@automattic/vip 4.1.3 → 4.1.5

package/internal/telemetry/pendo.go

@@ -2,22 +2,26 @@ package telemetry
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
+	"errors"
+	"fmt"
 	"net/http"
 	"strings"
 	"time"
 
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/httpproxy"
 )
 
 // PendoClient posts analytics events to Pendo via the VIP API proxy.
 //
-// Node parity: mirrors src/lib/analytics/clients/pendo.ts exactly.
+// Node counterpart: src/lib/analytics/clients/pendo.ts.
 //
 // The Node client sends to Pendo.ENDPOINT = "/pendo" prefixed by API_HOST
 // (https://api.wpvip.com), so the full URL is https://api.wpvip.com/pendo.
-// Node attaches a bearer token via the shared http wrapper; Go telemetry
-// calls are fire-and-forget without auth (same approach as TracksClient).
+// Both runtimes authenticate through the current VIP session. Failures are
+// diagnostic only: Tracker deliberately does not fail the user's command.
 //
 // Payload shape (mirrors Node's send() method):
 //
@@ -44,6 +48,11 @@ type PendoClient struct {
 	EventPrefix string
 	// HTTP is the HTTP client; nil means a default 5-second-timeout client.
 	HTTP *http.Client
+	// GetToken reads the current session at send time, including login/logout
+	// changes. Missing credentials skip Pendo without starting a login flow.
+	GetToken func() (string, error)
+	// Context carries this invocation's opt-in diagnostics.
+	Context context.Context
 }
 
 // resolveUserID returns UserID if set, otherwise calls GetUserID().
@@ -84,8 +93,26 @@ type pendoPayload struct {
 
 // TrackEvent sends a single named event to Pendo.
 // The event name is auto-prefixed with EventPrefix if not already present.
-// Errors from the HTTP call are swallowed (Node returns false on error).
+// Delivery errors contain only safe summaries; Tracker ignores them.
 func (c *PendoClient) TrackEvent(name string, props map[string]any) error {
+	requestContext := c.Context
+	if requestContext == nil {
+		requestContext = context.Background()
+	}
+	const namespace = "@automattic/vip:analytics:clients:pendo"
+	fail := func(message string) error {
+		debuglog.Printf(requestContext, namespace, "%s", message)
+		return errors.New(message)
+	}
+	if c.GetToken == nil {
+		debuglog.Printf(requestContext, namespace, "Skipping event: no authenticated session")
+		return nil
+	}
+	token, err := c.GetToken()
+	if err != nil || token == "" {
+		debuglog.Printf(requestContext, namespace, "Skipping event: no authenticated session")
+		return nil
+	}
 	if !strings.HasPrefix(name, c.EventPrefix) {
 		name = c.EventPrefix + name
 	}
@@ -125,16 +152,16 @@ func (c *PendoClient) TrackEvent(name string, props map[string]any) error {
 
 	body, err := json.Marshal(payload)
 	if err != nil {
-		// Swallow, same as Node's catch block returning false.
-		return nil
+		return fail("Unable to encode event")
 	}
 
-	req, err := http.NewRequest("POST", c.Endpoint, bytes.NewReader(body))
+	req, err := http.NewRequestWithContext(requestContext, "POST", c.Endpoint, bytes.NewReader(body))
 	if err != nil {
-		return nil
+		return fail("Unable to construct request")
 	}
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("User-Agent", c.UserAgent)
+	req.Header.Set("Authorization", "Bearer "+token)
 
 	httpClient := c.HTTP
 	if httpClient == nil {
@@ -144,11 +171,15 @@ func (c *PendoClient) TrackEvent(name string, props map[string]any) error {
 		httpClient = httpproxy.ClientWithTimeout(5 * time.Second)
 	}
 
+	debuglog.Printf(requestContext, namespace, "Sending event")
 	resp, err := httpClient.Do(req)
 	if err != nil {
-		// Node: catch(error) { debug(error); return Promise.resolve(false) }
-		return nil
+		return fail("Request failed")
 	}
 	resp.Body.Close()
+	debuglog.Printf(requestContext, namespace, "Response status=%d", resp.StatusCode)
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fail(fmt.Sprintf("Request rejected: HTTP %d", resp.StatusCode))
+	}
 	return nil
 }

package/internal/telemetry/pendo_auth_test.go

@@ -0,0 +1,92 @@
+package telemetry
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestPendoTokenChangesAndRemoval(t *testing.T) {
+	var headers []string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		headers = append(headers, r.Header.Get("Authorization"))
+	}))
+	defer srv.Close()
+	token := "first-token"
+	c := &PendoClient{Endpoint: srv.URL, HTTP: srv.Client(), GetToken: func() (string, error) { return token, nil }}
+	for _, next := range []string{"first-token", "replacement-token", ""} {
+		token = next
+		if err := c.TrackEvent("test", nil); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if len(headers) != 2 || headers[0] != "Bearer first-token" || headers[1] != "Bearer replacement-token" {
+		t.Fatalf("authentication did not follow token changes: %v", headers)
+	}
+}
+
+func TestPendoMissingCredentialsSkipsRequestAndIdentityLookup(t *testing.T) {
+	for _, getToken := range []func() (string, error){nil, func() (string, error) { return "", nil }, func() (string, error) { return "", errors.New("PRIVATE_STORE_ERROR") }} {
+		var diagnostics bytes.Buffer
+		c := &PendoClient{
+			Endpoint: ":invalid", GetToken: getToken,
+			Context:   debuglog.WithLogger(context.Background(), "*", &diagnostics),
+			GetUserID: func() string { t.Fatal("no-token event accessed the identity store"); return "" },
+		}
+		if err := c.TrackEvent("test", nil); err != nil {
+			t.Fatal(err)
+		}
+		if !strings.Contains(diagnostics.String(), "Skipping event") || strings.Contains(diagnostics.String(), "PRIVATE_STORE_ERROR") {
+			t.Fatalf("unexpected diagnostics: %s", &diagnostics)
+		}
+	}
+}
+
+func TestPendoDiagnosticsAndNonfatalFailures(t *testing.T) {
+	for _, selector := range []string{"", "@automattic/vip:analytics:clients:pendo", "*,-@automattic/vip:analytics:clients:pendo"} {
+		t.Run(selector, func(t *testing.T) {
+			for _, name := range []string{"DO_NOT_TRACK", "GO_ENV", "NODE_ENV"} {
+				t.Setenv(name, "")
+			}
+			var diagnostics bytes.Buffer
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusUnauthorized)
+				_, _ = w.Write([]byte("PRIVATE_RESPONSE"))
+			}))
+			defer srv.Close()
+			pendo := &PendoClient{Endpoint: srv.URL, HTTP: srv.Client(), UserID: "PRIVATE_ID"}
+			other := &fakeClient{}
+			tr := &Tracker{Clients: []Client{pendo, other}}
+			tr.SetPendoTokenSource(func() (string, error) { return "PRIVATE_TOKEN", nil })
+			tr.SetContext(debuglog.WithLogger(context.Background(), selector, &diagnostics))
+			tr.TrackEvent("test", map[string]any{"value": "PRIVATE_PAYLOAD"})
+			if len(other.events) != 1 {
+				t.Fatal("Pendo failure prevented other telemetry")
+			}
+			if strings.Contains(diagnostics.String(), "PRIVATE_") {
+				t.Fatalf("private data in diagnostics: %s", &diagnostics)
+			}
+			wantLog := selector == "@automattic/vip:analytics:clients:pendo"
+			if strings.Contains(diagnostics.String(), "401") != wantLog {
+				t.Fatalf("missing or unfiltered status: %s", &diagnostics)
+			}
+		})
+	}
+}
+
+func TestPendoTrackingOptOutAvoidsCredentials(t *testing.T) {
+	for _, name := range []string{"DO_NOT_TRACK", "GO_ENV", "NODE_ENV"} {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv(name, "test")
+			tr := &Tracker{Clients: []Client{&PendoClient{}}}
+			tr.SetPendoTokenSource(func() (string, error) { t.Fatal("tracking opt-out accessed credentials"); return "", nil })
+			tr.TrackEvent("test", nil)
+		})
+	}
+}

package/internal/telemetry/pendo_test.go

@@ -26,6 +26,7 @@ func captureRequest(t *testing.T, c *PendoClient, name string, props map[string]
 	t.Cleanup(srv.Close)
 
 	c.Endpoint = srv.URL
+	c.GetToken = func() (string, error) { return "fixture-token", nil }
 	if err := c.TrackEvent(name, props); err != nil {
 		t.Fatalf("TrackEvent returned unexpected error: %v", err)
 	}
@@ -35,6 +36,22 @@ func captureRequest(t *testing.T, c *PendoClient, name string, props map[string]
 	return captured, capturedReq
 }
 
+func TestPendoRejectsHTTPFailure(t *testing.T) {
+	for _, status := range []int{401, 403, 429, 500} {
+		t.Run(http.StatusText(status), func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(status)
+				_, _ = w.Write([]byte("private response body"))
+			}))
+			defer srv.Close()
+			c := &PendoClient{Endpoint: srv.URL, HTTP: srv.Client(), UserID: "fixture", GetToken: func() (string, error) { return "fixture-token", nil }}
+			if err := c.TrackEvent("test", nil); err == nil {
+				t.Fatal("failed delivery was reported as successful")
+			}
+		})
+	}
+}
+
 // TestPendoClientPostsExpectedPayload verifies that TrackEvent sends a POST
 // with the correct JSON body matching Node's send() output: event name (prefixed),
 // type "track", visitorId, accountId, context fields, and properties.
@@ -173,17 +190,18 @@ func TestPendoClientOrgContextFields(t *testing.T) {
 	}
 }
 
-// TestPendoClientSwallowsNetworkError verifies that a network failure returns
-// nil (not an error), mirroring Node's catch block returning Promise.resolve(false).
-func TestPendoClientSwallowsNetworkError(t *testing.T) {
+// TestPendoClientReportsNetworkError verifies failures are observable to the
+// tracker without including raw transport errors or request data.
+func TestPendoClientReportsNetworkError(t *testing.T) {
 	c := &PendoClient{
+		GetToken:    func() (string, error) { return "fixture-token", nil },
 		Endpoint:    "http://127.0.0.1:1", // nothing listening
 		UserID:      "u",
 		UserAgent:   "x",
 		EventPrefix: TracksEventPrefix,
 	}
-	if err := c.TrackEvent("test", nil); err != nil {
-		t.Errorf("expected nil on network error (Node swallows errors), got %v", err)
+	if err := c.TrackEvent("test", nil); err == nil || err.Error() != "Request failed" {
+		t.Errorf("expected safe network error, got %v", err)
 	}
 }
 
@@ -198,6 +216,7 @@ func TestPendoClientLazyUserIDResolved(t *testing.T) {
 
 	c := &PendoClient{
 		Endpoint:    srv.URL,
+		GetToken:    func() (string, error) { return "fixture-token", nil },
 		GetUserID:   func() string { calls++; return "lazy-uuid" },
 		UserAgent:   "vip-next/test",
 		EventPrefix: TracksEventPrefix,

package/internal/telemetry/tracker.go

@@ -1,6 +1,7 @@
 package telemetry
 
 import (
+	"context"
 	"fmt"
 	"os"
 )
@@ -19,6 +20,31 @@ type Tracker struct {
 	Disabled  bool
 }
 
+// SetPendoTokenSource binds Pendo to the invocation's credential store before
+// login can emit events. Tracks has its own authentication scheme.
+func (t *Tracker) SetPendoTokenSource(getToken func() (string, error)) {
+	if t == nil {
+		return
+	}
+	for _, client := range t.Clients {
+		if pendo, ok := client.(*PendoClient); ok {
+			pendo.GetToken = getToken
+		}
+	}
+}
+
+// SetContext attaches the parsed command's diagnostics before command events.
+func (t *Tracker) SetContext(ctx context.Context) {
+	if t == nil {
+		return
+	}
+	for _, client := range t.Clients {
+		if pendo, ok := client.(*PendoClient); ok {
+			pendo.Context = ctx
+		}
+	}
+}
+
 // TrackEvent emits name with props to every configured Client.
 // It is a no-op when the tracker is disabled or DO_NOT_TRACK / test env vars are set.
 func (t *Tracker) TrackEvent(name string, props map[string]any) {

package/internal/update/github.go

@@ -64,24 +64,26 @@ func (g GitHub) Releases(ctx context.Context) ([]Release, error) {
 		}
 		releases = append(releases, batch...)
 		next := 0
-		for _, part := range strings.Split(resp.Header.Get("Link"), ",") {
-			if !strings.Contains(part, `rel="next"`) {
-				continue
+		for _, value := range resp.Header.Values("Link") {
+			for _, part := range strings.Split(value, ",") {
+				if !strings.Contains(part, `rel="next"`) {
+					continue
+				}
+				left, right := strings.Index(part, "<"), strings.Index(part, ">")
+				if left < 0 || right <= left {
+					return nil, fmt.Errorf("invalid release pagination")
+				}
+				u, err := url.Parse(part[left+1 : right])
+				if err != nil {
+					return nil, fmt.Errorf("invalid release pagination")
+				}
+				u = origin.ResolveReference(u)
+				n, err := strconv.Atoi(u.Query().Get("page"))
+				if err != nil || n <= page || u.Scheme != origin.Scheme || u.Host != origin.Host || !isReleasePaginationPath(u.EscapedPath()) || u.User != nil || next != 0 {
+					return nil, fmt.Errorf("invalid release pagination")
+				}
+				next = n
 			}
-			left, right := strings.Index(part, "<"), strings.Index(part, ">")
-			if left < 0 || right <= left {
-				return nil, fmt.Errorf("invalid release pagination")
-			}
-			u, err := url.Parse(part[left+1 : right])
-			if err != nil {
-				return nil, fmt.Errorf("invalid release pagination")
-			}
-			u = origin.ResolveReference(u)
-			n, err := strconv.Atoi(u.Query().Get("page"))
-			if err != nil || n <= page || u.Scheme != origin.Scheme || u.Host != origin.Host || u.Path != "/repos/"+Repository+"/releases" || u.User != nil || next != 0 {
-				return nil, fmt.Errorf("invalid release pagination")
-			}
-			next = n
 		}
 		if next == 0 {
 			return releases, nil
@@ -90,6 +92,23 @@ func (g GitHub) Releases(ctx context.Context) ([]Release, error) {
 	}
 	return nil, fmt.Errorf("GitHub release pagination limit exceeded")
 }
+
+func isReleasePaginationPath(path string) bool {
+	if path == "/repos/"+Repository+"/releases" {
+		return true
+	}
+	repositoryID, ok := strings.CutPrefix(path, "/repositories/")
+	if !ok {
+		return false
+	}
+	repositoryID, ok = strings.CutSuffix(repositoryID, "/releases")
+	if !ok {
+		return false
+	}
+	id, err := strconv.ParseUint(repositoryID, 10, 64)
+	return err == nil && id > 0
+}
+
 func readBounded(r io.Reader, max int64) ([]byte, error) {
 	b, err := io.ReadAll(io.LimitReader(r, max+1))
 	if err != nil {

package/internal/update/ownership.go

@@ -24,6 +24,28 @@ func inspectOwnership(ctx context.Context, l Layout, goos string, query ownershi
 	ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
 	defer cancel()
 	for _, target := range []string{l.CLI, l.Helper} {
+		if goos == "darwin" || goos == "windows" {
+			markerPath := filepath.Join(filepath.Dir(target), ".vip-next-installer.json")
+			if _, err := regularFile(markerPath); err == nil {
+				var marker struct {
+					Schema  int    `json:"schema"`
+					Manager string `json:"manager"`
+				}
+				if err := readJSON(markerPath, 4096, &marker); err != nil {
+					return Ownership{}, fmt.Errorf("read installer ownership: %w", err)
+				}
+				manager := "pkg"
+				if goos == "windows" {
+					manager = "msi"
+				}
+				if marker.Schema != 1 || marker.Manager != manager {
+					return Ownership{}, fmt.Errorf("invalid installer ownership record: %s", markerPath)
+				}
+				return Ownership{true, "This installation is managed by the VIP CLI installer. Download and run the latest ." + manager + " installer for your platform from " + ReleasesURL}, nil
+			} else if !os.IsNotExist(err) {
+				return Ownership{}, fmt.Errorf("inspect installer ownership: %w", err)
+			}
+		}
 		normalized := filepath.ToSlash(target)
 		switch goos {
 		case "darwin":

package/internal/update/ownership_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -38,6 +39,49 @@ func TestOwnershipUsesReceiptsAndFailsClosed(t *testing.T) {
 		t.Fatal("bare /usr/local/bin misclassified", o, err)
 	}
 }
+
+func TestNativeInstallerOwnership(t *testing.T) {
+	for _, platform := range []struct{ os, manager, extension string }{{"darwin", "pkg", ".pkg"}, {"windows", "msi", ".msi"}} {
+		t.Run(platform.os, func(t *testing.T) {
+			for _, helperMarker := range []bool{false, true} {
+				dir := t.TempDir()
+				helperDir := filepath.Join(dir, "bin")
+				if err := os.Mkdir(helperDir, 0755); err != nil {
+					t.Fatal(err)
+				}
+				l := Layout{filepath.Join(dir, "vip-next"), filepath.Join(helperDir, "go-search-replace")}
+				markerDir := dir
+				if helperMarker {
+					markerDir = helperDir
+				}
+				q := func(context.Context, string, ...string) ([]byte, error) {
+					t.Fatal("unexpected external query")
+					return nil, nil
+				}
+				o, err := inspectOwnership(context.Background(), l, platform.os, q)
+				if err != nil || o.Managed {
+					t.Fatal("portable install misclassified", o, err)
+				}
+				marker := filepath.Join(markerDir, ".vip-next-installer.json")
+				if err := os.WriteFile(marker, []byte(`{"schema":1,"manager":"`+platform.manager+`"}`), 0644); err != nil {
+					t.Fatal(err)
+				}
+				o, err = inspectOwnership(context.Background(), l, platform.os, q)
+				if err != nil || !o.Managed || !strings.Contains(o.Instructions, platform.extension) || !strings.Contains(o.Instructions, ReleasesURL) {
+					t.Fatal(o, err)
+				}
+				for _, contents := range []string{"{", `{"schema":2,"manager":"pkg"}`, `{"schema":1,"manager":"unknown"}`} {
+					if err := os.WriteFile(marker, []byte(contents), 0644); err != nil {
+						t.Fatal(err)
+					}
+					if _, err := inspectOwnership(context.Background(), l, platform.os, q); err == nil {
+						t.Fatal("invalid marker accepted", contents)
+					}
+				}
+			}
+		})
+	}
+}
 func TestResolveLayoutPreservesEntrypointSymlink(t *testing.T) {
 	l, _ := installFixture(t)
 	link := filepath.Join(t.TempDir(), "vip")

package/internal/update/release_test.go

@@ -87,33 +87,73 @@ func TestSelectRejectsIncompleteAndInconsistentReleases(t *testing.T) {
 	}
 }
 func TestGitHubPagination(t *testing.T) {
+	for _, tc := range []struct {
+		name, nextPath string
+	}{{"named repository", "/repos/Automattic/vip-cli/releases"}, {"numeric repository ID", "/repositories/116313791/releases"}} {
+		t.Run(tc.name, func(t *testing.T) {
+			calls := 0
+			s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				calls++
+				if r.Header.Get("Authorization") != "" {
+					t.Error("credentials")
+				}
+				if r.URL.Path != "/repos/Automattic/vip-cli/releases" {
+					t.Error(r.URL.Path)
+				}
+				if r.URL.Query().Get("page") == "1" {
+					w.Header().Set("Link", "<http://"+r.Host+tc.nextPath+"?per_page=100&page=2>; rel=\"next\"")
+					fmt.Fprint(w, `[{"tag_name":"4.9.0"}]`)
+				} else {
+					fmt.Fprint(w, `[{"tag_name":"5.0.0"}]`)
+				}
+			}))
+			defer s.Close()
+			rs, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
+			if err != nil || len(rs) != 2 || calls != 2 {
+				t.Fatal(rs, err, calls)
+			}
+		})
+	}
+}
+
+func TestGitHubRejectsDuplicateNextLinkHeaders(t *testing.T) {
 	calls := 0
 	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		calls++
-		if r.Header.Get("Authorization") != "" {
-			t.Error("credentials")
-		}
-		if r.URL.Path != "/repos/Automattic/vip-cli/releases" {
-			t.Error(r.URL.Path)
+		if r.URL.Query().Get("page") == "1" {
+			w.Header().Add("Link", "<http://"+r.Host+"/repositories/116313791/releases?page=2>; rel=\"next\"")
+			w.Header().Add("Link", "<http://"+r.Host+"/repositories/116313791/releases?page=3>; rel=\"next\"")
 		}
+		fmt.Fprint(w, `[]`)
+	}))
+	defer s.Close()
+	_, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
+	if err == nil || calls != 1 {
+		t.Fatal(err, calls)
+	}
+}
+
+func TestGitHubRejectsEncodedReleasePaginationSeparator(t *testing.T) {
+	calls := 0
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
 		if r.URL.Query().Get("page") == "1" {
-			w.Header().Set("Link", "<http://"+r.Host+"/repos/Automattic/vip-cli/releases?per_page=100&page=2>; rel=\"next\"")
-			fmt.Fprint(w, `[{"tag_name":"4.9.0"}]`)
-		} else {
-			fmt.Fprint(w, `[{"tag_name":"5.0.0"}]`)
+			w.Header().Set("Link", "<http://"+r.Host+"/repositories/116313791%2Freleases?page=2>; rel=\"next\"")
 		}
+		fmt.Fprint(w, `[]`)
 	}))
 	defer s.Close()
-	rs, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
-	if err != nil || len(rs) != 2 || calls != 2 {
-		t.Fatal(rs, err, calls)
+	_, err := (GitHub{Client: s.Client(), BaseURL: s.URL}).Releases(context.Background())
+	if err == nil || calls != 1 {
+		t.Fatal(err, calls)
 	}
 }
+
 func TestGitHubErrors(t *testing.T) {
 	for _, tc := range []struct {
 		status     int
 		body, link string
-	}{{429, `{}`, ""}, {200, `broken`, ""}, {200, `[]`, `<https://evil.invalid/next>; rel="next"`}, {200, `[]`, `</repos/Automattic/vip-cli/releases?page=1>; rel="next"`}} {
+	}{{429, `{}`, ""}, {200, `broken`, ""}, {200, `[]`, `<https://evil.invalid/next>; rel="next"`}, {200, `[]`, `</repositories/not-a-number/releases?page=2>; rel="next"`}, {200, `[]`, `</repos/Automattic/vip-cli/releases?page=1>; rel="next"`}} {
 		s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			w.Header().Set("Link", tc.link)
 			w.WriteHeader(tc.status)

package/internal/update/service_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -28,6 +29,44 @@ func TestServiceCheckAndChannelPersistence(t *testing.T) {
 		t.Fatal("failed check changed channel")
 	}
 }
+
+func TestServiceNativeInstallerNeverDownloadsOrReplaces(t *testing.T) {
+	for _, manager := range []string{"pkg", "msi"} {
+		t.Run(manager, func(t *testing.T) {
+			l, _ := installFixture(t)
+			before, err := os.ReadFile(l.CLI)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(filepath.Join(filepath.Dir(l.CLI), ".vip-next-installer.json"), []byte(`{"schema":1,"manager":"`+manager+`"}`), 0644); err != nil {
+				t.Fatal(err)
+			}
+			s := Service{Installed: "5.0.0", Platform: Platform{"linux", "amd64"}, State: State{CacheDir: t.TempDir(), ConfigDir: t.TempDir()}, Executable: func() (string, error) { return l.CLI, nil }, Fetch: func(context.Context) ([]Release, error) { return []Release{release("5.0.1")}, nil }}
+			s.Installer.InspectOwnership = func(ctx context.Context, layout Layout) (Ownership, error) {
+				platform := "darwin"
+				if manager == "msi" {
+					platform = "windows"
+				}
+				return inspectOwnership(ctx, layout, platform, func(context.Context, string, ...string) ([]byte, error) { t.Fatal("unexpected query"); return nil, nil })
+			}
+			s.Stage = func(context.Context, Candidate, Platform, string) (Bundle, error) {
+				t.Fatal("installer-managed binaries must not be downloaded")
+				return Bundle{}, nil
+			}
+			out, err := s.Run(context.Background(), Request{}, nil)
+			if err != nil || out.Updated || !strings.Contains(out.Instructions, "."+manager) {
+				t.Fatal(out, err)
+			}
+			after, err := os.ReadFile(l.CLI)
+			if err != nil || string(before) != string(after) {
+				t.Fatal("installed bytes changed", err)
+			}
+			if _, err := os.Stat(markerPath(l)); !os.IsNotExist(err) {
+				t.Fatal("created an update recovery record", err)
+			}
+		})
+	}
+}
 func TestServiceStableAheadAndManagedInstall(t *testing.T) {
 	s := Service{Installed: "5.1.0-beta.1", Platform: Platform{"linux", "amd64"}, State: State{CacheDir: t.TempDir(), ConfigDir: t.TempDir()}, Now: time.Now, Fetch: func(context.Context) ([]Release, error) { return []Release{release("5.0.0")}, nil }}
 	out, err := s.Run(context.Background(), Request{Channel: Stable, ExplicitChannel: true}, nil)

package/internal/upload/debug_test.go

@@ -0,0 +1,76 @@
+package upload
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestUploadDebugSummarizesWithoutFileContentsOrCredentials(t *testing.T) {
+	for _, compress := range []bool{false, true} {
+		t.Run(map[bool]string{false: "plain", true: "compressed"}[compress], func(t *testing.T) {
+			c := stubPresignServer(t, func(w http.ResponseWriter, r *http.Request) {
+				_, _ = io.Copy(io.Discard, r.Body)
+				_, _ = w.Write([]byte("RESPONSE_SECRET"))
+			})
+			c.Token = "TOKEN_SECRET"
+			content := []byte("SQL_SECRET")
+			if compress {
+				content = bytes.Repeat(content, int(CompressThreshold)/len(content)+1)
+			}
+			meta, err := GetFileMeta(writeTemp(t, "PATH_SECRET.sql", content))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var logs bytes.Buffer
+			res, err := c.UploadImportFile(debuglog.WithLogger(context.Background(), "vip:lib/client-file-uploader", &logs), 1, 2, meta, "md5", nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if compress {
+				defer os.RemoveAll(filepath.Dir(res.Meta.FileName))
+			}
+			for _, want := range []string{"bytes=", "checksum", "PutObject", "Upload complete"} {
+				if !strings.Contains(logs.String(), want) {
+					t.Errorf("missing %q in %q", want, logs.String())
+				}
+			}
+			if compress && !strings.Contains(logs.String(), "Compression complete") {
+				t.Errorf("missing compression diagnostic: %s", &logs)
+			}
+			for _, secret := range []string{"SQL_SECRET", "PATH_SECRET", "TOKEN_SECRET", "RESPONSE_SECRET", res.Checksum} {
+				if strings.Contains(logs.String(), secret) {
+					t.Errorf("leaked %q", secret)
+				}
+			}
+		})
+	}
+}
+
+func TestMultipartDebugReportsPartCountWithoutUploadIdentifiers(t *testing.T) {
+	_, c := newMultipartTest(t)
+	meta, err := GetFileMeta(writeTemp(t, "PATH_SECRET.sql", bytes.Repeat([]byte("x"), 40)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var logs bytes.Buffer
+	_, err = c.uploadUsingMultipart(debuglog.WithLogger(context.Background(), "vip:lib/client-file-uploader", &logs), 1, 2, meta, 16, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(logs.String(), "Multipart") || !strings.Contains(logs.String(), "parts=3") {
+		t.Errorf("missing strategy/count: %s", &logs)
+	}
+	for _, secret := range []string{"UPLOAD123", "etag-", "PATH_SECRET", c.APIHost} {
+		if strings.Contains(logs.String(), secret) {
+			t.Errorf("leaked %q", secret)
+		}
+	}
+}