@automattic/vip 4.1.3 → 4.1.5

package/internal/upload/multipart.go

@@ -10,6 +10,8 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // initiateResult is S3's CreateMultipartUpload response
@@ -66,6 +68,7 @@ func (c *Client) uploadUsingMultipart(ctx context.Context, appID, envID int64, m
 	if err != nil {
 		return "", err
 	}
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Uploading to S3 using Multipart: parts=%d concurrency=%d", len(parts), MaxConcurrentPartUploads)
 	etags, err := c.uploadParts(ctx, appID, envID, meta, init.UploadId, parts, progressCb)
 	if err != nil {
 		return "", err

package/internal/upload/orchestrate.go

@@ -6,6 +6,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // UploadResult mirrors uploadImportFileToS3's return
@@ -31,7 +33,10 @@ func gzRename(base string) string {
 //  2. checksum the (possibly compressed) file,
 //  3. PutObject below MultipartThreshold, multipart at/above it.
 func (c *Client) UploadImportFile(ctx context.Context, appID, envID int64, meta FileMeta, hashType string, progressCb func(string)) (*UploadResult, error) {
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "File: bytes=%d compressed=%t", meta.FileSize, meta.IsCompressed)
 	if !meta.IsCompressed && meta.FileSize >= CompressThreshold {
+		debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Compressing file prior to transfer")
+		originalSize := meta.FileSize
 		tmpDir, err := os.MkdirTemp("", "vip-client-file-uploader")
 		if err != nil {
 			return nil, fmt.Errorf("Unable to create temporary working directory: %s", err.Error())
@@ -48,16 +53,20 @@ func (c *Client) UploadImportFile(ctx context.Context, appID, envID int64, meta
 			return nil, err
 		}
 		meta.FileSize = fi.Size()
+		debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Compression complete: bytes=%d saved_bytes=%d", meta.FileSize, originalSize-meta.FileSize)
 	}
 
 	if hashType == "" {
 		hashType = "md5"
 	}
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Calculating file checksum")
 	checksum, err := FileHash(meta.FileName, hashType)
 	if err != nil {
 		return nil, err
 	}
 
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Calculated file checksum")
+
 	var result string
 	if meta.FileSize < MultipartThreshold {
 		result, err = c.uploadUsingPutObject(ctx, appID, envID, meta, progressCb)
@@ -67,5 +76,6 @@ func (c *Client) UploadImportFile(ctx context.Context, appID, envID int64, meta
 	if err != nil {
 		return nil, err
 	}
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Upload complete: bytes=%d", meta.FileSize)
 	return &UploadResult{Meta: meta, Checksum: checksum, Result: result}, nil
 }

package/internal/upload/putobject.go

@@ -7,6 +7,8 @@ import (
 	"net/http"
 	"os"
 	"sync/atomic"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // progressReader counts bytes read and reports floor(100*read/total)% via
@@ -42,6 +44,7 @@ func (rc readCloser) Close() error { return rc.closer.Close() }
 // (client-file-uploader.ts:255). Returns "ok" on HTTP 200, otherwise an
 // error wrapping the S3 <Error> payload.
 func (c *Client) uploadUsingPutObject(ctx context.Context, appID, envID int64, meta FileMeta, progressCb func(string)) (string, error) {
+	debuglog.Printf(ctx, "vip:lib/client-file-uploader", "Uploading to S3 using PutObject")
 	pre, err := c.GetSignedUploadRequestData(ctx, SignedRequestArgs{
 		Action: "PutObject", AppID: appID, EnvID: envID, BaseName: meta.BaseName,
 	})

package/internal/wpssh/debug_test.go

@@ -0,0 +1,67 @@
+package wpssh_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+	"github.com/Automattic/vip/internal/wpssh"
+)
+
+func TestSSHDiagnosticsPreserveOutputAndExcludeSessionData(t *testing.T) {
+	for _, enabled := range []bool{false, true} {
+		for _, code := range []int{0, 7} {
+			host, port := startEchoSSHServer(t, code)
+			key := testClientKeyPEM(t)
+			var out, diagnostics bytes.Buffer
+			selector := ""
+			if enabled {
+				selector = "@automattic/vip:wp/ssh"
+			}
+			ctx := debuglog.WithLogger(context.Background(), selector, &diagnostics)
+			err := wpssh.Run(ctx, wpssh.Auth{Host: host, Port: port, Username: "secret-user", PrivateKey: key, GUID: "secret-guid", InputToken: "secret-token"}, wpssh.Streams{Stdin: strings.NewReader(""), Stdout: &out, Stderr: io.Discard}, wpssh.Meta{Version: "test", Rows: 15, Columns: 100})
+			var ec *wpssh.ExitCodeError
+			if code == 0 && err != nil || code != 0 && (!errors.As(err, &ec) || ec.Code != code) {
+				t.Fatalf("exit %d: %v", code, err)
+			}
+			if out.String() != "GUID=secret-guid INPUT_TOKEN=secret-token VERSION=test ROWS=15 COLUMNS=100 TTY=false" {
+				t.Fatalf("stdout changed: %q", out.String())
+			}
+			if !enabled {
+				if diagnostics.Len() != 0 {
+					t.Fatalf("default diagnostics: %s", &diagnostics)
+				}
+				continue
+			}
+			for _, stage := range []string{"Connecting to SSH", "SSH connected", "SSH exit code="} {
+				if !strings.Contains(diagnostics.String(), stage) {
+					t.Errorf("missing %q in %q", stage, diagnostics.String())
+				}
+			}
+			for _, sensitive := range []string{host, port, "secret-user", key, "secret-guid", "secret-token", "GUID="} {
+				if strings.Contains(diagnostics.String(), sensitive) {
+					t.Errorf("diagnostics disclose session data %q", sensitive)
+				}
+			}
+		}
+	}
+}
+
+func TestSSHDiagnosticsKeyFailureDoesNotPrintKeyOrPassphrase(t *testing.T) {
+	var diagnostics bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "@automattic/vip:wp/ssh", &diagnostics)
+	err := wpssh.Run(ctx, wpssh.Auth{PrivateKey: "secret-private-key", Passphrase: "secret-passphrase"}, wpssh.Streams{}, wpssh.Meta{})
+	if err == nil {
+		t.Fatal("expected invalid key error")
+	}
+	if !strings.Contains(diagnostics.String(), "SSH authentication key rejected") {
+		t.Fatalf("missing stage: %q", diagnostics.String())
+	}
+	if strings.Contains(diagnostics.String(), "secret-") {
+		t.Fatalf("secret in diagnostics: %q", diagnostics.String())
+	}
+}

package/internal/wpssh/wpssh.go

@@ -12,6 +12,8 @@ import (
 	"net"
 
 	"golang.org/x/crypto/ssh"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // SSH_HANDSHAKE_TIMEOUT_MS matches the Node constant (wp-ssh.ts:22).
@@ -56,6 +58,7 @@ func (e *ExitCodeError) Error() string {
 func Run(ctx context.Context, auth Auth, streams Streams, meta Meta) error {
 	signer, err := parseSigner(auth.PrivateKey, auth.Passphrase)
 	if err != nil {
+		debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH authentication key rejected")
 		return fmt.Errorf("wpssh: parse private key: %w", err)
 	}
 
@@ -70,11 +73,13 @@ func Run(ctx context.Context, auth Auth, streams Streams, meta Meta) error {
 	}
 
 	addr := net.JoinHostPort(auth.Host, auth.Port)
+	debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "Connecting to SSH")
 	client, err := ssh.Dial("tcp", addr, cfg)
 	if err != nil {
 		return fmt.Errorf("wpssh: dial %s: %w", addr, err)
 	}
 	defer client.Close()
+	debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH connected")
 
 	session, err := client.NewSession()
 	if err != nil {
@@ -99,10 +104,12 @@ func Run(ctx context.Context, auth Auth, streams Streams, meta Meta) error {
 	if err := session.Run(cmd); err != nil {
 		var exitErr *ssh.ExitError
 		if errors.As(err, &exitErr) {
+			debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH exit code=%d", exitErr.ExitStatus())
 			return &ExitCodeError{Code: exitErr.ExitStatus(), GUID: auth.GUID}
 		}
 		return fmt.Errorf("wpssh: run: %w", err)
 	}
+	debuglog.Printf(ctx, "@automattic/vip:wp/ssh", "SSH exit code=0")
 	return nil
 }
 

package/internal/wpstream/debug_test.go

@@ -0,0 +1,116 @@
+package wpstream
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/Automattic/vip/internal/debuglog"
+	"github.com/coder/websocket"
+)
+
+// Exercise the real transport, including a server-requested retry and reconnect.
+func TestSocketDiagnosticsRetryAndExitExcludeSessionData(t *testing.T) {
+	for _, enabled := range []bool{false, true} {
+		var connections atomic.Int32
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Query().Get("transport") == "polling" {
+				fmt.Fprint(w, `0{"sid":"secret-session","upgrades":["websocket"],"pingInterval":20000,"pingTimeout":20000}`)
+				return
+			}
+			c, err := websocket.Accept(w, r, nil)
+			if err != nil {
+				return
+			}
+			defer c.CloseNow()
+			ctx := r.Context()
+			_, probe, err := c.Read(ctx)
+			if err != nil || string(probe) != "2probe" {
+				return
+			}
+			if c.Write(ctx, websocket.MessageText, []byte("3probe")) != nil {
+				return
+			}
+			if _, _, err = c.Read(ctx); err != nil {
+				return
+			}
+			if _, _, err = c.Read(ctx); err != nil {
+				return
+			}
+			if c.Write(ctx, websocket.MessageText, []byte("40/wp-cli,")) != nil {
+				return
+			}
+			attempt := connections.Add(1)
+			for {
+				_, data, err := c.Read(ctx)
+				if err != nil {
+					return
+				}
+				if !strings.Contains(string(data), `"cmd"`) {
+					continue
+				}
+				if attempt == 1 {
+					_ = c.Write(ctx, websocket.MessageText, []byte(`42/wp-cli,["retry",{"message":"secret-retry"}]`))
+					_ = c.Write(ctx, websocket.MessageText, []byte("41/wp-cli,"))
+				} else {
+					_ = c.Write(ctx, websocket.MessageText, []byte(`42/wp-cli,["exit",{"exitCode":7,"message":"secret-server-output"}]`))
+				}
+			}
+		}))
+		var stdout, diagnostics bytes.Buffer
+		selector := ""
+		if enabled {
+			selector = "@automattic/vip:wp"
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		res, err := Run(debuglog.WithLogger(ctx, selector, &diagnostics), Options{APIHost: srv.URL, Token: "secret-token", GUID: "secret-guid", InputToken: "secret-input", Stdin: strings.NewReader(""), Stdout: &stdout, Stderr: io.Discard})
+		cancel()
+		srv.Close()
+		if err != nil || res.ExitCode != 7 {
+			t.Fatalf("result=%+v err=%v", res, err)
+		}
+		if stdout.String() != "secret-server-output\n" {
+			t.Fatalf("stdout changed: %q", stdout.String())
+		}
+		if !enabled {
+			if diagnostics.Len() != 0 {
+				t.Fatalf("default diagnostics: %q", diagnostics.String())
+			}
+			continue
+		}
+		for _, stage := range []string{"socket: connect attempt=1", "socket: connected", "socket: retry", "socket.io: reconnect", "socket: connect attempt=2", "socket: exit code=7"} {
+			if !strings.Contains(diagnostics.String(), stage) {
+				t.Errorf("missing %q in %q", stage, diagnostics.String())
+			}
+		}
+		if strings.Contains(diagnostics.String(), "secret-") || strings.Contains(diagnostics.String(), srv.URL) {
+			t.Fatalf("session data in diagnostics: %q", diagnostics.String())
+		}
+	}
+}
+
+func TestSocketDiagnosticsConnectionErrorDoesNotPrintResponse(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "secret-server-error", http.StatusForbidden)
+	}))
+	defer srv.Close()
+	var diagnostics bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "@automattic/vip:wp", &diagnostics)
+	_, err := Run(ctx, Options{APIHost: srv.URL, Token: "secret-token"})
+	if err == nil {
+		t.Fatal("expected handshake error")
+	}
+	if !strings.Contains(diagnostics.String(), "socket: connect_error stage=transport") {
+		t.Fatalf("missing failure stage: %q", diagnostics.String())
+	}
+	if strings.Contains(diagnostics.String(), "secret-") || strings.Contains(diagnostics.String(), srv.URL) {
+		t.Fatalf("private data in diagnostics: %q", diagnostics.String())
+	}
+}

package/internal/wpstream/run.go

@@ -14,6 +14,8 @@ import (
 	"time"
 
 	"github.com/fatih/color"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 const (
@@ -61,12 +63,14 @@ func Run(ctx context.Context, opts Options) (Result, error) {
 	const maxBackoff = 5 * time.Second
 	first := true
 
-	for {
+	for attempt := 1; ; attempt++ {
+		debuglog.Printf(ctx, "@automattic/vip:wp", "socket: connect attempt=%d", attempt)
 		eng, err := Dial(ctx, DialOptions{
 			BaseURL: opts.APIHost,
 			Header:  bearerHeader(opts.Token),
 		})
 		if err != nil {
+			debuglog.Printf(ctx, "@automattic/vip:wp", "socket: connect_error stage=transport")
 			if first {
 				return Result{}, err
 			}
@@ -82,6 +86,7 @@ func Run(ctx context.Context, opts Options) (Result, error) {
 		// Install a retry handler: the server sends "retry" to signal it wants us to
 		// reconnect. We close the engine after 5 s to force the disconnect.
 		cli.On("retry", func(args []any) {
+			debuglog.Printf(ctx, "@automattic/vip:wp", "socket: retry")
 			go func() {
 				select {
 				case <-time.After(5 * time.Second):
@@ -93,6 +98,7 @@ func Run(ctx context.Context, opts Options) (Result, error) {
 		})
 
 		if err := cli.Connect(ctx); err != nil {
+			debuglog.Printf(ctx, "@automattic/vip:wp", "socket: connect_error stage=namespace")
 			eng.Close()
 			if first {
 				return Result{}, err
@@ -102,6 +108,7 @@ func Run(ctx context.Context, opts Options) (Result, error) {
 			}
 			continue
 		}
+		debuglog.Printf(ctx, "@automattic/vip:wp", "socket: connected")
 		first = false
 
 		res, clean := runOnce(ctx, opts, cli, ss, &offset, offset.Load())
@@ -114,6 +121,7 @@ func Run(ctx context.Context, opts Options) (Result, error) {
 			return res, nil
 		}
 
+		debuglog.Printf(ctx, "@automattic/vip:wp", "socket.io: reconnect")
 		// disconnected mid-command → wait then reconnect from offset
 		if werr := waitBackoff(ctx, &backoff, maxBackoff); werr != nil {
 			return Result{}, werr
@@ -168,6 +176,7 @@ func runOnce(ctx context.Context, opts Options, cli *Client, ss *StreamSocket, o
 	})
 	cli.On("exit", func(args []any) {
 		code, msg := parseExit(args)
+		debuglog.Printf(ctx, "@automattic/vip:wp", "socket: exit code=%d", code)
 		if msg != "" {
 			fmt.Fprintln(opts.Stdout, msg)
 		}