deepdebug-local-agent 1.7.0 → 1.8.0

package/test/incident-detector/wiring.test.js

@@ -0,0 +1,165 @@
+// F3-11b: the detector wired on the REAL v2 session (buildV2Link) against the in-memory reference control plane, with real files.
+// What the CP receives is checked on the wire: 9 metadata fields, and never a word of the error text.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { ReferenceCp, TENANT, AGENT, waitFor } from "../la-protocol-v2/helpers/reference-cp.js";
+import { signingFor } from "../la-protocol-v2/helpers/la-rig.js";
+import { buildV2Link } from "../../src/la-protocol-v2/runtime.js";
+import { createIncidentDetector } from "../../src/incident-detector/detector.js";
+import { resolveIncidentDetectorConfig } from "../../src/incident-detector/config.js";
+
+const VECTORS = JSON.parse(fs.readFileSync(path.join(path.dirname(new URL(import.meta.url).pathname), "parity.vectors.json"), "utf8"));
+const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), "la-incw-"));
+const GH = "ghp_" + "A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8";
+const CANARIES = ["CANARY-MSG-7731", "CanaryVault", "/home/customer/secret-app", "order-9001-detail", GH];
+
+async function linkFor(cp, env, root = tmp()) {
+    const logs = [];
+    const log = { info: (m) => logs.push(m), log: (m) => logs.push(m), warn: (m) => logs.push(m), error: (m) => logs.push(m) };
+    const wsManager = { list: () => [{ id: "ws-1", root, tenantId: TENANT }] };
+    const link = await buildV2Link({ tenantId: TENANT, agentId: AGENT, signing: signingFor({ keyId: cp.keyId, publicKeyRaw: cp.publicKeyRaw }, "enforce"), wsManager, getWorkspaceRoot: () => root, log, env });
+    const transport = { send: (t) => cp.feed(t), close() {}, bufferedAmount: () => 0 };
+    cp.attach((t) => queueMicrotask(() => link.session.handleText(t, transport)), () => {});
+    link.session.attach(transport);
+    await waitFor(() => link.session.state === "ready");
+    return { link, logs };
+}
+const candidates = (cp) => cp.received.filter((f) => f.type === "incident.candidate");
+const envFor = (dir, extra = {}) => ({
+    LOCAL_AGENT_INCIDENT_DETECTOR: "true", LOCAL_AGENT_INCIDENT_LOG_FILES: path.join(dir, "billing-api.log"), LOCAL_AGENT_INCIDENT_STORE_DIR: path.join(dir, "store"),
+    LOCAL_AGENT_INCIDENT_FILE_POLL_MS: "50", LOCAL_AGENT_INCIDENT_FLUSH_MS: "300", LOCAL_AGENT_DLP_MODE: "enforce", ...extra,
+});
+
+test("flag off (unset or any non-true value): no capability, nothing started, the log file is not read, no store dir; flag on without a source warns and starts nothing", async () => {
+    for (const v of [undefined, "false", "maybe"]) {
+        const dir = tmp();
+        fs.writeFileSync(path.join(dir, "billing-api.log"), "");
+        const cp = new ReferenceCp();
+        const { link } = await linkFor(cp, { LOCAL_AGENT_INCIDENT_DETECTOR: v, LOCAL_AGENT_INCIDENT_LOG_FILES: path.join(dir, "billing-api.log"), LOCAL_AGENT_INCIDENT_STORE_DIR: path.join(dir, "store") });
+        fs.appendFileSync(path.join(dir, "billing-api.log"), "2026-10-29 10:00:00 ERROR java.lang.IllegalStateException: boom\n");
+        await new Promise((r) => setTimeout(r, 150));
+        assert.equal(link.incidents, undefined);
+        assert.ok(!cp.registers[0].capabilities.includes("incident.candidate"));
+        assert.equal(candidates(cp).length, 0);
+        assert.ok(!fs.existsSync(path.join(dir, "store")), "no store dir");
+        link.close();
+    }
+    const cp = new ReferenceCp();
+    const { link, logs } = await linkFor(cp, { LOCAL_AGENT_INCIDENT_DETECTOR: "true" });
+    assert.equal(link.incidents, undefined);
+    assert.ok(logs.some((l) => /no source is configured/.test(l)));
+    assert.ok(!cp.registers[0].capabilities.includes("incident.candidate"));
+    link.close();
+});
+
+test("flag on + file source: candidates carry the 9 metadata fields and nothing of the text; the detail is in the local store; the capability is announced", async () => {
+    const dir = tmp(); const file = path.join(dir, "billing-api.log");
+    fs.writeFileSync(file, "");
+    const cp = new ReferenceCp();
+    const { link } = await linkFor(cp, envFor(dir));
+    assert.ok(cp.registers[0].capabilities.includes("incident.candidate"));
+    await new Promise((r) => setTimeout(r, 120));   // the tailer has taken its offset
+    const stack = `\tat com.acme.CanaryVault.open(CanaryVault.java:44)\n\tat com.acme.Main.run(Main.java:9)\n`;
+    fs.appendFileSync(file,
+        `2026-10-29 10:00:00 ERROR c.a.Order : java.lang.IllegalStateException: CANARY-MSG-7731 order 9001 not found\n`
+        + `java.lang.IllegalStateException: CANARY-MSG-7731 order-9001-detail at /home/customer/secret-app token ${GH}\n` + stack
+        + "2026-10-29 10:00:01 INFO nothing to see\n");
+    await waitFor(() => candidates(cp).length >= 1, 4000);
+    const c = candidates(cp)[0];
+    assert.deepEqual(Object.keys(c.payload).sort(), ["count", "environment", "errorHash", "fingerprint", "firstSeen", "lastSeen", "logCategory", "service", "severity"]);
+    assert.equal(c.payload.service, "billing-api");
+    assert.equal(c.payload.environment, "production");
+    assert.equal(c.payload.severity, "high");
+    assert.equal(c.payload.logCategory, "exception");
+    assert.equal(c.payload.count, 1);
+    assert.match(c.payload.errorHash, /^[0-9a-f]{32}$/);
+    assert.match(c.payload.fingerprint, /^[0-9a-f]{64}$/);
+    assert.equal(c.workspaceId, "");
+    // NOTHING of the text on the wire (every raw frame of the session, both the handshake and the data)
+    const wire = cp.rawIn.join("\n");
+    for (const w of CANARIES) assert.ok(!wire.includes(w), `the wire must not carry ${w.slice(0, 12)}...`);
+    // the detail stayed local, masked
+    const detail = await link.incidents.getDetail(c.payload.errorHash);
+    assert.equal(detail.length, 1);
+    assert.ok(detail[0].message.includes("CANARY-MSG-7731"));
+    assert.ok(!JSON.stringify(detail).includes(GH), "the DLP masked the token before it was stored");
+    assert.ok(detail[0].stack.includes("CanaryVault"));
+    assert.equal(detail[0].stackBytes, Buffer.byteLength(`java.lang.IllegalStateException: CANARY-MSG-7731 order-9001-detail at /home/customer/secret-app token ${GH}\n` + stack.replace(/\n$/, "")), "the size of the stack is local metadata");
+    assert.equal(fs.statSync(path.join(dir, "store", "incident-detail.jsonl")).mode & 0o777, 0o600);
+    // the same error with other ids: same errorHash, ONE window: the count grows in a batched update
+    for (let i = 0; i < 5; i++) fs.appendFileSync(file, `2026-10-29 10:00:0${2 + i} ERROR c.a.Order : java.lang.IllegalStateException: CANARY-MSG-7731 order ${9100 + i} not found\n`);
+    await waitFor(() => candidates(cp).length >= 2, 4000);
+    const u = candidates(cp).at(-1).payload;
+    assert.equal(u.firstSeen, c.payload.firstSeen, "same window");
+    assert.ok(u.count >= 2);
+    const wire2 = cp.rawIn.join("\n");
+    for (const w of CANARIES) assert.ok(!wire2.includes(w));
+    // the audit has no text either
+    assert.ok(!JSON.stringify(link.incidents.audit.tail(100)).includes("CANARY"));
+    link.close();
+});
+
+test("flag on: noise, INFO/WARN, duplicates and an entry without a message produce no candidate", async () => {
+    const dir = tmp(); const file = path.join(dir, "billing-api.log");
+    fs.writeFileSync(file, "");
+    const cp = new ReferenceCp();
+    const { link } = await linkFor(cp, envFor(dir));
+    await new Promise((r) => setTimeout(r, 120));
+    fs.appendFileSync(file, [
+        '2026-10-29 10:00:00 ERROR {code=9, message=Ready condition status changed to False}',
+        "2026-10-29 10:00:01 WARN java.lang.RuntimeException: not an error level",
+        "2026-10-29 10:00:02 ERROR GET /actuator/health Exception",
+        "2026-10-29 10:00:03 ERROR plain failure without any marker",
+        "2026-10-29 10:00:04 ERROR org.apache.maven.lifecycle.LifecycleExecutionException: build",
+        "",
+    ].join("\n"));
+    await new Promise((r) => setTimeout(r, 500));
+    assert.equal(candidates(cp).length, 0);
+    const s = link.incidents.detector.stats;
+    assert.equal(s.noise, 1, "the Maven build failure is significant to ErrorDetector but infra/build noise to LogNoiseClassifier");
+    assert.equal(s.insignificant, 4, JSON.stringify(s));
+    assert.equal(s.detected, 0);
+    link.close();
+});
+
+// ------------------------------------------------------------------------------------------ the Java vectors through the whole pipeline
+
+test("parity end to end: every significant vector goes through detector -> aggregator -> emitter and the candidate carries the Java errorHash and fingerprint", async () => {
+    const sent = [];
+    const session = { state: "ready", on() {}, off() {}, async send(type, payload) { sent.push(payload); } };
+    const { createCandidateEmitter } = await import("../../src/incident-detector/emitter.js");
+    const { createDetailStore } = await import("../../src/incident-detector/store.js");
+    const config = resolveIncidentDetectorConfig({ LOCAL_AGENT_INCIDENT_DETECTOR: "1", LOCAL_AGENT_INCIDENT_STORE_DIR: path.join(tmp(), "s"), LOCAL_AGENT_INCIDENT_MAX_PENDING: "5000", LOCAL_AGENT_INCIDENT_MAX_EMITS_PER_MINUTE: "600", LOCAL_AGENT_INCIDENT_MAX_TRACKED: "5000" }, () => {});
+    config.emitBurst = 100_000;
+    const emitter = createCandidateEmitter({ session, config, env: {}, log: { warn() {}, info() {}, log() {} } });
+    const store = createDetailStore({ dir: config.storeDir, maxBytes: 8 << 20, maxQueue: 100, messageChars: 1000, stackChars: 1000, samplesPerWindow: 1, env: {} });
+    const det = createIncidentDetector({ config, emitter, store, log: console });
+    let expected = 0;
+    const want = new Map();
+    for (const c of VECTORS.cases) {
+        const e = c.expect;
+        if (!e.significant || e.noiseClass !== "app_error" || e.fingerprint == null) continue;
+        const svc = `svc-${expected}`;
+        await det.ingest({ severity: c.severity, message: c.message, stacktrace: c.stack, service: svc, tsMs: 1_700_000_000_000 + expected });
+        want.set(svc, e);
+        expected++;
+    }
+    await emitter.flush();
+    assert.ok(expected >= 40, `${expected} significant vectors`);
+    // errorHash is shared by cases with the same normalised first line: one window per errorHash, so compare per hash
+    const byHash = new Map(sent.map((p) => [p.errorHash, p]));
+    const hashes = new Set([...want.values()].map((e) => e.groupHash));
+    assert.equal(byHash.size, hashes.size, "one window per Java errorHash");
+    for (const e of want.values()) {
+        const p = byHash.get(e.groupHash);
+        assert.ok(p, "candidate for " + e.groupHash);
+    }
+    // the first occurrence of each hash carries ITS fingerprint (first one wins, as in incident_dedup_log)
+    const firstOfHash = new Map();
+    for (const e of want.values()) if (!firstOfHash.has(e.groupHash)) firstOfHash.set(e.groupHash, e);
+    for (const [h, e] of firstOfHash) assert.equal(byHash.get(h).fingerprint, e.fingerprint, "Java fingerprint of the first occurrence of " + h);
+    emitter.close();
+});