@shipfox/api-logs 10.1.0 → 11.0.0

package/src/presentation/routes/read-logs.test.ts

@@ -50,13 +50,15 @@ const fakeUserAuth: AuthMethod = {
       throw new ClientError('Invalid user token', 'unauthorized', {status: 401});
     }
     const header = request.headers['x-test-workspace'];
-    const workspaceId = Array.isArray(header) ? header[0] : header;
+    const value = Array.isArray(header) ? header[0] : header;
+    const [workspaceId, status] = value?.split('|') ?? [];
+    const workspaceStatus = status === 'suspended' || status === 'deleted' ? status : 'active';
     setUserContext(
       request,
       buildUserContext({
         userId: 'user-1',
         email: 'user@example.com',
-        memberships: workspaceId ? [{workspaceId, role: 'admin'}] : [],
+        memberships: workspaceId ? [{workspaceId, role: 'admin', workspaceStatus}] : [],
       }),
     );
     return Promise.resolve();
@@ -174,11 +176,11 @@ describe('GET /steps/:stepId/attempts/:attempt/logs', () => {
     return `/steps/${stepId}/attempts/${attempt}/logs?cursor=${cursor}`;
   }
 
-  function authedGet(stream: AttemptStream, cursor: number, workspaceId = stream.workspaceId) {
+  function authedGet(stream: AttemptStream, cursor: number, workspaceClaim = stream.workspaceId) {
     return app.inject({
       method: 'GET',
       url: readUrl(stream.stepId, stream.attempt, cursor),
-      headers: {authorization: 'Bearer user', 'x-test-workspace': workspaceId},
+      headers: {authorization: 'Bearer user', 'x-test-workspace': workspaceClaim},
     });
   }
 
@@ -288,6 +290,18 @@ describe('GET /steps/:stepId/attempts/:attempt/logs', () => {
     expect(res.json().code).toBe('not-found');
   });
 
+  it('returns workspace-suspended for a suspended membership claim', async () => {
+    const stream = await arrangeStream({
+      workspaceId: crypto.randomUUID(),
+      chunks: [ndjsonBody(outputLine('secret\n'))],
+    });
+
+    const res = await authedGet(stream, 0, `${stream.workspaceId}|suspended`);
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   it('serves an open stream inline with the next cursor and stream state', async () => {
     const workspaceId = crypto.randomUUID();
     const lineA = outputLine('alpha\n');

package/src/presentation/routes/read-logs.ts

@@ -1,4 +1,4 @@
-import {requireUserContext} from '@shipfox/api-auth-context';
+import {requireWorkspaceResourceAccess} from '@shipfox/api-auth-context';
 import {readLogsQuerySchema, readLogsResponseSchema} from '@shipfox/api-logs-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -22,16 +22,20 @@ export const readLogsRoute = defineRoute({
     },
   },
   handler: async (request) => {
-    const user = requireUserContext(request);
     const {stepId, attempt} = request.params;
     const {cursor} = request.query;
 
     const stream = await getStreamByStepAttempt({stepId, attempt});
-    // 404 covers both "no such stream" and "not your workspace" so the endpoint never
-    // leaks the existence of another workspace's step.
-    if (!stream || !user.canAccess(stream.workspaceId)) {
+    // Missing streams and memberships remain 404 so the endpoint never leaks another
+    // workspace's step; lifecycle claims propagate their stable access errors.
+    if (!stream) {
       throw new ClientError('Logs not found', 'not-found', {status: 404});
     }
+    requireWorkspaceResourceAccess({
+      request,
+      workspaceId: stream.workspaceId,
+      notFoundError: new ClientError('Logs not found', 'not-found', {status: 404}),
+    });
 
     return toReadLogsDto(await buildLogReadResult(stream, cursor));
   },

package/test/fixtures/claude-session/agent-step.jsonl

@@ -0,0 +1,12 @@
+{"type":"system","subtype":"init","apiKeySource":"user","claude_code_version":"1.0.0","cwd":"/workspace","tools":["Read","Bash"],"mcp_servers":[],"model":"claude-sonnet-4-20250514","permissionMode":"default","slash_commands":[],"output_style":"default","skills":[],"plugins":[],"uuid":"init-1","session_id":"session-1"}
+{"type":"assistant","message":{"id":"msg-1","type":"message","role":"assistant","model":"claude-sonnet-4-20250514","content":[{"type":"text","text":"I will inspect the repository."},{"type":"tool_use","id":"toolu-1","name":"Read","input":{"file_path":"README.md"}}],"stop_reason":"tool_use","stop_sequence":null,"usage":{"input_tokens":100,"output_tokens":20}},"parent_tool_use_id":null,"uuid":"assistant-1","session_id":"session-1"}
+{"type":"user","message":{"role":"user","content":[{"type":"tool_result","tool_use_id":"toolu-1","content":[{"type":"text","text":"# Shipfox\n"}],"is_error":false}]},"parent_tool_use_id":null,"uuid":"user-1","session_id":"session-1"}
+{"type":"system","subtype":"permission_denied","tool_name":"mcp__shipfox_outputs__set_output","tool_use_id":"toolu-2","decision_reason_type":"mode","decision_reason":"Permission mode","message":"Permission denied","uuid":"permission-1","session_id":"session-1"}
+{"type":"system","subtype":"api_retry","attempt":2,"max_retries":3,"retry_delay_ms":1500,"error_status":429,"error":"rate_limit","uuid":"retry-1","session_id":"session-1"}
+{"type":"system","subtype":"hook_response","hook_id":"hook-1","hook_name":"PreToolUse","hook_event":"PreToolUse","output":"Hook completed","stdout":"","stderr":"","exit_code":0,"outcome":"success","uuid":"hook-1","session_id":"session-1"}
+{"type":"system","subtype":"compact_boundary","compact_metadata":{"trigger":"auto","pre_tokens":12000,"post_tokens":4000,"duration_ms":250},"uuid":"compact-1","session_id":"session-1"}
+{"type":"result","subtype":"success","is_error":false,"result":"First turn response","duration_ms":1200,"duration_api_ms":900,"num_turns":1,"total_cost_usd":0.0042,"uuid":"result-1","session_id":"session-1"}
+{"type":"system","subtype":"init","apiKeySource":"user","claude_code_version":"1.0.0","cwd":"/workspace","tools":["Read","Bash"],"mcp_servers":[],"model":"claude-sonnet-4-20250514","permissionMode":"default","slash_commands":[],"output_style":"default","skills":[],"plugins":[],"uuid":"init-2","session_id":"session-1"}
+{"type":"user","message":{"role":"user","content":"The previous turn ended without setting required workflow outputs: answer. Call set_output for each missing key, then provide your final response."},"parent_tool_use_id":null,"isSynthetic":true,"uuid":"user-2","session_id":"session-1"}
+{"type":"assistant","message":{"id":"msg-2","type":"message","role":"assistant","model":"claude-sonnet-4-20250514","content":[{"type":"text","text":"The answer is ready."}],"stop_reason":"end_turn","stop_sequence":null,"usage":{"input_tokens":120,"output_tokens":8}},"parent_tool_use_id":null,"uuid":"assistant-2","session_id":"session-1"}
+{"type":"result","subtype":"success","is_error":false,"result":"Final response","duration_ms":800,"duration_api_ms":600,"num_turns":1,"total_cost_usd":0.0021,"uuid":"result-2","session_id":"session-1"}

package/test/fixtures/claude-session/sdk-system-subtypes.json

@@ -0,0 +1,32 @@
+{
+  "package": "@anthropic-ai/claude-agent-sdk",
+  "version": "0.3.200",
+  "subtypes": [
+    "api_retry",
+    "commands_changed",
+    "compact_boundary",
+    "elicitation_complete",
+    "files_persisted",
+    "hook_progress",
+    "hook_response",
+    "hook_started",
+    "informational",
+    "init",
+    "local_command_output",
+    "memory_recall",
+    "mirror_error",
+    "model_refusal_fallback",
+    "model_refusal_no_fallback",
+    "notification",
+    "permission_denied",
+    "plugin_install",
+    "session_state_changed",
+    "status",
+    "task_notification",
+    "task_progress",
+    "task_started",
+    "task_updated",
+    "thinking_tokens",
+    "worker_shutting_down"
+  ]
+}

package/test/fixtures/claude-session.ts

@@ -0,0 +1,45 @@
+import {readFileSync} from 'node:fs';
+import type {AgentSessionRecord} from '#core/session/session-record.js';
+
+export interface ClaudeSystemSubtypeFixture {
+  package: string;
+  version: string;
+  subtypes: string[];
+}
+
+const SDK_ENTRY_URL = import.meta.resolve('@anthropic-ai/claude-agent-sdk');
+const SDK_TYPES_URL = new URL('./sdk.d.ts', SDK_ENTRY_URL);
+
+export function readClaudeSessionFixture(name: string): AgentSessionRecord[] {
+  const contents = readFileSync(
+    new URL(`./claude-session/${name}`, import.meta.url),
+    'utf8',
+  ).trim();
+
+  return contents.split('\n').map((data, index) => ({data, ts: index + 1}));
+}
+
+export function readClaudeSystemSubtypeFixture(): ClaudeSystemSubtypeFixture {
+  const contents = readFileSync(
+    new URL('./claude-session/sdk-system-subtypes.json', import.meta.url),
+    'utf8',
+  );
+  return JSON.parse(contents) as ClaudeSystemSubtypeFixture;
+}
+
+export function readInstalledClaudeSdkVersion(): string {
+  const contents = readFileSync(new URL('./package.json', SDK_TYPES_URL), 'utf8');
+  const packageJson = JSON.parse(contents) as {version?: unknown};
+  if (typeof packageJson.version !== 'string') {
+    throw new Error('The installed Claude SDK package has no version');
+  }
+  return packageJson.version;
+}
+
+export function readInstalledClaudeSystemSubtypes(): string[] {
+  const declaration = readFileSync(SDK_TYPES_URL, 'utf8');
+  return [...declaration.matchAll(/type: 'system';\s+subtype: '([^']+)'/g)]
+    .map((match) => match[1])
+    .filter((subtype): subtype is string => subtype !== undefined)
+    .sort();
+}