@automattic/vip 4.1.3 → 4.1.5

package/internal/releasepromotion/contract_test.go

@@ -16,6 +16,8 @@ func TestValidateRequest(t *testing.T) {
 		{"5.0.0-beta.1", "refs/heads/trunk", true},
 		{"5.12.3-alpha.10", "refs/heads/trunk", true},
 		{"5.1.0-rc.2", "refs/heads/trunk", true},
+		{"5.0.0-beta.200", "refs/heads/trunk", true},
+		{"5.0.65-alpha.1", "refs/heads/trunk", true},
 		{"5.0.0", "refs/heads/trunk", false},
 		{"v5.0.0-beta.1", "refs/heads/trunk", false},
 		{"4.9.0-beta.1", "refs/heads/trunk", false},
@@ -34,6 +36,42 @@ func TestValidateRequest(t *testing.T) {
 	}
 }
 
+func TestManifestAllowsMissingInstallerPairs(t *testing.T) {
+	var artifacts []Artifact
+	for _, p := range ExpectedArtifactPaths() {
+		if strings.Contains(p, ".tar.gz") {
+			artifacts = append(artifacts, Artifact{Path: p, State: "finished"})
+		}
+	}
+	if _, err := ValidateArtifactManifest(artifacts); err != nil {
+		t.Fatal(err)
+	}
+	artifacts = append(artifacts, Artifact{Path: "dist/vip-next-windows-amd64.msi", State: "finished"}, Artifact{Path: "dist/vip-next-windows-amd64.msi.sha256", State: "finished"})
+	if _, err := ValidateArtifactManifest(artifacts); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestManifestRejectsPartialInstallerPairs(t *testing.T) {
+	for _, missing := range []string{
+		"dist/vip-next-darwin-amd64.pkg", "dist/vip-next-darwin-amd64.pkg.sha256",
+		"dist/vip-next-darwin-arm64.pkg", "dist/vip-next-darwin-arm64.pkg.sha256",
+		"dist/vip-next-windows-amd64.msi", "dist/vip-next-windows-amd64.msi.sha256",
+	} {
+		t.Run(missing, func(t *testing.T) {
+			var artifacts []Artifact
+			for _, p := range ExpectedArtifactPaths() {
+				if p != missing {
+					artifacts = append(artifacts, Artifact{Path: p, State: "finished"})
+				}
+			}
+			if _, err := ValidateArtifactManifest(artifacts); err == nil || !strings.Contains(err.Error(), missing) {
+				t.Fatalf("missing installer artifact accepted: %v", err)
+			}
+		})
+	}
+}
+
 func TestValidateArtifactManifest(t *testing.T) {
 	t.Parallel()
 	expected := ExpectedArtifactPaths()

package/internal/releasepromotion/github.go

@@ -172,14 +172,9 @@ func (c *GitHubClient) ReplaceAssets(ctx context.Context, release Release, root
 			return fmt.Errorf("unexpected existing asset %q on draft release", asset.Name)
 		}
 	}
-	for name := range expectedNames {
-		info, err := os.Stat(filepath.Join(root, name))
-		if err != nil {
-			return fmt.Errorf("read replacement asset %q: %w", name, err)
-		}
-		if !info.Mode().IsRegular() {
-			return fmt.Errorf("replacement asset %q is not a regular file", name)
-		}
+	paths, err := localArtifactPaths(root)
+	if err != nil {
+		return fmt.Errorf("read replacement assets: %w", err)
 	}
 
 	for _, asset := range release.Assets {
@@ -193,8 +188,7 @@ func (c *GitHubClient) ReplaceAssets(ctx context.Context, release Release, root
 	if uploadBase == "" {
 		uploadBase = fmt.Sprintf("%s/repos/%s/releases/%d/assets", c.uploadsURL(), GitHubRepository, release.ID)
 	}
-	for _, artifactPath := range expectedArtifactPaths {
-		name := filepath.Base(artifactPath)
+	for _, name := range paths {
 		if err := c.uploadAsset(ctx, uploadBase, name, filepath.Join(root, name)); err != nil {
 			return err
 		}

package/internal/releasepromotion/optional_installers_test.go

@@ -0,0 +1,87 @@
+package releasepromotion
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+)
+
+func TestDownloadVerifyAndReplaceWithOptionalInstallers(t *testing.T) {
+	for _, windowsInstaller := range []bool{false, true} {
+		name := "binaries-only"
+		if windowsInstaller {
+			name = "binaries-and-windows-installer"
+		}
+		t.Run(name, func(t *testing.T) {
+			fixtures := t.TempDir()
+			writeCompleteArtifactSet(t, fixtures)
+			var expected, uploaded []string
+			var artifacts []Artifact
+			var serverURL string
+			deleted := false
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				switch {
+				case strings.HasSuffix(r.URL.Path, "/artifacts"):
+					writeJSON(t, w, artifacts)
+				case strings.HasPrefix(r.URL.Path, "/download/"):
+					data, err := os.ReadFile(filepath.Join(fixtures, filepath.Base(r.URL.Path)))
+					if err != nil {
+						t.Error(err)
+						w.WriteHeader(404)
+						return
+					}
+					_, _ = w.Write(data)
+				case r.Method == http.MethodDelete:
+					deleted = true
+					w.WriteHeader(http.StatusNoContent)
+				case r.Method == http.MethodPost && r.URL.Path == "/uploads":
+					name := r.URL.Query().Get("name")
+					data, _ := io.ReadAll(r.Body)
+					original, err := os.ReadFile(filepath.Join(fixtures, name))
+					if err != nil || string(data) != string(original) {
+						t.Errorf("uploaded wrong bytes for %s: %v", name, err)
+					}
+					uploaded = append(uploaded, name)
+					w.WriteHeader(http.StatusCreated)
+				default:
+					t.Errorf("unexpected request %s %s", r.Method, r.URL)
+					w.WriteHeader(500)
+				}
+			}))
+			defer server.Close()
+			serverURL = server.URL
+			for _, p := range ExpectedArtifactPaths() {
+				if !strings.Contains(p, ".tar.gz") && !(windowsInstaller && strings.Contains(p, ".msi")) {
+					continue
+				}
+				expected = append(expected, filepath.Base(p))
+				artifacts = append(artifacts, Artifact{Path: p, State: "finished", DownloadURL: serverURL + "/download/" + filepath.Base(p)})
+			}
+			downloads := t.TempDir()
+			if err := testBuildkiteClient(server.URL).DownloadArtifacts(context.Background(), Build{Number: 28}, downloads); err != nil {
+				t.Fatal(err)
+			}
+			if err := VerifyDownloads(downloads); err != nil {
+				t.Fatal(err)
+			}
+			// A retry also removes an old optional installer from the draft when the
+			// current exact build did not produce it.
+			release := Release{ID: 1, Draft: true, UploadURL: server.URL + "/uploads{?name,label}", Assets: []ReleaseAsset{{ID: 9, Name: "vip-next-darwin-amd64.pkg"}}}
+			if err := testGitHubClient(server.URL).ReplaceAssets(context.Background(), release, downloads); err != nil {
+				t.Fatal(err)
+			}
+			sort.Strings(expected)
+			sort.Strings(uploaded)
+			if !deleted || !reflect.DeepEqual(expected, uploaded) {
+				t.Fatalf("deleted=%t uploaded=%v want=%v", deleted, uploaded, expected)
+			}
+		})
+	}
+}

package/internal/releasepromotion/verify.go

@@ -3,6 +3,7 @@ package releasepromotion
 import (
 	"archive/tar"
 	"bufio"
+	"bytes"
 	"compress/gzip"
 	"crypto/sha256"
 	"crypto/subtle"
@@ -20,8 +21,12 @@ var unixEntries = map[string]struct{}{"vip-next": {}, "go-search-replace": {}}
 var windowsEntries = map[string]struct{}{"vip-next.exe": {}, "go-search-replace.exe": {}}
 
 func VerifyDownloads(root string) error {
-	for _, artifactPath := range expectedArtifactPaths {
-		if !strings.HasSuffix(artifactPath, ".tar.gz") {
+	paths, err := localArtifactPaths(root)
+	if err != nil {
+		return err
+	}
+	for _, artifactPath := range paths {
+		if strings.HasSuffix(artifactPath, ".sha256") {
 			continue
 		}
 		archivePath := filepath.Join(root, filepath.Base(artifactPath))
@@ -29,6 +34,12 @@ func VerifyDownloads(root string) error {
 		if err := verifyChecksum(archivePath, checksumPath); err != nil {
 			return fmt.Errorf("verify %s: %w", filepath.Base(archivePath), err)
 		}
+		if !strings.HasSuffix(artifactPath, ".tar.gz") {
+			if err := verifyInstallerContainer(archivePath); err != nil {
+				return fmt.Errorf("verify %s: %w", filepath.Base(archivePath), err)
+			}
+			continue
+		}
 		expected := unixEntries
 		if strings.Contains(filepath.Base(archivePath), "-windows-") {
 			expected = windowsEntries
@@ -40,6 +51,33 @@ func VerifyDownloads(root string) error {
 	return nil
 }
 
+// Platform builders verify the actual payload and platform signature before
+// upload. This portable gate checks the container type as well as its checksum;
+// it is deliberately not a replacement for native PKG/MSI validation.
+func verifyInstallerContainer(name string) error {
+	f, err := os.Open(name)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	magic, minSize := []byte("xar!"), int64(28)
+	if strings.HasSuffix(name, ".msi") {
+		magic, minSize = []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, 512
+	}
+	info, err := f.Stat()
+	if err != nil {
+		return err
+	}
+	header := make([]byte, len(magic))
+	if _, err := io.ReadFull(f, header); err != nil {
+		return fmt.Errorf("truncated installer: %w", err)
+	}
+	if info.Size() < minSize || !bytes.Equal(header, magic) {
+		return fmt.Errorf("invalid installer container")
+	}
+	return nil
+}
+
 func verifyChecksum(archivePath, checksumPath string) error {
 	checksumFile, err := os.Open(checksumPath)
 	if err != nil {
@@ -140,3 +178,62 @@ func verifyArchive(archivePath string, expected map[string]struct{}) error {
 	}
 	return nil
 }
+
+// ExtractBinaryArchive verifies the checksum and strict two-file archive
+// contract before writing signed payload bytes for a downstream installer job.
+// The destination must be new; no existing installation can be overwritten.
+func ExtractBinaryArchive(platform, archivePath, destination string) error {
+	expected := unixEntries
+	switch platform {
+	case "darwin":
+	case "windows":
+		expected = windowsEntries
+	default:
+		return fmt.Errorf("unsupported installer platform %q", platform)
+	}
+	if err := verifyChecksum(archivePath, archivePath+".sha256"); err != nil {
+		return err
+	}
+	if err := verifyArchive(archivePath, expected); err != nil {
+		return err
+	}
+	if err := os.Mkdir(destination, 0700); err != nil {
+		return err
+	}
+	file, err := os.Open(archivePath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	gz, err := gzip.NewReader(file)
+	if err != nil {
+		return err
+	}
+	defer gz.Close()
+	reader := tar.NewReader(gz)
+	for {
+		header, err := reader.Next()
+		if err == io.EOF {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		// Recheck names/types on the extraction pass as well.
+		if _, ok := expected[header.Name]; !ok || (header.Typeflag != tar.TypeReg && header.Typeflag != tar.TypeRegA) {
+			return fmt.Errorf("invalid payload entry %q", header.Name)
+		}
+		out, err := os.OpenFile(filepath.Join(destination, header.Name), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0755)
+		if err != nil {
+			return err
+		}
+		_, copyErr := io.Copy(out, reader)
+		closeErr := out.Close()
+		if copyErr != nil {
+			return copyErr
+		}
+		if closeErr != nil {
+			return closeErr
+		}
+	}
+}

package/internal/releasepromotion/verify_test.go

@@ -34,6 +34,47 @@ func TestVerifyDownloads(t *testing.T) {
 	}
 }
 
+func TestVerifyDownloadsWithoutInstallers(t *testing.T) {
+	root := t.TempDir()
+	writeCompleteArtifactSet(t, root)
+	for _, p := range ExpectedArtifactPaths() {
+		if !strings.Contains(p, ".tar.gz") {
+			if err := os.Remove(filepath.Join(root, filepath.Base(p))); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	if err := VerifyDownloads(root); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestVerifyInstallerDownloads(t *testing.T) {
+	for _, name := range []string{"vip-next-darwin-amd64.pkg", "vip-next-darwin-arm64.pkg", "vip-next-windows-amd64.msi"} {
+		for _, mutation := range []string{"checksum", "format", "truncated"} {
+			t.Run(name+"/"+mutation, func(t *testing.T) {
+				root := t.TempDir()
+				writeCompleteArtifactSet(t, root)
+				file := filepath.Join(root, name)
+				if err := os.WriteFile(file, []byte("invalid installer"), 0600); err != nil {
+					t.Fatal(err)
+				}
+				if mutation == "truncated" {
+					if err := os.WriteFile(file, []byte("xar!"), 0600); err != nil {
+						t.Fatal(err)
+					}
+				}
+				if mutation != "checksum" {
+					writeChecksum(t, root, name, false, false)
+				}
+				if err := VerifyDownloads(root); err == nil || !strings.Contains(err.Error(), name) {
+					t.Fatalf("invalid installer accepted: %v", err)
+				}
+			})
+		}
+	}
+}
+
 func TestVerifyDownloadsRejectsInvalidArtifacts(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
@@ -103,6 +144,20 @@ func writeCompleteArtifactSet(t *testing.T, root string) {
 			continue
 		}
 		archiveName := filepath.Base(artifactPath)
+		if strings.HasSuffix(archiveName, ".pkg") || strings.HasSuffix(archiveName, ".msi") {
+			// Container checks only; platform-native tests validate real payloads.
+			data := make([]byte, 512)
+			if strings.HasSuffix(archiveName, ".pkg") {
+				copy(data, "xar!")
+			} else {
+				copy(data, []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1})
+			}
+			if err := os.WriteFile(filepath.Join(root, archiveName), data, 0600); err != nil {
+				t.Fatal(err)
+			}
+			writeChecksum(t, root, archiveName, false, false)
+			continue
+		}
 		entries := []archiveEntry{{name: "vip-next", typeflag: tar.TypeReg}, {name: "go-search-replace", typeflag: tar.TypeReg}}
 		if strings.Contains(archiveName, "windows") {
 			entries = []archiveEntry{{name: "vip-next.exe", typeflag: tar.TypeReg}, {name: "go-search-replace.exe", typeflag: tar.TypeReg}}
@@ -195,3 +250,47 @@ func writeChecksum(t *testing.T, root, archiveName string, includeDist, uppercas
 		t.Fatal(err)
 	}
 }
+
+func TestExtractBinaryArchive(t *testing.T) {
+	for _, platform := range []string{"darwin", "windows"} {
+		t.Run(platform, func(t *testing.T) {
+			root := t.TempDir()
+			writeCompleteArtifactSet(t, root)
+			archive := filepath.Join(root, "vip-next-"+platform+"-amd64.tar.gz")
+			destination := filepath.Join(root, "payload")
+			if err := ExtractBinaryArchive(platform, archive, destination); err != nil {
+				t.Fatal(err)
+			}
+			expected := unixEntries
+			if platform == "windows" {
+				expected = windowsEntries
+			}
+			for name := range expected {
+				got, err := os.ReadFile(filepath.Join(destination, name))
+				if err != nil || string(got) != "x" {
+					t.Fatalf("payload %s = %q, %v", name, got, err)
+				}
+			}
+			if err := ExtractBinaryArchive(platform, archive, destination); err == nil {
+				t.Fatal("overwrote existing destination")
+			}
+		})
+	}
+}
+
+func TestExtractBinaryArchiveRejectsInvalidPayloadBeforeWriting(t *testing.T) {
+	for _, mutation := range []fixtureMutation{corruptChecksum, addReadmeEntry, addNestedVIPNext, replaceVIPNextWithSymlink} {
+		t.Run(fmt.Sprint(mutation), func(t *testing.T) {
+			root := t.TempDir()
+			writeCompleteArtifactSet(t, root)
+			applyFixtureMutation(t, root, mutation)
+			destination := filepath.Join(root, "payload")
+			if err := ExtractBinaryArchive("darwin", filepath.Join(root, "vip-next-darwin-amd64.tar.gz"), destination); err == nil {
+				t.Fatal("invalid archive accepted")
+			}
+			if _, err := os.Stat(destination); !os.IsNotExist(err) {
+				t.Fatalf("destination created before validation: %v", err)
+			}
+		})
+	}
+}

package/internal/searchreplace/debug_test.go

@@ -0,0 +1,71 @@
+package searchreplace
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestRunContextReportsRoutesWithoutSensitiveValues(t *testing.T) {
+	for _, mode := range []string{"in-place", "temporary-file", "file"} {
+		t.Run(mode, func(t *testing.T) {
+			t.Setenv("VIP_SEARCH_REPLACE_BIN", fakeBinary(t))
+			input := write(t, "private-input.sql", "-- metadata.header 1\n-- private_table 123\n")
+			opts := Options{InPlace: mode == "in-place"}
+			if mode == "file" {
+				opts.Output = filepath.Join(t.TempDir(), "private-output.sql")
+			}
+			var diagnostics bytes.Buffer
+			ctx := debuglog.WithLogger(context.Background(), "@automattic/vip:lib:search-and-replace", &diagnostics)
+			result, err := RunContext(ctx, input, []string{"private-search,private-replacement"}, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if mode == "temporary-file" {
+				t.Cleanup(func() { _ = os.RemoveAll(filepath.Dir(result.OutputFileName)) })
+			}
+			got, err := os.ReadFile(result.OutputFileName)
+			if err != nil || !strings.Contains(string(got), "-- PRIVATE_TABLE -1") {
+				t.Fatalf("mydumper output=%q err=%v", got, err)
+			}
+			log := diagnostics.String()
+			for _, want := range []string{"input=file", "output=" + mode, "stage=started", "mydumper=true", "stage=completed"} {
+				if !strings.Contains(log, want) {
+					t.Errorf("missing %q in %q", want, log)
+				}
+			}
+			for _, secret := range []string{input, result.OutputFileName, "private-", "PRIVATE_TABLE", "metadata.header"} {
+				if strings.Contains(log, secret) {
+					t.Errorf("diagnostics expose %q: %q", secret, log)
+				}
+			}
+		})
+	}
+}
+
+func TestRunContextDoesNotReportCompletionWhenCompanionFails(t *testing.T) {
+	t.Setenv("VIP_SEARCH_REPLACE_BIN", failingBinary(t))
+	input := write(t, "private-input.sql", "private_sql\n")
+	var diagnostics bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "*", &diagnostics)
+	_, err := RunContext(ctx, input, []string{"private-search,private-replacement"}, Options{InPlace: true})
+	if err == nil {
+		t.Fatal("expected companion failure")
+	}
+	log := diagnostics.String()
+	if !strings.Contains(log, "stage=started") || strings.Contains(log, "stage=completed") {
+		t.Fatalf("inaccurate stage diagnostics: %q", log)
+	}
+	if strings.Contains(log, "private") {
+		t.Fatalf("sensitive diagnostic: %q", log)
+	}
+	got, err := os.ReadFile(input)
+	if err != nil || string(got) != "private_sql\n" {
+		t.Fatalf("input changed: %q err=%v", got, err)
+	}
+}

package/internal/searchreplace/searchreplace.go

@@ -2,6 +2,7 @@ package searchreplace
 
 import (
 	"bufio"
+	"context"
 	"crypto/rand"
 	"encoding/hex"
 	"errors"
@@ -12,6 +13,8 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // InPlaceConfirmMessage is the prompt Node shows before an irreversible
@@ -93,6 +96,12 @@ func statExists(path string) bool {
 // files, stream input → go-search-replace → (optional mydumper fix) →
 // output.
 func Run(fileName string, pairs []string, opts Options) (*Result, error) {
+	return RunContext(context.Background(), fileName, pairs, opts)
+}
+
+// RunContext preserves invocation-scoped diagnostics while running the same
+// file pipeline as Run. Diagnostics deliberately omit paths and replacements.
+func RunContext(ctx context.Context, fileName string, pairs []string, opts Options) (*Result, error) {
 	// Node: if (!pairs.length) throw (ts:138)
 	if len(pairs) == 0 {
 		return nil, errors.New("No search and replace parameters provided.")
@@ -112,7 +121,9 @@ func Run(fileName string, pairs []string, opts Options) (*Result, error) {
 
 	inputPath := fileName
 	outputPath := opts.Output
+	outputMode := "file"
 	if opts.InPlace {
+		outputMode = "in-place"
 		// Node copies the input to a temp "midput" file first (ts:40-58) because
 		// it opens a write stream on the original immediately. We instead stage
 		// the result in a sibling temp file and rename it into place only on
@@ -120,6 +131,7 @@ func Run(fileName string, pairs []string, opts Options) (*Result, error) {
 		// read directly — no full extra copy of a multi-GB dump.
 		outputPath = fileName
 	} else if outputPath == "" {
+		outputMode = "temporary-file"
 		// Default: temp output file keeping the basename (ts:79-90).
 		tmpDir, err := os.MkdirTemp("", "vip-search-replace")
 		if err != nil {
@@ -127,6 +139,7 @@ func Run(fileName string, pairs []string, opts Options) (*Result, error) {
 		}
 		outputPath = filepath.Join(tmpDir, filepath.Base(fileName))
 	}
+	debuglog.Printf(ctx, "@automattic/vip:lib:search-and-replace", "stage=started input=file output=%s mydumper=%t", outputMode, details.Type == DumpTypeMyDumper)
 
 	bin, err := ResolveBinary()
 	if err != nil {
@@ -189,6 +202,7 @@ func Run(fileName string, pairs []string, opts Options) (*Result, error) {
 		return nil, err
 	}
 	committed = true
+	debuglog.Printf(ctx, "@automattic/vip:lib:search-and-replace", "stage=completed")
 
 	return &Result{InputFileName: fileName, OutputFileName: outputPath}, nil
 }

package/internal/siteimport/debug_test.go

@@ -0,0 +1,34 @@
+package siteimport
+
+import (
+	"bytes"
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Automattic/vip/internal/debuglog"
+	"github.com/Automattic/vip/internal/tui"
+)
+
+func TestStatusDebugSummarizesWithoutServerOutput(t *testing.T) {
+	var logs bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "vip:lib/site-import/status", &logs)
+	_, err := CheckStatus(ctx, CheckStatusOpts{Tracker: tui.NewProgressTracker(nil), Interval: time.Millisecond, Fetch: scriptedFetch([]ProgressSnapshot{
+		{Job: nil},
+		{Job: &ImportJob{Status: "SERVER_SECRET", CreatedAt: "2026-01-01T00:00:00Z", CompletedAt: "TIME_SECRET", Steps: []JobStep{{ID: "ID_SECRET", Name: "NAME_SECRET", Status: tui.StepFailed}}}, StatusProgressStartedAt: 1767225602, FailedStep: &FailedStep{Name: "STEP_SECRET", Output: []string{"SQL_SECRET"}, StartedAt: 1767225603}},
+	})})
+	if err == nil {
+		t.Fatal("expected failed import")
+	}
+	for _, want := range []string{"No import job", "status=unknown", "steps=1", "Import step failed"} {
+		if !strings.Contains(logs.String(), want) {
+			t.Errorf("missing %q in %s", want, &logs)
+		}
+	}
+	for _, secret := range []string{"SERVER_SECRET", "TIME_SECRET", "ID_SECRET", "NAME_SECRET", "STEP_SECRET", "SQL_SECRET"} {
+		if strings.Contains(logs.String(), secret) {
+			t.Errorf("leaked %q", secret)
+		}
+	}
+}

package/internal/siteimport/status.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/fatih/color"
 
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/tui"
 )
 
@@ -117,6 +118,7 @@ func CheckStatus(ctx context.Context, opts CheckStatusOpts) (*StatusResult, erro
 		}
 
 		if snap.Job == nil {
+			debuglog.Printf(ctx, "vip:lib/site-import/status", "No import job data available")
 			if opts.ReturnMissingJobImmediately {
 				// status.ts:329 — resolve('No import job found')
 				return &StatusResult{Message: "No import job found"}, nil
@@ -137,6 +139,14 @@ func CheckStatus(ctx context.Context, opts CheckStatusOpts) (*StatusResult, erro
 		}
 		createdAt := job.CreatedAt
 		completedAt := job.CompletedAt
+		// Server strings and command output can contain sensitive data. Only
+		// allow known status values into the diagnostic summary.
+		diagnosticStatus := "unknown"
+		switch jobStatus {
+		case "running", "success", "error", "failed", "completed":
+			diagnosticStatus = jobStatus
+		}
+		debuglog.Printf(ctx, "vip:lib/site-import/status", "Import job: status=%s steps=%d completed=%t", diagnosticStatus, len(job.Steps), completedAt != "")
 
 		// failedImportStep gate (status.ts:353-366): the import_progress
 		// meta is only pertinent when it started at/after job creation.
@@ -155,6 +165,7 @@ func CheckStatus(ctx context.Context, opts CheckStatusOpts) (*StatusResult, erro
 		}
 
 		if failed != nil {
+			debuglog.Printf(ctx, "vip:lib/site-import/status", "Import step failed: launched=%t", snap.Launched)
 			// status.ts:373 — demote the 'import' step to failed, render,
 			// then reject with the structured error.
 			steps := make([]JobStep, len(job.Steps))