@automattic/vip 4.1.3 → 4.1.4

package/internal/update/release_test.go

@@ -87,33 +87,73 @@ func TestSelectRejectsIncompleteAndInconsistentReleases(t *testing.T) {
 	}
 }
 func TestGitHubPagination(t *testing.T) {
+	for _, tc := range []struct {
+		name, nextPath string
+	}{{"named repository", "/repos/Automattic/vip-cli/releases"}, {"numeric repository ID", "/repositories/116313791/releases"}} {
+		t.Run(tc.name, func(t *testing.T) {
+			calls := 0
+			s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				calls++
+				if r.Header.Get("Authorization") != "" {
+					t.Error("credentials")
+				}
+				if r.URL.Path != "/repos/Automattic/vip-cli/releases" {
+					t.Error(r.URL.Path)
+				}
+				if r.URL.Query().Get("page") == "1" {
+					w.Header().Set("Link", "<http://"+r.Host+tc.nextPath+"?per_page=100&page=2>; rel=\"next\"")
+					fmt.Fprint(w, `[{"tag_name":"4.9.0"}]`)
+				} else {
+					fmt.Fprint(w, `[{"tag_name":"5.0.0"}]`)
+				}
+			}))
+			defer s.Close()
+			rs, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
+			if err != nil || len(rs) != 2 || calls != 2 {
+				t.Fatal(rs, err, calls)
+			}
+		})
+	}
+}
+
+func TestGitHubRejectsDuplicateNextLinkHeaders(t *testing.T) {
 	calls := 0
 	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		calls++
-		if r.Header.Get("Authorization") != "" {
-			t.Error("credentials")
-		}
-		if r.URL.Path != "/repos/Automattic/vip-cli/releases" {
-			t.Error(r.URL.Path)
+		if r.URL.Query().Get("page") == "1" {
+			w.Header().Add("Link", "<http://"+r.Host+"/repositories/116313791/releases?page=2>; rel=\"next\"")
+			w.Header().Add("Link", "<http://"+r.Host+"/repositories/116313791/releases?page=3>; rel=\"next\"")
 		}
+		fmt.Fprint(w, `[]`)
+	}))
+	defer s.Close()
+	_, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
+	if err == nil || calls != 1 {
+		t.Fatal(err, calls)
+	}
+}
+
+func TestGitHubRejectsEncodedReleasePaginationSeparator(t *testing.T) {
+	calls := 0
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
 		if r.URL.Query().Get("page") == "1" {
-			w.Header().Set("Link", "<http://"+r.Host+"/repos/Automattic/vip-cli/releases?per_page=100&page=2>; rel=\"next\"")
-			fmt.Fprint(w, `[{"tag_name":"4.9.0"}]`)
-		} else {
-			fmt.Fprint(w, `[{"tag_name":"5.0.0"}]`)
+			w.Header().Set("Link", "<http://"+r.Host+"/repositories/116313791%2Freleases?page=2>; rel=\"next\"")
 		}
+		fmt.Fprint(w, `[]`)
 	}))
 	defer s.Close()
-	rs, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
-	if err != nil || len(rs) != 2 || calls != 2 {
-		t.Fatal(rs, err, calls)
+	_, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
+	if err == nil || calls != 1 {
+		t.Fatal(err, calls)
 	}
 }
+
 func TestGitHubErrors(t *testing.T) {
 	for _, tc := range []struct {
 		status     int
 		body, link string
-	}{{429, `{}`, ""}, {200, `broken`, ""}, {200, `[]`, `<https://evil.invalid/next>; rel="next"`}, {200, `[]`, `</repos/Automattic/vip-cli/releases?page=1>; rel="next"`}} {
+	}{{429, `{}`, ""}, {200, `broken`, ""}, {200, `[]`, `<https://evil.invalid/next>; rel="next"`}, {200, `[]`, `</repositories/not-a-number/releases?page=2>; rel="next"`}, {200, `[]`, `</repos/Automattic/vip-cli/releases?page=1>; rel="next"`}} {
 		s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			w.Header().Set("Link", tc.link)
 			w.WriteHeader(tc.status)

package/internal/update/service_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -28,6 +29,44 @@ func TestServiceCheckAndChannelPersistence(t *testing.T) {
 		t.Fatal("failed check changed channel")
 	}
 }
+
+func TestServiceNativeInstallerNeverDownloadsOrReplaces(t *testing.T) {
+	for _, manager := range []string{"pkg", "msi"} {
+		t.Run(manager, func(t *testing.T) {
+			l, _ := installFixture(t)
+			before, err := os.ReadFile(l.CLI)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(filepath.Join(filepath.Dir(l.CLI), ".vip-next-installer.json"), []byte(`{"schema":1,"manager":"`+manager+`"}`), 0644); err != nil {
+				t.Fatal(err)
+			}
+			s := Service{Installed: "5.0.0", Platform: Platform{"linux", "amd64"}, State: State{CacheDir: t.TempDir(), ConfigDir: t.TempDir()}, Executable: func() (string, error) { return l.CLI, nil }, Fetch: func(context.Context) ([]Release, error) { return []Release{release("5.0.1")}, nil }}
+			s.Installer.InspectOwnership = func(ctx context.Context, layout Layout) (Ownership, error) {
+				platform := "darwin"
+				if manager == "msi" {
+					platform = "windows"
+				}
+				return inspectOwnership(ctx, layout, platform, func(context.Context, string, ...string) ([]byte, error) { t.Fatal("unexpected query"); return nil, nil })
+			}
+			s.Stage = func(context.Context, Candidate, Platform, string) (Bundle, error) {
+				t.Fatal("installer-managed binaries must not be downloaded")
+				return Bundle{}, nil
+			}
+			out, err := s.Run(context.Background(), Request{}, nil)
+			if err != nil || out.Updated || !strings.Contains(out.Instructions, "."+manager) {
+				t.Fatal(out, err)
+			}
+			after, err := os.ReadFile(l.CLI)
+			if err != nil || string(before) != string(after) {
+				t.Fatal("installed bytes changed", err)
+			}
+			if _, err := os.Stat(markerPath(l)); !os.IsNotExist(err) {
+				t.Fatal("created an update recovery record", err)
+			}
+		})
+	}
+}
 func TestServiceStableAheadAndManagedInstall(t *testing.T) {
 	s := Service{Installed: "5.1.0-beta.1", Platform: Platform{"linux", "amd64"}, State: State{CacheDir: t.TempDir(), ConfigDir: t.TempDir()}, Now: time.Now, Fetch: func(context.Context) ([]Release, error) { return []Release{release("5.0.0")}, nil }}
 	out, err := s.Run(context.Background(), Request{Channel: Stable, ExplicitChannel: true}, nil)

package/internal/upload/debug_test.go

@@ -0,0 +1,76 @@
+package upload
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestUploadDebugSummarizesWithoutFileContentsOrCredentials(t *testing.T) {
+	for _, compress := range []bool{false, true} {
+		t.Run(map[bool]string{false: "plain", true: "compressed"}[compress], func(t *testing.T) {
+			c := stubPresignServer(t, func(w http.ResponseWriter, r *http.Request) {
+				_, _ = io.Copy(io.Discard, r.Body)
+				_, _ = w.Write([]byte("RESPONSE_SECRET"))
+			})
+			c.Token = "TOKEN_SECRET"
+			content := []byte("SQL_SECRET")
+			if compress {
+				content = bytes.Repeat(content, int(CompressThreshold)/len(content)+1)
+			}
+			meta, err := GetFileMeta(writeTemp(t, "PATH_SECRET.sql", content))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var logs bytes.Buffer
+			res, err := c.UploadImportFile(debuglog.WithLogger(context.Background(), "vip:lib/client-file-uploader", &logs), 1, 2, meta, "md5", nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if compress {
+				defer os.RemoveAll(filepath.Dir(res.Meta.FileName))
+			}
+			for _, want := range []string{"bytes=", "checksum", "PutObject", "Upload complete"} {
+				if !strings.Contains(logs.String(), want) {
+					t.Errorf("missing %q in %q", want, logs.String())
+				}
+			}
+			if compress && !strings.Contains(logs.String(), "Compression complete") {
+				t.Errorf("missing compression diagnostic: %s", &logs)
+			}
+			for _, secret := range []string{"SQL_SECRET", "PATH_SECRET", "TOKEN_SECRET", "RESPONSE_SECRET", res.Checksum} {
+				if strings.Contains(logs.String(), secret) {
+					t.Errorf("leaked %q", secret)
+				}
+			}
+		})
+	}
+}
+
+func TestMultipartDebugReportsPartCountWithoutUploadIdentifiers(t *testing.T) {
+	_, c := newMultipartTest(t)
+	meta, err := GetFileMeta(writeTemp(t, "PATH_SECRET.sql", bytes.Repeat([]byte("x"), 40)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var logs bytes.Buffer
+	_, err = c.uploadUsingMultipart(debuglog.WithLogger(context.Background(), "vip:lib/client-file-uploader", &logs), 1, 2, meta, 16, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(logs.String(), "Multipart") || !strings.Contains(logs.String(), "parts=3") {
+		t.Errorf("missing strategy/count: %s", &logs)
+	}
+	for _, secret := range []string{"UPLOAD123", "etag-", "PATH_SECRET", c.APIHost} {
+		if strings.Contains(logs.String(), secret) {
+			t.Errorf("leaked %q", secret)
+		}
+	}
+}

package/internal/upload/multipart.go

@@ -10,6 +10,8 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // initiateResult is S3's CreateMultipartUpload response
@@ -66,6 +68,7 @@ func (c *Client) uploadUsingMultipart(ctx context.Context, appID, envID int64, m
 	if err != nil {
 		return "", err
 	}
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Uploading to S3 using Multipart: parts=%d concurrency=%d", len(parts), MaxConcurrentPartUploads)
 	etags, err := c.uploadParts(ctx, appID, envID, meta, init.UploadId, parts, progressCb)
 	if err != nil {
 		return "", err

package/internal/upload/orchestrate.go

@@ -6,6 +6,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // UploadResult mirrors uploadImportFileToS3's return
@@ -31,7 +33,10 @@ func gzRename(base string) string {
 //  2. checksum the (possibly compressed) file,
 //  3. PutObject below MultipartThreshold, multipart at/above it.
 func (c *Client) UploadImportFile(ctx context.Context, appID, envID int64, meta FileMeta, hashType string, progressCb func(string)) (*UploadResult, error) {
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "File: bytes=%d compressed=%t", meta.FileSize, meta.IsCompressed)
 	if !meta.IsCompressed && meta.FileSize >= CompressThreshold {
+		debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Compressing file prior to transfer")
+		originalSize := meta.FileSize
 		tmpDir, err := os.MkdirTemp("", "vip-client-file-uploader")
 		if err != nil {
 			return nil, fmt.Errorf("Unable to create temporary working directory: %s", err.Error())
@@ -48,16 +53,20 @@ func (c *Client) UploadImportFile(ctx context.Context, appID, envID int64, meta
 			return nil, err
 		}
 		meta.FileSize = fi.Size()
+		debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Compression complete: bytes=%d saved_bytes=%d", meta.FileSize, originalSize-meta.FileSize)
 	}
 
 	if hashType == "" {
 		hashType = "md5"
 	}
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Calculating file checksum")
 	checksum, err := FileHash(meta.FileName, hashType)
 	if err != nil {
 		return nil, err
 	}
 
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Calculated file checksum")
+
 	var result string
 	if meta.FileSize < MultipartThreshold {
 		result, err = c.uploadUsingPutObject(ctx, appID, envID, meta, progressCb)
@@ -67,5 +76,6 @@ func (c *Client) UploadImportFile(ctx context.Context, appID, envID int64, meta
 	if err != nil {
 		return nil, err
 	}
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Upload complete: bytes=%d", meta.FileSize)
 	return &UploadResult{Meta: meta, Checksum: checksum, Result: result}, nil
 }

package/internal/upload/putobject.go

@@ -7,6 +7,8 @@ import (
 	"net/http"
 	"os"
 	"sync/atomic"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // progressReader counts bytes read and reports floor(100*read/total)% via
@@ -42,6 +44,7 @@ func (rc readCloser) Close() error { return rc.closer.Close() }
 // (client-file-uploader.ts:255). Returns "ok" on HTTP 200, otherwise an
 // error wrapping the S3 <Error> payload.
 func (c *Client) uploadUsingPutObject(ctx context.Context, appID, envID int64, meta FileMeta, progressCb func(string)) (string, error) {
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Uploading to S3 using PutObject")
 	pre, err := c.GetSignedUploadRequestData(ctx, SignedRequestArgs{
 		Action: "PutObject", AppID: appID, EnvID: envID, BaseName: meta.BaseName,
 	})

package/internal/wpssh/debug_test.go

@@ -0,0 +1,67 @@
+package wpssh_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+	"github.com/Automattic/vip/internal/wpssh"
+)
+
+func TestSSHDiagnosticsPreserveOutputAndExcludeSessionData(t *testing.T) {
+	for _, enabled := range []bool{false, true} {
+		for _, code := range []int{0, 7} {
+			host, port := startEchoSSHServer(t, code)
+			key := testClientKeyPEM(t)
+			var out, diagnostics bytes.Buffer
+			selector := ""
+			if enabled {
+				selector = "@automattic/vip:wp/ssh"
+			}
+			ctx := debuglog.WithLogger(context.Background(), selector, &diagnostics)
+			err := wpssh.Run(ctx, wpssh.Auth{Host: host, Port: port, Username: "secret-user", PrivateKey: key, GUID: "secret-guid", InputToken: "secret-token"}, wpssh.Streams{Stdin: strings.NewReader(""), Stdout: &out, Stderr: io.Discard}, wpssh.Meta{Version: "test", Rows: 15, Columns: 100})
+			var ec *wpssh.ExitCodeError
+			if code == 0 && err != nil || code != 0 && (!errors.As(err, &ec) || ec.Code != code) {
+				t.Fatalf("exit %d: %v", code, err)
+			}
+			if out.String() != "GUID=secret-guid INPUT_TOKEN=secret-token VERSION=test ROWS=15 COLUMNS=100 TTY=false" {
+				t.Fatalf("stdout changed: %q", out.String())
+			}
+			if !enabled {
+				if diagnostics.Len() != 0 {
+					t.Fatalf("default diagnostics: %s", &diagnostics)
+				}
+				continue
+			}
+			for _, stage := range []string{"Connecting to SSH", "SSH connected", "SSH exit code="} {
+				if !strings.Contains(diagnostics.String(), stage) {
+					t.Errorf("missing %q in %q", stage, diagnostics.String())
+				}
+			}
+			for _, sensitive := range []string{host, port, "secret-user", key, "secret-guid", "secret-token", "GUID="} {
+				if strings.Contains(diagnostics.String(), sensitive) {
+					t.Errorf("diagnostics disclose session data %q", sensitive)
+				}
+			}
+		}
+	}
+}
+
+func TestSSHDiagnosticsKeyFailureDoesNotPrintKeyOrPassphrase(t *testing.T) {
+	var diagnostics bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "@automattic/vip:wp/ssh", &diagnostics)
+	err := wpssh.Run(ctx, wpssh.Auth{PrivateKey: "secret-private-key", Passphrase: "secret-passphrase"}, wpssh.Streams{}, wpssh.Meta{})
+	if err == nil {
+		t.Fatal("expected invalid key error")
+	}
+	if !strings.Contains(diagnostics.String(), "SSH authentication key rejected") {
+		t.Fatalf("missing stage: %q", diagnostics.String())
+	}
+	if strings.Contains(diagnostics.String(), "secret-") {
+		t.Fatalf("secret in diagnostics: %q", diagnostics.String())
+	}
+}

package/internal/wpssh/wpssh.go

@@ -12,6 +12,8 @@ import (
 	"net"
 
 	"golang.org/x/crypto/ssh"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // SSH_HANDSHAKE_TIMEOUT_MS matches the Node constant (wp-ssh.ts:22).
@@ -56,6 +58,7 @@ func (e *ExitCodeError) Error() string {
 func Run(ctx context.Context, auth Auth, streams Streams, meta Meta) error {
 	signer, err := parseSigner(auth.PrivateKey, auth.Passphrase)
 	if err != nil {
+		debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH authentication key rejected")
 		return fmt.Errorf("wpssh: parse private key: %w", err)
 	}
 
@@ -70,11 +73,13 @@ func Run(ctx context.Context, auth Auth, streams Streams, meta Meta) error {
 	}
 
 	addr := net.JoinHostPort(auth.Host, auth.Port)
+	debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "Connecting to SSH")
 	client, err := ssh.Dial("tcp", addr, cfg)
 	if err != nil {
 		return fmt.Errorf("wpssh: dial %s: %w", addr, err)
 	}
 	defer client.Close()
+	debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH connected")
 
 	session, err := client.NewSession()
 	if err != nil {
@@ -99,10 +104,12 @@ func Run(ctx context.Context, auth Auth, streams Streams, meta Meta) error {
 	if err := session.Run(cmd); err != nil {
 		var exitErr *ssh.ExitError
 		if errors.As(err, &exitErr) {
+			debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH exit code=%d", exitErr.ExitStatus())
 			return &ExitCodeError{Code: exitErr.ExitStatus(), GUID: auth.GUID}
 		}
 		return fmt.Errorf("wpssh: run: %w", err)
 	}
+	debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH exit code=0")
 	return nil
 }
 

package/internal/wpstream/debug_test.go

@@ -0,0 +1,116 @@
+package wpstream
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/Automattic/vip/internal/debuglog"
+	"github.com/coder/websocket"
+)
+
+// Exercise the real transport, including a server-requested retry and reconnect.
+func TestSocketDiagnosticsRetryAndExitExcludeSessionData(t *testing.T) {
+	for _, enabled := range []bool{false, true} {
+		var connections atomic.Int32
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Query().Get("transport") == "polling" {
+				fmt.Fprint(w, `0{"sid":"secret-session","upgrades":["websocket"],"pingInterval":20000,"pingTimeout":20000}`)
+				return
+			}
+			c, err := websocket.Accept(w, r, nil)
+			if err != nil {
+				return
+			}
+			defer c.CloseNow()
+			ctx := r.Context()
+			_, probe, err := c.Read(ctx)
+			if err != nil || string(probe) != "2probe" {
+				return
+			}
+			if c.Write(ctx, websocket.MessageText, []byte("3probe")) != nil {
+				return
+			}
+			if _, _, err = c.Read(ctx); err != nil {
+				return
+			}
+			if _, _, err = c.Read(ctx); err != nil {
+				return
+			}
+			if c.Write(ctx, websocket.MessageText, []byte("40/wp-cli,")) != nil {
+				return
+			}
+			attempt := connections.Add(1)
+			for {
+				_, data, err := c.Read(ctx)
+				if err != nil {
+					return
+				}
+				if !strings.Contains(string(data), `"cmd"`) {
+					continue
+				}
+				if attempt == 1 {
+					_ = c.Write(ctx, websocket.MessageText, []byte(`42/wp-cli,["retry",{"message":"secret-retry"}]`))
+					_ = c.Write(ctx, websocket.MessageText, []byte("41/wp-cli,"))
+				} else {
+					_ = c.Write(ctx, websocket.MessageText, []byte(`42/wp-cli,["exit",{"exitCode":7,"message":"secret-server-output"}]`))
+				}
+			}
+		}))
+		var stdout, diagnostics bytes.Buffer
+		selector := ""
+		if enabled {
+			selector = "@automattic/vip:wp"
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		res, err := Run(debuglog.WithLogger(ctx, selector, &diagnostics), Options{APIHost: srv.URL, Token: "secret-token", GUID: "secret-guid", InputToken: "secret-input", Stdin: strings.NewReader(""), Stdout: &stdout, Stderr: io.Discard})
+		cancel()
+		srv.Close()
+		if err != nil || res.ExitCode != 7 {
+			t.Fatalf("result=%+v err=%v", res, err)
+		}
+		if stdout.String() != "secret-server-output\n" {
+			t.Fatalf("stdout changed: %q", stdout.String())
+		}
+		if !enabled {
+			if diagnostics.Len() != 0 {
+				t.Fatalf("default diagnostics: %q", diagnostics.String())
+			}
+			continue
+		}
+		for _, stage := range []string{"socket: connect attempt=1", "socket: connected", "socket: retry", "socket.io: reconnect", "socket: connect attempt=2", "socket: exit code=7"} {
+			if !strings.Contains(diagnostics.String(), stage) {
+				t.Errorf("missing %q in %q", stage, diagnostics.String())
+			}
+		}
+		if strings.Contains(diagnostics.String(), "secret-") || strings.Contains(diagnostics.String(), srv.URL) {
+			t.Fatalf("session data in diagnostics: %q", diagnostics.String())
+		}
+	}
+}
+
+func TestSocketDiagnosticsConnectionErrorDoesNotPrintResponse(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "secret-server-error", http.StatusForbidden)
+	}))
+	defer srv.Close()
+	var diagnostics bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "@automattic/vip:wp", &diagnostics)
+	_, err := Run(ctx, Options{APIHost: srv.URL, Token: "secret-token"})
+	if err == nil {
+		t.Fatal("expected handshake error")
+	}
+	if !strings.Contains(diagnostics.String(), "socket: connect_error stage=transport") {
+		t.Fatalf("missing failure stage: %q", diagnostics.String())
+	}
+	if strings.Contains(diagnostics.String(), "secret-") || strings.Contains(diagnostics.String(), srv.URL) {
+		t.Fatalf("private data in diagnostics: %q", diagnostics.String())
+	}
+}

package/internal/wpstream/run.go

@@ -14,6 +14,8 @@ import (
 	"time"
 
 	"github.com/fatih/color"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 const (
@@ -61,12 +63,14 @@ func Run(ctx context.Context, opts Options) (Result, error) {
 	const maxBackoff = 5 * time.Second
 	first := true
 
-	for {
+	for attempt := 1; ; attempt++ {
+		debuglog.Printf(ctx, "@automattic/vip:wp", "socket: connect attempt=%d", attempt)
 		eng, err := Dial(ctx, DialOptions{
 			BaseURL: opts.APIHost,
 			Header:  bearerHeader(opts.Token),
 		})
 		if err != nil {
+			debuglog.Printf(ctx, "@automattic/vip:wp", "socket: connect_error stage=transport")
 			if first {
 				return Result{}, err
 			}
@@ -82,6 +86,7 @@ func Run(ctx context.Context, opts Options) (Result, error) {
 		// Install a retry handler: the server sends "retry" to signal it wants us to
 		// reconnect. We close the engine after 5 s to force the disconnect.
 		cli.On("retry", func(args []any) {
+			debuglog.Printf(ctx, "@automattic/vip:wp", "socket: retry")
 			go func() {
 				select {
 				case <-time.After(5 * time.Second):
@@ -93,6 +98,7 @@ func Run(ctx context.Context, opts Options) (Result, error) {
 		})
 
 		if err := cli.Connect(ctx); err != nil {
+			debuglog.Printf(ctx, "@automattic/vip:wp", "socket: connect_error stage=namespace")
 			eng.Close()
 			if first {
 				return Result{}, err
@@ -102,6 +108,7 @@ func Run(ctx context.Context, opts Options) (Result, error) {
 			}
 			continue
 		}
+		debuglog.Printf(ctx, "@automattic/vip:wp", "socket: connected")
 		first = false
 
 		res, clean := runOnce(ctx, opts, cli, ss, &offset, offset.Load())
@@ -114,6 +121,7 @@ func Run(ctx context.Context, opts Options) (Result, error) {
 			return res, nil
 		}
 
+		debuglog.Printf(ctx, "@automattic/vip:wp", "socket.io: reconnect")
 		// disconnected mid-command → wait then reconnect from offset
 		if werr := waitBackoff(ctx, &backoff, maxBackoff); werr != nil {
 			return Result{}, werr
@@ -168,6 +176,7 @@ func runOnce(ctx context.Context, opts Options, cli *Client, ss *StreamSocket, o
 	})
 	cli.On("exit", func(args []any) {
 		code, msg := parseExit(args)
+		debuglog.Printf(ctx, "@automattic/vip:wp", "socket: exit code=%d", code)
 		if msg != "" {
 			fmt.Fprintln(opts.Stdout, msg)
 		}