q in %q", want, logs.String())
+				}
+			}
+			if compress && !strings.Contains(logs.String(), "Compression complete") {
+				t.Errorf("missing compression diagnostic: %s", &logs)
+			}
+			for _, secret := range []string{"SQL_SECRET", "PATH_SECRET", "TOKEN_SECRET", "RESPONSE_SECRET", res.Checksum} {
+				if strings.Contains(logs.String(), secret) {
+					t.Errorf("leaked %q", secret)
+				}
+			}
+		})
+	}
+}
+
+func TestMultipartDebugReportsPartCountWithoutUploadIdentifiers(t *testing.T) {
+	_, c := newMultipartTest(t)
+	meta, err := GetFileMeta(writeTemp(t, "PATH_SECRET.sql", bytes.Repeat([]byte("x"), 40)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var logs bytes.Buffer
+	_, err = c.uploadUsingMultipart(debuglog.WithLogger(context.Background(), "vip:lib/client-file-uploader", &logs), 1, 2, meta, 16, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(logs.String(), "Multipart") || !strings.Contains(logs.String(), "parts=3") {
+		t.Errorf("missing strategy/count: %s", &logs)
+	}
+	for _, secret := range []string{"UPLOAD123", "etag-", "PATH_SECRET", c.APIHost} {
+		if strings.Contains(logs.String(), secret) {
+			t.Errorf("leaked %q", secret)
+		}
+	}
+}

package/internal/upload/multipart.go

@@ -10,6 +10,8 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // initiateResult is S3's CreateMultipartUpload response
@@ -66,6 +68,7 @@ func (c *Client) uploadUsingMultipart(ctx context.Context, appID, envID int64, m
 	if err != nil {
 		return "", err
 	}
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Uploading to S3 using Multipart: parts=%d concurrency=%d", len(parts), MaxConcurrentPartUploads)
 	etags, err := c.uploadParts(ctx, appID, envID, meta, init.UploadId, parts, progressCb)
 	if err != nil {
 		return "", err

package/internal/upload/orchestrate.go

@@ -6,6 +6,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // UploadResult mirrors uploadImportFileToS3's return
@@ -31,7 +33,10 @@ func gzRename(base string) string {
 //  2. checksum the (possibly compressed) file,
 //  3. PutObject below MultipartThreshold, multipart at/above it.
 func (c *Client) UploadImportFile(ctx context.Context, appID, envID int64, meta FileMeta, hashType string, progressCb func(string)) (*UploadResult, error) {
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "File: bytes=%d compressed=%t", meta.FileSize, meta.IsCompressed)
 	if !meta.IsCompressed && meta.FileSize >= CompressThreshold {
+		debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Compressing file prior to transfer")
+		originalSize := meta.FileSize
 		tmpDir, err := os.MkdirTemp("", "vip-client-file-uploader")
 		if err != nil {
 			return nil, fmt.Errorf("Unable to create temporary working directory: %s", err.Error())
@@ -48,16 +53,20 @@ func (c *Client) UploadImportFile(ctx context.Context, appID, envID int64, meta
 			return nil, err
 		}
 		meta.FileSize = fi.Size()
+		debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Compression complete: bytes=%d saved_bytes=%d", meta.FileSize, originalSize-meta.FileSize)
 	}
 
 	if hashType == "" {
 		hashType = "md5"
 	}
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Calculating file checksum")
 	checksum, err := FileHash(meta.FileName, hashType)
 	if err != nil {
 		return nil, err
 	}
 
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Calculated file checksum")
+
 	var result string
 	if meta.FileSize < MultipartThreshold {
 		result, err = c.uploadUsingPutObject(ctx, appID, envID, meta, progressCb)
@@ -67,5 +76,6 @@ func (c *Client) UploadImportFile(ctx context.Context, appID, envID int64, meta
 	if err != nil {
 		return nil, err
 	}
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Upload complete: bytes=%d", meta.FileSize)
 	return &UploadResult{Meta: meta, Checksum: checksum, Result: result}, nil
 }

package/internal/upload/putobject.go

@@ -7,6 +7,8 @@ import (
 	"net/http"
 	"os"
 	"sync/atomic"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // progressReader counts bytes read and reports floor(100*read/total)% via
@@ -42,6 +44,7 @@ func (rc readCloser) Close() error { return rc.closer.Close() }
 // (client-file-uploader.ts:255). Returns "ok" on HTTP 200, otherwise an
 // error wrapping the S3 <Error> payload.
 func (c *Client) uploadUsingPutObject(ctx context.Context, appID, envID int64, meta FileMeta, progressCb func(string)) (string, error) {
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Uploading to S3 using PutObject")
 	pre, err := c.GetSignedUploadRequestData(ctx, SignedRequestArgs{
 		Action: "PutObject", AppID: appID, EnvID: envID, BaseName: meta.BaseName,
 	})

package/internal/wpssh/debug_test.go

@@ -0,0 +1,67 @@
+package wpssh_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+	"github.com/Automattic/vip/internal/wpssh"
+)
+
+func TestSSHDiagnosticsPreserveOutputAndExcludeSessionData(t *testing.T) {
+	for _, enabled := range []bool{false, true} {
+		for _, code := range []int{0, 7} {
+			host, port := startEchoSSHServer(t, code)
+			key := testClientKeyPEM(t)
+			var out, diagnostics bytes.Buffer
+			selector := ""
+			if enabled {
+				selector = "@automattic/vip:wp/ssh"
+			}
+			ctx := debuglog.WithLogger(context.Background(), selector, &diagnostics)
+			err := wpssh.Run(ctx, wpssh.Auth{Host: host, Port: port, Username: "secret-user", PrivateKey: key, GUID: "secret-guid", InputToken: "secret-token"}, wpssh.Streams{Stdin: strings.NewReader(""), Stdout: &out, Stderr: io.Discard}, wpssh.Meta{Version: "test", Rows: 15, Columns: 100})
+			var ec *wpssh.ExitCodeError
+			if code == 0 && err != nil || code != 0 && (!errors.As(err, &ec) || ec.Code != code) {
+				t.Fatalf("exit %d: %v", code, err)
+			}
+			if out.String() != "GUID=secret-guid INPUT_TOKEN=secret-token VERSION=test ROWS=15 COLUMNS=100 TTY=false" {
+				t.Fatalf("stdout changed: %q", out.String())
+			}
+			if !enabled {
+				if diagnostics.Len() != 0 {
+					t.Fatalf("default diagnostics: %s", &diagnostics)
+				}
+				continue
+			}
+			for _, stage := range []string{"Connecting to SSH", "SSH connected", "SSH exit code="} {
+				if !strings.Contains(diagnostics.String(), stage) {
+					t.Errorf("missing %q in %q", stage, diagnostics.String())
+				}
+			}
+			for _, sensitive := range []string{host, port, "secret-user", key, "secret-guid", "secret-token", "GUID="} {
+				if strings.Contains(diagnostics.String(), sensitive) {
+					t.Errorf("diagnostics disclose session data %q", sensitive)
+				}
+			}
+		}
+	}
+}
+
+func TestSSHDiagnosticsKeyFailureDoesNotPrintKeyOrPassphrase(t *testing.T) {
+	var diagnostics bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "@automattic/vip:wp/ssh", &diagnostics)
+	err := wpssh.Run(ctx, wpssh.Auth{PrivateKey: "secret-private-key", Passphrase: "secret-passphrase"}, wpssh.Streams{}, wpssh.Meta{})
+	if err == nil {
+		t.Fatal("expected invalid key error")
+	}
+	if !strings.Contains(diagnostics.String(), "SSH authentication key rejected") {
+		t.Fatalf("missing stage: %q", diagnostics.String())
+	}
+	if strings.Contains(diagnostics.String(), "secret-") {
+		t.Fatalf("secret in diagnostics: %q", diagnostics.String())
+	}
+}

package/internal/wpssh/wpssh.go

@@ -12,6 +12,8 @@ import (
 	"net"
 
 	"golang.org/x/crypto/ssh"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // SSH_HANDSHAKE_TIMEOUT_MS matches the Node constant (wp-ssh.ts:22).
@@ -56,6 +58,7 @@ func (e *ExitCodeError) Error() string {
 func Run(ctx context.Context, auth Auth, streams Streams, meta Meta) error {
 	signer, err := parseSigner(auth.PrivateKey, auth.Passphrase)
 	if err != nil {
+		debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH authentication key rejected")
 		return fmt.Errorf("wpssh: parse private key: %w", err)
 	}
 
@@ -70,11 +73,13 @@ func Run(ctx context.Context, auth Auth, streams Streams, meta Meta) error {
 	}
 
 	addr := net.JoinHostPort(auth.Host, auth.Port)
+	debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "Connecting to SSH")
 	client, err := ssh.Dial("tcp", addr, cfg)
 	if err != nil {
 		return fmt.Errorf("wpssh: dial %s: %w", addr, err)
 	}
 	defer client.Close()
+	debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH connected")
 
 	session, err := client.NewSession()
 	if err != nil {
@@ -99,10 +104,12 @@ func Run(ctx context.Context, auth Auth, streams Streams, meta Meta) error {
 	if err := session.Run(cmd); err != nil {
 		var exitErr *ssh.ExitError
 		if errors.As(err, &exitErr) {
+			debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH exit code=%d", exitErr.ExitStatus())
 			return &ExitCodeError{Code: exitErr.ExitStatus(), GUID: auth.GUID}
 		}
 		return fmt.Errorf("wpssh: run: %w", err)
 	}
+	debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH exit code=0")
 	return nil
 }