@celilo/cli 1.8.0 → 1.9.1

package/src/hooks/executor.ts

@@ -7,14 +7,28 @@
  * - Output validation
  * - Structured logging
  *
- * **Execution model:** hook scripts run *in-process* on the celilo CLI host.
- * `runScript` dynamically `import()`s the hook module and awaits its default
- * export. They do NOT execute on the target machine. A hook that needs to
- * touch the target initiates SSH outbound itself (see e.g.
- * modules/lunacycle/celilo/scripts/health-check.ts's `ssh()` helper). This
- * means hook scripts can freely use npm packages, make HTTP calls, read
- * local files, etc. — and conversely, anything they depend on (chromium,
+ * **Execution model:** a hook script is a program celilo RUNS, not a library
+ * celilo loads. `executeHookScript` spawns `bun hook-runner.ts <script>` and
+ * becomes a broker: it keeps the database, the master key and the live
+ * capability objects, and answers the child over a versioned NDJSON protocol
+ * on a Unix socket (`hook-protocol.ts`, `broker.ts`). See
+ * `openspec/changes/hook-process-boundary/design.md`.
+ *
+ * Three things follow, and they are the point:
+ *
+ *   - The child's environment is an ALLOW-LIST, not `...process.env`. celilo's
+ *     own paths and the operator's tokens stop being visible (design D5).
+ *   - A timeout is a real `proc.kill()`. The old implementation raced the
+ *     hook's promise against a timer and cancelled nothing, so a hook that
+ *     "timed out" kept its capability objects and went on registering DNS
+ *     records after celilo reported the deploy failed (celilo#1003).
+ *   - A hook's memory is its own process's, not celilo's heap.
+ *
+ * Hooks still do NOT execute on the target machine. One that needs to touch a
+ * target initiates SSH outbound itself, so anything it depends on (chromium,
  * system binaries, credentials) must be available on the celilo CLI host.
+ * Stage 2 of the change above jails the filesystem and stage 3 scopes that
+ * reachability; neither has landed.
  *
  * Execution function (Rule 10.1) - performs side effects (script execution)
  */
@@ -23,9 +37,9 @@ import { existsSync, mkdirSync, readdirSync, rmdirSync, statSync } from 'node:fs
 import { dirname, join, resolve } from 'node:path';
 import {
   type DeployedSystem,
-  isCompiledHook,
   isMissingProviderInputError,
   moduleArtifactDir,
+  moduleStateDir,
 } from '@celilo/capabilities';
 import {
   type ContractHookSignature,
@@ -35,6 +49,14 @@ import {
 } from '../manifest/contracts';
 import { isPrivilegedCapability } from '../manifest/validate';
 import { pruneModuleArtifacts } from './artifact-retention';
+import { startBroker } from './broker';
+import {
+  HOOK_PROTOCOL_VERSION,
+  HOOK_PROTOCOL_VERSION_ENV,
+  HOOK_SOCKET_ENV,
+  createLineReader,
+  deserializeError,
+} from './hook-protocol';
 import type { HookContext, HookDefinition, HookLogger, HookResult } from './types';
 
 /** Default total timeout: 60 seconds */
@@ -51,6 +73,76 @@ const DEFAULT_TIMEOUT_MS = 60_000;
  */
 const IDLE_TIMEOUT_MS = 30_000;
 
+/** How often the idle tracker looks. Unchanged from the promise-based timer. */
+const IDLE_POLL_MS = 5_000;
+
+/**
+ * SIGTERM is a request. A hook that traps it and keeps working would leave the
+ * boundary buying nothing over the promise race it replaced, so SIGKILL
+ * follows. Short, because by this point celilo has already told the operator
+ * the hook failed.
+ */
+const SIGKILL_GRACE_MS = 2_000;
+
+/**
+ * Environment variables a hook inherits. Everything else is dropped (D5).
+ *
+ * Two kinds, and the distinction is the whole rule.
+ *
+ * **How to run** — `PATH`, `HOME`, `LANG`, `TZ`, `TMPDIR`. A hook that spawns
+ * anything needs these, and withholding them hides no path.
+ *
+ * **How to reach the network, and whom to trust** — the CA and proxy families.
+ * These configure the RUNTIME, not the module: they say which certificate
+ * authorities this host trusts and how it reaches the internet. They name no
+ * secret, they are not module-specific, and withholding them reduces a hook's
+ * authority by nothing at all. It only makes its TLS connections wrong.
+ *
+ * `NODE_EXTRA_CA_CERTS` is why this second group exists rather than being an
+ * afterthought. `packages/e2e/docker/Dockerfile.management:107` sets it because
+ * `bun fetch()` otherwise ignores `/etc/ssl/certs/ca-certificates.crt`
+ * entirely and rejects every certificate the simulated CA issues. Twelve
+ * hook-reachable module files make HTTPS requests. Dropping it would have
+ * broken all of them, in the rig only, as a TLS error naming no cause.
+ *
+ * The proxy family is not set anywhere today. It is here because it is the
+ * same kind of thing, it costs nothing when absent, and the alternative is
+ * discovering it the way `NODE_EXTRA_CA_CERTS` was discovered.
+ *
+ * **`TF_CLI_CONFIG_FILE` is deliberately NOT here.** It is toolchain
+ * configuration too, but no hook invokes the terraform binary — every mention
+ * of terraform in a module script is a `generated/terraform/` PATH. celilo runs
+ * terraform from its own process, which keeps its own environment. Recorded so
+ * the next reader does not have to re-derive it.
+ *
+ * What is NOT in either group: anything module-specific. A module that needs a
+ * value declares it (config) or is handed it (a hook input). See the note on
+ * `DDNS_ENDPOINT` in openspec/changes/hook-process-boundary/baseline.md for the
+ * one case that got this wrong and what was done about it.
+ */
+const FORWARDED_ENV = [
+  // How to run.
+  'PATH',
+  'HOME',
+  'LANG',
+  'TZ',
+  'TMPDIR',
+  // Whom to trust.
+  'NODE_EXTRA_CA_CERTS',
+  'SSL_CERT_FILE',
+  'SSL_CERT_DIR',
+  // How to reach the network.
+  'HTTP_PROXY',
+  'HTTPS_PROXY',
+  'NO_PROXY',
+  'http_proxy',
+  'https_proxy',
+  'no_proxy',
+] as const;
+
+/** The shim celilo spawns. Resolved from here so an npm install finds it too. */
+const HOOK_RUNNER_PATH = join(import.meta.dir, 'hook-runner.ts');
+
 /**
  * Validate hook inputs against a contract signature.
  *
@@ -148,127 +240,159 @@ export async function executeHookScript(
     throw new Error(`Hook script not found: ${scriptPath}`);
   }
 
-  // Create an idle timeout tracker
+  // Activity is now ANY frame or ANY byte the child writes, rather than only a
+  // `ctx.logger` call. That is strictly more generous than the old tracker and
+  // it removes a class of false idle-kill: a hook that prints progress to
+  // stdout used to look silent (celilo#622 is the same family).
   let lastActivity = Date.now();
-  const originalLogger = context.logger;
-
-  // Wrap logger to track activity for idle timeout
-  const trackedLogger: HookLogger = {
-    info(message: string) {
-      lastActivity = Date.now();
-      originalLogger.info(message);
-    },
-    warn(message: string) {
-      lastActivity = Date.now();
-      originalLogger.warn(message);
-    },
-    error(message: string) {
-      lastActivity = Date.now();
-      originalLogger.error(message);
-    },
-    success(message: string) {
-      lastActivity = Date.now();
-      originalLogger.success(message);
-    },
+  const markActive = () => {
+    lastActivity = Date.now();
   };
 
-  const trackedContext: HookContext = {
-    ...context,
-    logger: trackedLogger,
-  };
+  const { logger, ...serializableContext } = context;
+  delete (serializableContext as Record<string, unknown>).capabilities;
 
-  // Execute with timeout — disable idle timeout in debug mode
-  const promises: Promise<Record<string, unknown>>[] = [
-    runScript(scriptPath, trackedContext),
-    createTimeoutPromise(timeoutMs, 'total'),
-  ];
-  if (!context.debug) {
-    promises.push(createIdleTimeoutPromise(() => Date.now() - lastActivity, idleTimeoutMs));
-  }
-  const result = await Promise.race(promises);
+  const broker = await startBroker({
+    capabilities: context.capabilities,
+    context: serializableContext as Record<string, unknown>,
+    scriptPath,
+    logger,
+    onActivity: markActive,
+  });
 
-  return result;
-}
+  try {
+    const child = Bun.spawn({
+      cmd: [process.execPath, HOOK_RUNNER_PATH],
+      env: hookChildEnv(broker.socketPath),
+      stdout: 'pipe',
+      stderr: 'pipe',
+    });
+
+    // The child's stdout and stderr stay what they are — human output. They
+    // now reach `ctx.logger` instead of celilo's own stdout, which is the
+    // attribution: a `console.log` from an in-process hook landed unlabelled
+    // in the CLI's output with nothing saying which hook wrote it.
+    const forwarding = Promise.all([
+      forwardStream(child.stdout, logger.info.bind(logger), markActive),
+      forwardStream(child.stderr, logger.warn.bind(logger), markActive),
+    ]);
+
+    let killedFor: string | null = null;
+    const kill = (reason: string) => {
+      if (killedFor) return;
+      killedFor = reason;
+      // Refuse capability calls FIRST. A hook between `kill` and its own death
+      // can still have a call in flight, and answering it is exactly the
+      // failure this replaces.
+      broker.stop();
+      child.kill('SIGTERM');
+      setTimeout(() => child.kill('SIGKILL'), SIGKILL_GRACE_MS).unref();
+    };
 
-/**
- * Run a hook script by dynamically importing it.
- *
- * HOOK_API_V2 Phase 8 (D8): the executor only accepts hook scripts that
- * use `defineHook` from `@celilo/capabilities`. The compiled output
- * carries a brand symbol (`CELILO_HOOK_BRAND`) that this function
- * checks via `isCompiledHook`. Raw `async function(context)` exports are
- * rejected with a clear error pointing at the migration guide — no more
- * silent failures from forgotten brand registration.
- *
- * @param scriptPath - Absolute path to script
- * @param context - Hook context
- * @returns Script outputs
- */
-async function runScript(
-  scriptPath: string,
-  context: HookContext,
-): Promise<Record<string, unknown>> {
-  const module = await import(scriptPath);
+    const totalTimer = setTimeout(() => kill('total'), timeoutMs);
+    // Debug runs get no idle timer, same as before: an operator stepping
+    // through a browser hook is silent for minutes on purpose.
+    const idleTimer = context.debug
+      ? undefined
+      : setInterval(() => {
+          if (Date.now() - lastActivity >= idleTimeoutMs) kill('idle');
+        }, IDLE_POLL_MS);
+
+    let exitCode: number;
+    try {
+      exitCode = await child.exited;
+      // Both channels, not just the process: the terminal frame can still be
+      // in the socket buffer when the exit is observed.
+      await broker.drained();
+      await forwarding;
+    } finally {
+      clearTimeout(totalTimer);
+      if (idleTimer) clearInterval(idleTimer);
+    }
 
-  if (typeof module.default !== 'function') {
-    throw new Error(`Hook script must export a default function: ${scriptPath}`);
-  }
+    // Process exit is the ONE terminal event, so there is no race to lose and
+    // nothing keeps running past this line. That is the difference from the
+    // `Promise.race` this replaces (celilo#1003).
+    if (killedFor === 'total') {
+      throw new Error(`Hook total timeout exceeded (${Math.round(timeoutMs / 1000)}s)`);
+    }
+    if (killedFor === 'idle') {
+      throw new Error(
+        `Hook idle timeout exceeded (no log output for ${Math.round(idleTimeoutMs / 1000)}s)`,
+      );
+    }
 
-  if (!isCompiledHook(module.default)) {
-    throw new Error(
-      `Hook script ${scriptPath} does not use defineHook(). As of HOOK_API_V2 Phase 8, all hook scripts must wrap their handler with defineHook from @celilo/capabilities so the executor can verify the brand and apply pre-flight checks. See reference/MODULE_DEVELOPMENT_GUIDE.md "Hooks" section for the migration pattern.`,
-    );
+    const outcome = broker.outcome();
+    if (!outcome) {
+      const faults = broker.faults();
+      throw new Error(
+        `Hook process exited with code ${exitCode} without returning a result.${
+          faults.length > 0 ? ` ${faults.join('; ')}` : ''
+        }`,
+      );
+    }
+
+    if (!outcome.ok) throw deserializeError(outcome.error);
+    return outcome.outputs;
+  } finally {
+    broker.close();
   }
+}
 
-  const result = await module.default(context);
+/**
+ * The child's environment, built from an allow-list (design D5).
+ *
+ * NOT `...process.env`. `packages/event-bus/src/dispatcher.ts` spawns handlers
+ * that way and it grants a subprocess MORE than the in-process call did — the
+ * whole environment plus an explicit database path. Copying that pattern would
+ * buy the crash isolation and none of the authority reduction.
+ *
+ * Measured on the operator's own shell: what a hook inherited before this was
+ * 24 variables naming celilo state or carrying a credential, twenty of them
+ * third-party API tokens with nothing to do with celilo
+ * (`openspec/changes/hook-process-boundary/baseline.md`).
+ *
+ * This is not the boundary — a hook can still COMPUTE the default master-key
+ * path from `$HOME` and read it. It is the cheap half, and it is what stops the
+ * dispatcher's mistake repeating here. Stage 2's mount set is what makes the
+ * path unreachable.
+ *
+ * Planning function (Rule 10.4) — pure.
+ */
+export function hookChildEnv(socketPath: string): Record<string, string> {
+  const env: Record<string, string> = {};
 
-  if (result === null || result === undefined) {
-    return {};
+  for (const name of FORWARDED_ENV) {
+    const value = process.env[name];
+    if (value !== undefined) env[name] = value;
   }
 
-  if (typeof result !== 'object' || Array.isArray(result)) {
-    throw new Error('Hook script must return an object (or nothing)');
-  }
+  env[HOOK_SOCKET_ENV] = socketPath;
+  env[HOOK_PROTOCOL_VERSION_ENV] = String(HOOK_PROTOCOL_VERSION);
+  // Forwarded when the operator set it, not synthesised from `debug` — a hook
+  // reads the flag off `ctx.debug`, which crosses in the context frame.
+  if (process.env.CELILO_DEBUG !== undefined) env.CELILO_DEBUG = process.env.CELILO_DEBUG;
 
-  return result as Record<string, unknown>;
+  return env;
 }
 
-/**
- * Create a promise that rejects after a total timeout
- */
-function createTimeoutPromise(timeoutMs: number, type: string): Promise<never> {
-  return new Promise((_, reject) => {
-    setTimeout(() => {
-      reject(new Error(`Hook ${type} timeout exceeded (${Math.round(timeoutMs / 1000)}s)`));
-    }, timeoutMs);
+/** Read a piped stream line by line into the logger. */
+async function forwardStream(
+  stream: ReadableStream<Uint8Array>,
+  emit: (line: string) => void,
+  markActive: () => void,
+): Promise<void> {
+  const decoder = new TextDecoder();
+  const feed = createLineReader((line) => {
+    markActive();
+    emit(line);
   });
-}
 
-/**
- * Create a promise that rejects when idle timeout is exceeded
- * Polls every 5 seconds to check idle duration
- */
-function createIdleTimeoutPromise(
-  getIdleDuration: () => number,
-  idleTimeoutMs: number,
-): Promise<never> {
-  return new Promise((_, reject) => {
-    const interval = setInterval(() => {
-      if (getIdleDuration() >= idleTimeoutMs) {
-        clearInterval(interval);
-        reject(
-          new Error(
-            `Hook idle timeout exceeded (no log output for ${Math.round(idleTimeoutMs / 1000)}s)`,
-          ),
-        );
-      }
-    }, 5000);
-
-    // Don't block process exit
-    if (interval.unref) {
-      interval.unref();
-    }
-  });
+  for await (const chunk of stream) {
+    feed(decoder.decode(chunk, { stream: true }));
+  }
+  // A final line with no trailing newline would otherwise be dropped.
+  feed('\n');
 }
 
 export interface InvokeHookOptions {
@@ -505,6 +629,10 @@ export async function invokeHook(
   // below — the capability pre-flight is one — and nothing ever cleans
   // those up, so a module accrues one per affected run forever.
   const screenshotDir = moduleArtifactDir(modulePath, `${hookName}-${startTime}`);
+  // Unlike the artifact directory, this one is NOT per-run and is created
+  // unconditionally: a hook must be able to write state on its first ever run,
+  // and should never have to mkdir its own sanctioned location (celilo#1000).
+  const stateDir = moduleStateDir(modulePath);
 
   // Build context
   const loadedCapabilities = options.capabilities ?? {};
@@ -516,6 +644,7 @@ export async function invokeHook(
     logger,
     debug,
     screenshotDir,
+    stateDir,
     capabilities: loadedCapabilities,
   };
 
@@ -550,6 +679,11 @@ export async function invokeHook(
   // Create the artifact directory only once every early return is behind
   // us, so the `finally` below is guaranteed to run and reclaim it.
   mkdirSync(screenshotDir, { recursive: true });
+  // Created every run and reclaimed on none. An empty `state/` is not litter
+  // the way an empty per-run artifact directory is: there is one of them, it is
+  // where the module is told to write, and deleting it between runs would make
+  // its existence depend on whether the last hook happened to use it.
+  mkdirSync(stateDir, { recursive: true });
   // Prune on write, so retention needs no scheduler of its own and cannot
   // fall behind a module that runs often.
   pruneModuleArtifacts(dirname(screenshotDir));

package/src/hooks/hook-protocol.test.ts

@@ -0,0 +1,192 @@
+import { describe, expect, test } from 'bun:test';
+import { MissingProviderInputError, isMissingProviderInputError } from '@celilo/capabilities';
+import {
+  type ChildFrame,
+  HOOK_PROTOCOL_VERSION,
+  type ParentFrame,
+  createLineReader,
+  deserializeError,
+  encodeFrame,
+  parseChildFrame,
+  parseParentFrame,
+  serializeError,
+  versionMismatch,
+} from './hook-protocol';
+
+const CHILD_FRAMES: ChildFrame[] = [
+  { type: 'ready', protocolVersion: HOOK_PROTOCOL_VERSION },
+  {
+    type: 'call',
+    id: 'c1',
+    capability: 'public_web',
+    method: 'register_route',
+    args: [{ path: '/x' }],
+  },
+  { type: 'log', level: 'info', message: 'hello' },
+  { type: 'log', level: 'success', message: 'done' },
+  { type: 'result', outputs: { api_key: 'k' } },
+  { type: 'throw', error: { name: 'Error', message: 'boom', stack: 'at x' } },
+];
+
+const PARENT_FRAMES: ParentFrame[] = [
+  {
+    type: 'context',
+    protocolVersion: HOOK_PROTOCOL_VERSION,
+    scriptPath: '/m/scripts/h.ts',
+    context: { config: { a: 1 }, secrets: {}, systems: [], debug: false, screenshotDir: '/tmp/a' },
+  },
+  {
+    type: 'capabilities',
+    shape: { firewall: { methods: ['exposeService'], data: { providerModuleId: 'iptables' } } },
+  },
+  { type: 'return', id: 'c1', value: { success: true } },
+  { type: 'throw', id: 'c1', error: { name: 'Error', message: 'nope' } },
+];
+
+describe('hook protocol', () => {
+  describe('round trip', () => {
+    for (const frame of CHILD_FRAMES) {
+      test(`child ${frame.type}${'level' in frame ? `/${frame.level}` : ''}`, () => {
+        const parsed = parseChildFrame(encodeFrame(frame).trimEnd());
+        expect(parsed.ok).toBe(true);
+        if (parsed.ok) expect(parsed.frame).toEqual(frame);
+      });
+    }
+
+    for (const frame of PARENT_FRAMES) {
+      test(`parent ${frame.type}`, () => {
+        const parsed = parseParentFrame(encodeFrame(frame).trimEnd());
+        expect(parsed.ok).toBe(true);
+        if (parsed.ok) expect(parsed.frame).toEqual(frame);
+      });
+    }
+
+    test('every frame ends in exactly one newline', () => {
+      for (const frame of [...CHILD_FRAMES, ...PARENT_FRAMES]) {
+        const encoded = encodeFrame(frame);
+        expect(encoded.endsWith('\n')).toBe(true);
+        expect(encoded.slice(0, -1)).not.toContain('\n');
+      }
+    });
+  });
+
+  describe('malformed input is a value, never a throw', () => {
+    // The boundary's whole claim is that the child cannot take celilo down. A
+    // reader that throws on a bad line hands that back.
+    const bad = [
+      '',
+      'not json at all',
+      '{',
+      '{"type":"nope"}',
+      '{"type":"call"}',
+      'null',
+      '[]',
+      '"a string"',
+    ];
+
+    for (const line of bad) {
+      test(`child reader survives ${JSON.stringify(line)}`, () => {
+        const parsed = parseChildFrame(line);
+        expect(parsed.ok).toBe(false);
+        if (!parsed.ok) expect(parsed.error.length).toBeGreaterThan(0);
+      });
+    }
+
+    test('a very long malformed line is truncated in the message', () => {
+      const parsed = parseChildFrame('x'.repeat(5000));
+      expect(parsed.ok).toBe(false);
+      if (!parsed.ok) expect(parsed.error.length).toBeLessThan(200);
+    });
+
+    test('a parent frame is not a child frame', () => {
+      expect(parseChildFrame(encodeFrame(PARENT_FRAMES[1]).trimEnd()).ok).toBe(false);
+    });
+  });
+
+  describe('line reader', () => {
+    test('reassembles a frame split across chunks', () => {
+      const lines: string[] = [];
+      const feed = createLineReader((l) => lines.push(l));
+      const encoded = encodeFrame(CHILD_FRAMES[1]);
+      feed(encoded.slice(0, 7));
+      expect(lines).toEqual([]);
+      feed(encoded.slice(7));
+      expect(lines).toHaveLength(1);
+      expect(parseChildFrame(lines[0]).ok).toBe(true);
+    });
+
+    test('splits several frames arriving in one chunk', () => {
+      const lines: string[] = [];
+      const feed = createLineReader((l) => lines.push(l));
+      feed(CHILD_FRAMES.map(encodeFrame).join(''));
+      expect(lines).toHaveLength(CHILD_FRAMES.length);
+    });
+
+    test('holds a partial tail rather than emitting it', () => {
+      const lines: string[] = [];
+      const feed = createLineReader((l) => lines.push(l));
+      feed(`${encodeFrame(CHILD_FRAMES[0])}{"type":"log"`);
+      expect(lines).toHaveLength(1);
+    });
+  });
+
+  describe('handshake', () => {
+    test('matching versions pass', () => {
+      expect(versionMismatch(HOOK_PROTOCOL_VERSION, 'the hook runner')).toBeNull();
+    });
+
+    test('a mismatch names both numbers', () => {
+      const message = versionMismatch(99, 'the hook runner');
+      expect(message).toContain('99');
+      expect(message).toContain(String(HOOK_PROTOCOL_VERSION));
+      expect(message).toContain('the hook runner');
+    });
+  });
+
+  describe('errors', () => {
+    test('a plain Error keeps name, message and stack', () => {
+      const rebuilt = deserializeError(serializeError(new TypeError('bad shape')));
+      expect(rebuilt.name).toBe('TypeError');
+      expect(rebuilt.message).toBe('bad shape');
+      expect(rebuilt.stack).toBeTruthy();
+    });
+
+    test('a non-Error throw still crosses', () => {
+      expect(deserializeError(serializeError('just a string')).message).toBe('just a string');
+    });
+
+    test('MissingProviderInputError survives, fields intact', () => {
+      // The one error the framework READS rather than displays. If the four
+      // fields do not survive, the cross-module ensure interview never runs
+      // and the deploy fails with a message instead of a question.
+      const original = new MissingProviderInputError({
+        providerModuleId: 'caddy',
+        ensureId: 'hostnames',
+        value: 'foo.example.com',
+        humanContext: 'so the route resolves',
+      });
+
+      const rebuilt = deserializeError(serializeError(original));
+
+      expect(isMissingProviderInputError(rebuilt)).toBe(true);
+      if (!isMissingProviderInputError(rebuilt)) throw new Error('unreachable');
+      expect(rebuilt.providerModuleId).toBe('caddy');
+      expect(rebuilt.ensureId).toBe('hostnames');
+      expect(rebuilt.value).toBe('foo.example.com');
+      expect(rebuilt.humanContext).toBe('so the route resolves');
+    });
+
+    test('an absent humanContext does not become the string "undefined"', () => {
+      const rebuilt = deserializeError(
+        serializeError(
+          new MissingProviderInputError({ providerModuleId: 'p', ensureId: 'e', value: 'v' }),
+        ),
+      );
+      expect((rebuilt as unknown as Record<string, unknown>).humanContext).toBeUndefined();
+    });
+
+    test('an ordinary Error carries no fields envelope', () => {
+      expect(serializeError(new Error('x')).fields).toBeUndefined();
+    });
+  });
+});