@oneuptime/common 14.0.1 → 14.0.3

package/Tests/Server/Services/RunnerJobSubmitResultRedaction.test.ts

@@ -0,0 +1,322 @@
+import RunnerJobService, {
+  Service as RunnerJobServiceClass,
+} from "../../../Server/Services/RunnerJobService";
+import PostgresAppInstance from "../../../Server/Infrastructure/PostgresDatabase";
+import RunnerJobOrigin, {
+  AI_COMMAND_JOB_ORIGINS,
+} from "../../../Types/Runbook/RunnerJobOrigin";
+import RunnerJobStatus from "../../../Types/Runbook/RunnerJobStatus";
+import { KUBECTL_REDACTED_MARKER } from "../../../Utils/AiRemediation/KubectlOutputRedactor";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+
+/*
+ * Contract under test — RunnerJobService.submitResult, the one write that
+ * puts a Runner's output on the RunnerJob row the dashboard displays:
+ *
+ * - for an AI-origin job (an investigation's or a remediation's kubectl)
+ *   the stored output and error message go through the same two redaction
+ *   passes KubectlJobRunner applies before a model sees them, so a Secret
+ *   value the command printed never lands on the row;
+ * - a Runbook-origin job's output is the operator's own script's output
+ *   and is stored verbatim;
+ * - the origin is read inside the UPDATE itself (a CASE on the row's
+ *   origin column), so the lease check and the write remain one atomic
+ *   statement and one round trip;
+ * - the lease guard is unchanged: only the assigned agent, only from
+ *   Claimed/Running, and "no row" means "not ours any more".
+ *
+ * Postgres is replaced by a captured query so the statement and its
+ * parameters can be asserted on exactly; the CASE is evaluated here the way
+ * Postgres would, from the captured SQL and parameters, for each origin.
+ */
+
+const JOB_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const AGENT_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+
+const SECRET_VALUE: string = "c3VwZXItc2VjcmV0LXBhc3N3b3Jk";
+const BEARER_TOKEN: string =
+  "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJvbmV1cHRpbWUifQ.abcdefghijklmnopqrstuvwxyz0123456789";
+
+const SECRET_OUTPUT: string = [
+  "[stdout]",
+  "apiVersion: v1",
+  "kind: Secret",
+  "metadata:",
+  "  name: db-credentials",
+  "  namespace: web",
+  "data:",
+  `  password: ${SECRET_VALUE}`,
+  "type: Opaque",
+].join("\n");
+
+interface CapturedQuery {
+  sql: string;
+  params: Array<unknown>;
+}
+
+/*
+ * Evaluate a `"<column>" = CASE WHEN "origin" = ANY($n::text[]) THEN $a::text
+ * ELSE $b::text END` assignment the way Postgres would for a row of the
+ * given origin — so the test asserts what is STORED, not just which
+ * parameters were sent.
+ */
+function storedValueFor(data: {
+  query: CapturedQuery;
+  column: "output" | "errorMessage";
+  origin: RunnerJobOrigin;
+}): unknown {
+  const pattern: RegExp = new RegExp(
+    `"${data.column}" = CASE\\s+WHEN "origin" = ANY\\(\\$(\\d+)::text\\[\\]\\) THEN \\$(\\d+)::text\\s+ELSE \\$(\\d+)::text\\s+END`,
+  );
+  const match: RegExpMatchArray | null = data.query.sql.match(pattern);
+
+  if (!match) {
+    throw new Error(
+      `The UPDATE does not pick "${data.column}" by origin:\n${data.query.sql}`,
+    );
+  }
+
+  const originsParam: Array<string> = data.query.params[
+    Number(match[1]) - 1
+  ] as Array<string>;
+  const thenParam: unknown = data.query.params[Number(match[2]) - 1];
+  const elseParam: unknown = data.query.params[Number(match[3]) - 1];
+
+  return originsParam.includes(data.origin) ? thenParam : elseParam;
+}
+
+describe("RunnerJobService.submitResult output redaction at rest", () => {
+  let queries: Array<CapturedQuery>;
+  let queryMock: jest.Mock;
+
+  beforeEach(() => {
+    queries = [];
+    queryMock = jest
+      .fn()
+      .mockImplementation(
+        async (sql: string, params: Array<unknown>): Promise<unknown> => {
+          queries.push({ sql, params });
+          return [[{ _id: JOB_ID.toString() }], 1];
+        },
+      );
+    jest.spyOn(PostgresAppInstance, "getDataSource").mockReturnValue({
+      query: queryMock,
+    } as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function lastQuery(): CapturedQuery {
+    const query: CapturedQuery | undefined = queries[queries.length - 1];
+
+    if (!query) {
+      throw new Error("submitResult never queried the database");
+    }
+
+    return query;
+  }
+
+  it("masks a Secret data value before it is stored for an investigation job, and keeps the key", async () => {
+    const written: boolean = await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output: SECRET_OUTPUT,
+      exitCode: 0,
+    });
+
+    expect(written).toBe(true);
+    expect(queryMock).toHaveBeenCalledTimes(1);
+
+    const stored: string = storedValueFor({
+      query: lastQuery(),
+      column: "output",
+      origin: RunnerJobOrigin.AiInvestigation,
+    }) as string;
+
+    expect(stored).not.toContain(SECRET_VALUE);
+    expect(stored).toContain(KUBECTL_REDACTED_MARKER);
+    expect(stored).toContain("password:");
+    expect(stored).toContain("kind: Secret");
+  });
+
+  it("masks the same way for a remediation job", async () => {
+    await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output: SECRET_OUTPUT,
+    });
+
+    const stored: string = storedValueFor({
+      query: lastQuery(),
+      column: "output",
+      origin: RunnerJobOrigin.AiRemediation,
+    }) as string;
+
+    expect(stored).not.toContain(SECRET_VALUE);
+    expect(stored).toContain(KUBECTL_REDACTED_MARKER);
+  });
+
+  it("stores a Runbook-origin job's output verbatim", async () => {
+    await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output: SECRET_OUTPUT,
+    });
+
+    expect(
+      storedValueFor({
+        query: lastQuery(),
+        column: "output",
+        origin: RunnerJobOrigin.Runbook,
+      }),
+    ).toBe(SECRET_OUTPUT);
+  });
+
+  it("redacts the error message of an AI job too — kubectl prints the offending object on stderr", async () => {
+    const errorMessage: string = `Exit code 1: could not patch, applied object was: ${SECRET_OUTPUT}`;
+
+    await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: false,
+      output: "",
+      exitCode: 1,
+      errorMessage,
+    });
+
+    const query: CapturedQuery = lastQuery();
+
+    const storedForAi: string = storedValueFor({
+      query,
+      column: "errorMessage",
+      origin: RunnerJobOrigin.AiInvestigation,
+    }) as string;
+    expect(storedForAi).not.toContain(SECRET_VALUE);
+    expect(storedForAi).toContain("Exit code 1");
+
+    expect(
+      storedValueFor({
+        query,
+        column: "errorMessage",
+        origin: RunnerJobOrigin.Runbook,
+      }),
+    ).toBe(errorMessage);
+  });
+
+  it("also applies the tool-result pass, so a bearer token in plain describe output is masked", async () => {
+    const output: string = `[stdout]\nAnnotations: auth-header: Bearer ${BEARER_TOKEN}\n`;
+
+    await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output,
+    });
+
+    const stored: string = storedValueFor({
+      query: lastQuery(),
+      column: "output",
+      origin: RunnerJobOrigin.AiInvestigation,
+    }) as string;
+
+    expect(stored).not.toContain(BEARER_TOKEN);
+  });
+
+  it("leaves an absent output and error message null for every origin", async () => {
+    await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: false,
+    });
+
+    const query: CapturedQuery = lastQuery();
+
+    for (const origin of [
+      RunnerJobOrigin.Runbook,
+      RunnerJobOrigin.AiInvestigation,
+      RunnerJobOrigin.AiRemediation,
+    ]) {
+      expect(storedValueFor({ query, column: "output", origin })).toBeNull();
+      expect(
+        storedValueFor({ query, column: "errorMessage", origin }),
+      ).toBeNull();
+    }
+  });
+
+  it("decides by the row's origin inside the one UPDATE — both AI origins, no prior lookup", async () => {
+    await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output: "ok",
+    });
+
+    expect(queryMock).toHaveBeenCalledTimes(1);
+
+    const query: CapturedQuery = lastQuery();
+    expect(query.sql).toMatch(/^\s*UPDATE "RunnerJob"/);
+    expect(query.sql).toContain('WHEN "origin" = ANY(');
+    expect(query.params).toContainEqual(AI_COMMAND_JOB_ORIGINS);
+    expect(AI_COMMAND_JOB_ORIGINS).toEqual([
+      RunnerJobOrigin.AiRemediation,
+      RunnerJobOrigin.AiInvestigation,
+    ]);
+  });
+
+  it("keeps the lease guard: the assigned agent, from Claimed or Running only, and no row means not ours", async () => {
+    queryMock.mockImplementationOnce(
+      async (sql: string, params: Array<unknown>): Promise<unknown> => {
+        queries.push({ sql, params });
+        return [[], 0];
+      },
+    );
+
+    const written: boolean = await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output: "ok",
+      exitCode: 0,
+    });
+
+    expect(written).toBe(false);
+
+    const query: CapturedQuery = lastQuery();
+    expect(query.sql).toContain('"assignedAgentId" = $6::uuid');
+    expect(query.sql).toContain('"status" IN ($7, $8)');
+    expect(query.params[0]).toBe(RunnerJobStatus.Succeeded);
+    expect(query.params[4]).toBe(JOB_ID.toString());
+    expect(query.params[5]).toBe(AGENT_ID.toString());
+    expect(query.params[6]).toBe(RunnerJobStatus.Claimed);
+    expect(query.params[7]).toBe(RunnerJobStatus.Running);
+  });
+
+  it("refuses to write without a database connection", async () => {
+    (PostgresAppInstance.getDataSource as jest.Mock).mockReturnValue(null);
+
+    await expect(
+      RunnerJobService.submitResult({
+        jobId: JOB_ID,
+        agentId: AGENT_ID,
+        success: true,
+        output: "ok",
+      }),
+    ).rejects.toBeInstanceOf(BadDataException);
+  });
+
+  it("redactAiJobText is the pure transform the row gets: kubectl redaction, then the tool-result pass", () => {
+    const text: string = `${SECRET_OUTPUT}\nauth: Bearer ${BEARER_TOKEN}`;
+    const redacted: string = RunnerJobServiceClass.redactAiJobText(text);
+
+    expect(redacted).not.toContain(SECRET_VALUE);
+    expect(redacted).not.toContain(BEARER_TOKEN);
+    expect(redacted).toContain("kind: Secret");
+  });
+});

package/Tests/Server/Services/RunnerJobSubmitResultUnstorableText.test.ts

@@ -0,0 +1,357 @@
+import RunnerJobService, {
+  RUNNER_JOB_UNSTORABLE_CHARACTER_REPLACEMENT,
+  Service as RunnerJobServiceClass,
+} from "../../../Server/Services/RunnerJobService";
+import PostgresAppInstance from "../../../Server/Infrastructure/PostgresDatabase";
+import RunnerJobOrigin from "../../../Types/Runbook/RunnerJobOrigin";
+import { KUBECTL_REDACTED_MARKER } from "../../../Utils/AiRemediation/KubectlOutputRedactor";
+import ObjectID from "../../../Types/ObjectID";
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+
+/*
+ * ---------------------------------------------------------------------------
+ * Contract under test — a Runner's result is always storable.
+ *
+ * RunnerJob.output and RunnerJob.errorMessage are Postgres text columns, and
+ * Postgres rejects U+0000 anywhere in a text value — at BIND time, so every
+ * text parameter of the UPDATE counts, including the one the statement's
+ * CASE does not pick for the row's origin. A NUL byte is ordinary in what a
+ * Runner reports (`kubectl logs` of a log rotated with copytruncate, a
+ * ConfigMap value `describe` prints verbatim, a script writing binary), and
+ * before round four the whole result POST then failed with a 500 on every
+ * attempt: the Runner retried it as if the server were down, the lease
+ * lapsed, and the job read "result unknown" although the command had run.
+ *
+ * So RunnerJobService.submitResult, for every origin and before the
+ * redaction passes read the text:
+ *
+ * - replaces each U+0000 with U+FFFD (visible, rather than silently closing
+ *   up the text);
+ * - replaces a lone UTF-16 surrogate half (no UTF-8 encoding exists for it)
+ *   with U+FFFD too, keeping whole surrogate pairs;
+ * - leaves every other character exactly as it was.
+ *
+ * Postgres is replaced by a captured query that refuses a NUL in any text
+ * parameter the way Postgres does (22021), so "the result is accepted" is
+ * asserted, not only "the parameter looks clean".
+ * ---------------------------------------------------------------------------
+ */
+
+const JOB_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const AGENT_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+
+const NUL: string = String.fromCharCode(0);
+const FFFD: string = String.fromCharCode(0xfffd);
+const HIGH_SURROGATE: string = String.fromCharCode(0xd83d);
+const LOW_SURROGATE: string = String.fromCharCode(0xde80);
+// U+1F680, a whole pair: a character like any other.
+const ROCKET: string = HIGH_SURROGATE + LOW_SURROGATE;
+
+const SECRET_VALUE: string = "c3VwZXItc2VjcmV0LXBhc3N3b3Jk";
+
+// Parameter positions in the UPDATE (1-based $n minus one).
+const RAW_OUTPUT_PARAM: number = 1;
+const RAW_ERROR_MESSAGE_PARAM: number = 3;
+const REDACTED_OUTPUT_PARAM: number = 9;
+const REDACTED_ERROR_MESSAGE_PARAM: number = 10;
+
+interface CapturedQuery {
+  sql: string;
+  params: Array<unknown>;
+}
+
+// What Postgres answers when a text parameter carries U+0000.
+class PostgresInvalidByteSequenceError extends Error {
+  public readonly code: string = "22021";
+
+  public constructor() {
+    super('invalid byte sequence for encoding "UTF8": 0x00');
+  }
+}
+
+function containsNul(value: unknown): boolean {
+  if (typeof value === "string") {
+    return value.includes(NUL);
+  }
+
+  if (Array.isArray(value)) {
+    return value.some((item: unknown) => {
+      return containsNul(item);
+    });
+  }
+
+  return false;
+}
+
+// Every text parameter, flattened (the origins list is an array of text).
+function textParams(query: CapturedQuery): Array<string> {
+  const texts: Array<string> = [];
+
+  for (const param of query.params) {
+    if (typeof param === "string") {
+      texts.push(param);
+    } else if (Array.isArray(param)) {
+      for (const item of param) {
+        if (typeof item === "string") {
+          texts.push(item);
+        }
+      }
+    }
+  }
+
+  return texts;
+}
+
+// A lone surrogate half anywhere in the text.
+function hasLoneSurrogate(text: string): boolean {
+  for (let index: number = 0; index < text.length; index++) {
+    const code: number = text.charCodeAt(index);
+
+    if (code >= 0xd800 && code <= 0xdbff) {
+      const next: number = text.charCodeAt(index + 1);
+
+      if (next >= 0xdc00 && next <= 0xdfff) {
+        index++;
+        continue;
+      }
+
+      return true;
+    }
+
+    if (code >= 0xdc00 && code <= 0xdfff) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+describe("RunnerJobService.submitResult stores text Postgres can hold", () => {
+  let queries: Array<CapturedQuery>;
+  let postgresLikeQuery: jest.Mock;
+
+  beforeEach(() => {
+    queries = [];
+    postgresLikeQuery = jest
+      .fn()
+      .mockImplementation(
+        async (sql: string, params: Array<unknown>): Promise<unknown> => {
+          queries.push({ sql, params });
+
+          if (containsNul(params)) {
+            throw new PostgresInvalidByteSequenceError();
+          }
+
+          return [[{ _id: JOB_ID.toString() }], 1];
+        },
+      );
+    jest.spyOn(PostgresAppInstance, "getDataSource").mockReturnValue({
+      query: postgresLikeQuery,
+    } as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function lastQuery(): CapturedQuery {
+    const query: CapturedQuery | undefined = queries[queries.length - 1];
+
+    if (!query) {
+      throw new Error("submitResult never queried the database");
+    }
+
+    return query;
+  }
+
+  /*
+   * The stand-in refuses what Postgres refuses; without this the tests
+   * below would pass against a database that accepts anything.
+   */
+  it("negative control: the stand-in database refuses a NUL in any text parameter, as Postgres does", async () => {
+    await expect(
+      postgresLikeQuery("SELECT $1::text", [`a${NUL}b`]),
+    ).rejects.toBeInstanceOf(PostgresInvalidByteSequenceError);
+    await expect(
+      postgresLikeQuery("SELECT $1::text[]", [["ok", `x${NUL}`]]),
+    ).rejects.toBeInstanceOf(PostgresInvalidByteSequenceError);
+    await expect(
+      postgresLikeQuery("SELECT $1::text", ["no nul"]),
+    ).resolves.toBeDefined();
+  });
+
+  it("accepts a kubectl logs output with NUL bytes, stored with U+FFFD where each NUL was", async () => {
+    const output: string = `[stdout]\n2026-09-23T10:00:00Z GET /health 200\n${NUL}${NUL}${NUL}2026-09-23T10:00:01Z GET /health 200\n`;
+
+    const accepted: boolean = await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output,
+      exitCode: 0,
+    });
+
+    expect(accepted).toBe(true);
+    const query: CapturedQuery = lastQuery();
+    expect(query.params[RAW_OUTPUT_PARAM]).toBe(
+      `[stdout]\n2026-09-23T10:00:00Z GET /health 200\n${FFFD}${FFFD}${FFFD}2026-09-23T10:00:01Z GET /health 200\n`,
+    );
+    expect(query.params[REDACTED_OUTPUT_PARAM]).toBe(
+      query.params[RAW_OUTPUT_PARAM],
+    );
+
+    for (const text of textParams(query)) {
+      expect(text.includes(NUL)).toBe(false);
+    }
+  });
+
+  it("accepts a NUL in the error message too, for both the verbatim and the redacted copy", async () => {
+    const accepted: boolean = await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: false,
+      output: `partial${NUL}`,
+      exitCode: 1,
+      errorMessage: `Exit code 1: error: unexpected byte ${NUL} in stream`,
+    });
+
+    expect(accepted).toBe(true);
+    const query: CapturedQuery = lastQuery();
+    expect(query.params[RAW_ERROR_MESSAGE_PARAM]).toBe(
+      `Exit code 1: error: unexpected byte ${FFFD} in stream`,
+    );
+    expect(query.params[REDACTED_ERROR_MESSAGE_PARAM]).toBe(
+      `Exit code 1: error: unexpected byte ${FFFD} in stream`,
+    );
+    expect(query.params[RAW_OUTPUT_PARAM]).toBe(`partial${FFFD}`);
+  });
+
+  /*
+   * The origin is decided inside the UPDATE, so one submission carries the
+   * text for every origin. A NUL in a runbook step's output failed the write
+   * the same way before round four (the runbook lane on master had the same
+   * defect).
+   */
+  it("covers every origin: the verbatim copy a runbook row keeps is cleaned too", async () => {
+    await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output: `binary${NUL}blob`,
+    });
+
+    const query: CapturedQuery = lastQuery();
+    expect(query.sql).toContain(
+      `WHEN "origin" = ANY($9::text[]) THEN $10::text`,
+    );
+    expect(query.sql).toContain("ELSE $2::text");
+    expect(query.params[8]).toContain(RunnerJobOrigin.AiInvestigation);
+    expect(query.params[8]).not.toContain(RunnerJobOrigin.Runbook);
+    expect(query.params[RAW_OUTPUT_PARAM]).toBe(`binary${FFFD}blob`);
+  });
+
+  /*
+   * Cleaned BEFORE redaction: a NUL next to a Secret value (describe prints
+   * ConfigMap/Secret data verbatim) must not stop the value being masked.
+   */
+  it("still masks a Secret value for an AI job when the output also carries a NUL", async () => {
+    const output: string = [
+      "[stdout]",
+      "apiVersion: v1",
+      "kind: Secret",
+      "data:",
+      `  password: ${SECRET_VALUE}`,
+      `  blob: AAAA${NUL}BBBB`,
+      "type: Opaque",
+    ].join("\n");
+
+    const accepted: boolean = await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output,
+    });
+
+    expect(accepted).toBe(true);
+    const redacted: string = lastQuery().params[
+      REDACTED_OUTPUT_PARAM
+    ] as string;
+    expect(redacted).not.toContain(SECRET_VALUE);
+    expect(redacted).toContain(KUBECTL_REDACTED_MARKER);
+    expect(redacted.includes(NUL)).toBe(false);
+  });
+
+  it("replaces a lone surrogate half with U+FFFD and keeps a whole pair", async () => {
+    await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output: `cut here ${HIGH_SURROGATE}| orphan ${LOW_SURROGATE}| whole ${ROCKET} | reversed ${LOW_SURROGATE}${HIGH_SURROGATE}`,
+    });
+
+    const stored: string = lastQuery().params[RAW_OUTPUT_PARAM] as string;
+    expect(stored).toBe(
+      `cut here ${FFFD}| orphan ${FFFD}| whole ${ROCKET} | reversed ${FFFD}${FFFD}`,
+    );
+    expect(hasLoneSurrogate(stored)).toBe(false);
+    expect(
+      hasLoneSurrogate(lastQuery().params[REDACTED_OUTPUT_PARAM] as string),
+    ).toBe(false);
+  });
+
+  /*
+   * Negative control: ordinary text — control characters Postgres does
+   * accept, non-Latin scripts, emoji, an empty string — is bound exactly
+   * as it arrived.
+   */
+  it("negative control: text without an unstorable character is bound unchanged", async () => {
+    const output: string = `clean output\ttab\r\nbell\u0007 ünïcödé 日本語 ${ROCKET} ${FFFD}`;
+
+    const accepted: boolean = await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: true,
+      output,
+      errorMessage: "",
+    });
+
+    expect(accepted).toBe(true);
+    expect(lastQuery().params[RAW_OUTPUT_PARAM]).toBe(output);
+    expect(lastQuery().params[RAW_ERROR_MESSAGE_PARAM]).toBe("");
+  });
+
+  it("negative control: an absent output and error message stay null", async () => {
+    await RunnerJobService.submitResult({
+      jobId: JOB_ID,
+      agentId: AGENT_ID,
+      success: false,
+    });
+
+    const query: CapturedQuery = lastQuery();
+    expect(query.params[RAW_OUTPUT_PARAM]).toBeNull();
+    expect(query.params[RAW_ERROR_MESSAGE_PARAM]).toBeNull();
+    expect(query.params[REDACTED_OUTPUT_PARAM]).toBeNull();
+    expect(query.params[REDACTED_ERROR_MESSAGE_PARAM]).toBeNull();
+  });
+
+  it("toStorableText is the pure transform: NUL and lone halves become U+FFFD, nothing else moves", () => {
+    expect(RUNNER_JOB_UNSTORABLE_CHARACTER_REPLACEMENT).toBe(FFFD);
+    expect(RunnerJobServiceClass.toStorableText("")).toBe("");
+    expect(RunnerJobServiceClass.toStorableText(NUL)).toBe(FFFD);
+    expect(RunnerJobServiceClass.toStorableText(`${NUL}${NUL}`)).toBe(
+      `${FFFD}${FFFD}`,
+    );
+    expect(RunnerJobServiceClass.toStorableText(`a${NUL}b${NUL}c`)).toBe(
+      `a${FFFD}b${FFFD}c`,
+    );
+    expect(RunnerJobServiceClass.toStorableText(HIGH_SURROGATE)).toBe(FFFD);
+    expect(RunnerJobServiceClass.toStorableText(LOW_SURROGATE)).toBe(FFFD);
+    expect(RunnerJobServiceClass.toStorableText(ROCKET)).toBe(ROCKET);
+    expect(
+      RunnerJobServiceClass.toStorableText(`${ROCKET}${HIGH_SURROGATE}`),
+    ).toBe(`${ROCKET}${FFFD}`);
+    // Called twice, the same answer: the global patterns keep no state.
+    expect(RunnerJobServiceClass.toStorableText(`x${NUL}`)).toBe(`x${FFFD}`);
+    expect(RunnerJobServiceClass.toStorableText(`x${NUL}`)).toBe(`x${FFFD}`);
+  });
+});