p-dev-harness 0.3.1 → 0.4.0

package/workspace-snapshot/files/tests/observability/sentry-envelope.test.ts

@@ -0,0 +1,289 @@
+import { serializeEnvelope } from "@sentry/core";
+import { describe, expect, it } from "vitest";
+import { createSentryErrorTransport } from "../../src/observability/adapters/sentry.js";
+import { ALLOWED_SENTRY_TAG_KEYS } from "../../src/observability/privacy-schema.js";
+import {
+  findSentryPrivacyViolation,
+  scrubOutboundSentryEvent,
+} from "../../src/observability/sentry-outbound-privacy.js";
+import type { ErrorEvent } from "@sentry/node";
+import {
+  assertCapturedSentryEnvelopePrivacy,
+  assertNdjsonSentryBodyPrivacy,
+} from "./sentry-privacy-assertions.js";
+
+const PRIVACY_FIXTURE = [
+  "ghp_1234567890abcdef",
+  "weston@example.com",
+  "/Users/weston/Code/secret-repo",
+  "https://github.com/weston/private-repo?token=abc",
+].join(" ");
+
+const BASE_CONTEXT = {
+  observability_schema_version: 1,
+  package_version: "0.4.0",
+  release_sha: "abc123",
+  session_id: "session-123",
+  runtime_mode: "packaged",
+  os_family: "linux",
+  cpu_arch_family: "x64",
+  node_major_version: 22,
+  lifecycle_phase: "provisioning",
+} as const;
+
+function createCapturingTransport(captured: unknown[]) {
+  return createSentryErrorTransport({
+    dsn: "http://public@127.0.0.1:9999/1",
+    release: "p-dev-harness@0.3.1",
+    transport: () =>
+      ({
+        send: async (envelope: unknown) => {
+          captured.push(envelope);
+          return { statusCode: 200 };
+        },
+        flush: async () => true,
+        close: async () => undefined,
+      }) as never,
+  });
+}
+
+describe("observability sentry adapter envelope", () => {
+  it("constructs the outbound event to the approved privacy schema", async () => {
+    const captured: unknown[] = [];
+    const transport = createCapturingTransport(captured);
+
+    transport.captureError(
+      {
+        lifecyclePhase: "provisioning",
+        productErrorCode: "provision_failed",
+        errorCategory: "server",
+        message: PRIVACY_FIXTURE,
+        cause: new Error(PRIVACY_FIXTURE),
+      },
+      BASE_CONTEXT,
+    );
+
+    await transport.flush(2_000);
+
+    expect(captured).toHaveLength(1);
+    const events = assertCapturedSentryEnvelopePrivacy(captured[0]);
+    expect(events).toHaveLength(1);
+    const event = events[0]!;
+    expect(event.tags?.product_error_code).toBe("provision_failed");
+    expect(event.fingerprint).toEqual(["provision_failed", "provisioning"]);
+    expect(event.user).toBeUndefined();
+    expect(event.request).toBeUndefined();
+    expect(event.contexts).toBeUndefined();
+    expect(event.breadcrumbs).toBeUndefined();
+    expect(event.transaction).toBeUndefined();
+    expect(event.server_name).toBeUndefined();
+    expect(JSON.stringify(event)).not.toMatch(/trace_id|span_id|parent_span_id|ip_address/);
+
+    const ndjson = String(serializeEnvelope(captured[0] as never));
+    const roundTripEvents = assertNdjsonSentryBodyPrivacy(ndjson);
+    expect(roundTripEvents[0]?.tags?.product_error_code).toBe("provision_failed");
+  });
+
+  it("omits tracing and profiling client options", async () => {
+    const captured: unknown[] = [];
+    const transport = createCapturingTransport(captured);
+    transport.captureError(
+      {
+        lifecyclePhase: "provisioning",
+        productErrorCode: "provision_failed",
+        errorCategory: "server",
+      },
+      BASE_CONTEXT,
+    );
+    await transport.flush(2_000);
+    expect(captured).toHaveLength(1);
+    const envelope = captured[0] as [Record<string, unknown>, unknown[]];
+    expect(envelope[0].trace).toBeUndefined();
+    const events = assertCapturedSentryEnvelopePrivacy(captured[0]);
+    expect(JSON.stringify(events[0])).not.toContain("trace_id");
+  });
+
+  it("keeps concurrent captures bound to their own product metadata", async () => {
+    const captured: unknown[] = [];
+    let releaseFirst: (() => void) | undefined;
+    const firstSendBlocked = new Promise<void>((resolve) => {
+      releaseFirst = resolve;
+    });
+    let sendCount = 0;
+    const transport = createSentryErrorTransport({
+      dsn: "http://public@127.0.0.1:9999/1",
+      release: "p-dev-harness@0.3.1",
+      transport: () =>
+        ({
+          send: async (envelope: unknown) => {
+            sendCount += 1;
+            if (sendCount === 1) {
+              await firstSendBlocked;
+            }
+            captured.push(envelope);
+            return { statusCode: 200 };
+          },
+          flush: async () => true,
+        }) as never,
+    });
+
+    transport.captureError(
+      {
+        lifecyclePhase: "provisioning",
+        productErrorCode: "provision_failed",
+        errorCategory: "server",
+        cause: new Error("first error"),
+      },
+      BASE_CONTEXT,
+    );
+    transport.captureError(
+      {
+        lifecyclePhase: "configure_route",
+        productErrorCode: "configure_request_error",
+        errorCategory: "unexpected",
+        cause: new Error("second error"),
+      },
+      { ...BASE_CONTEXT, lifecycle_phase: "configure_route" },
+    );
+    releaseFirst?.();
+    await transport.flush(2_000);
+
+    expect(captured).toHaveLength(2);
+    const events = captured.flatMap((envelope) =>
+      assertCapturedSentryEnvelopePrivacy(envelope),
+    );
+    expect(events.map((event) => event.tags?.product_error_code).sort()).toEqual([
+      "configure_request_error",
+      "provision_failed",
+    ]);
+    const provisionEvent = events.find(
+      (event) => event.tags?.product_error_code === "provision_failed",
+    );
+    const configureEvent = events.find(
+      (event) => event.tags?.product_error_code === "configure_request_error",
+    );
+    expect(provisionEvent?.message).toBe("Harness workspace provisioning failed.");
+    expect(provisionEvent?.tags?.lifecycle_phase).toBe("provisioning");
+    expect(provisionEvent?.fingerprint).toEqual([
+      "provision_failed",
+      "provisioning",
+    ]);
+    expect(configureEvent?.message).toBe(
+      "A Configure request failed unexpectedly.",
+    );
+    expect(configureEvent?.tags?.lifecycle_phase).toBe("configure_route");
+    expect(configureEvent?.fingerprint).toEqual([
+      "configure_request_error",
+      "configure_route",
+    ]);
+    for (const key of ALLOWED_SENTRY_TAG_KEYS) {
+      expect(ALLOWED_SENTRY_TAG_KEYS).toContain(key);
+    }
+  });
+
+  it("drops uninitiated events on consent withdrawal without starting later sends", async () => {
+    let releaseFirst: (() => void) | undefined;
+    const firstSendBlocked = new Promise<void>((resolve) => {
+      releaseFirst = resolve;
+    });
+    const initiated: number[] = [];
+    const captured: unknown[] = [];
+    const transport = createSentryErrorTransport({
+      dsn: "http://public@127.0.0.1:9999/1",
+      release: "p-dev-harness@0.3.1",
+      transport: () =>
+        ({
+          send: async (envelope: unknown) => {
+            initiated.push(Date.now());
+            captured.push(envelope);
+            await firstSendBlocked;
+            return { statusCode: 200 };
+          },
+          flush: async () => true,
+        }) as never,
+    });
+
+    transport.captureError(
+      {
+        lifecyclePhase: "provisioning",
+        productErrorCode: "provision_failed",
+        errorCategory: "server",
+      },
+      BASE_CONTEXT,
+    );
+    const waitForFirstSend = async () => {
+      const deadline = Date.now() + 500;
+      while (initiated.length < 1 && Date.now() < deadline) {
+        await new Promise((resolve) => queueMicrotask(resolve));
+      }
+    };
+    await waitForFirstSend();
+    expect(initiated).toHaveLength(1);
+
+    transport.captureError(
+      {
+        lifecyclePhase: "configure_route",
+        productErrorCode: "configure_request_error",
+        errorCategory: "unexpected",
+      },
+      { ...BASE_CONTEXT, lifecycle_phase: "configure_route" },
+    );
+    const gateClosedAt = Date.now();
+    const disableStarted = Date.now();
+    await transport.disableAndDrop(25);
+    const disableElapsed = Date.now() - disableStarted;
+    transport.captureError(
+      {
+        lifecyclePhase: "shutdown",
+        productErrorCode: "p_dev_launch_failed",
+        errorCategory: "unexpected",
+      },
+      { ...BASE_CONTEXT, lifecycle_phase: "shutdown" },
+    );
+    await new Promise((resolve) => setTimeout(resolve, 40));
+    releaseFirst?.();
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(disableElapsed).toBeLessThan(150);
+    expect(initiated).toHaveLength(1);
+    expect(initiated.every((timestamp) => timestamp <= gateClosedAt)).toBe(true);
+    const survivingEvents = assertCapturedSentryEnvelopePrivacy(captured[0]);
+    expect(survivingEvents[0]?.tags?.product_error_code).toBe("provision_failed");
+    expect(transport.isActive()).toBe(false);
+  });
+
+  it("drops non-compliant events in production without throwing", async () => {
+    const captured: unknown[] = [];
+    const transport = createCapturingTransport(captured);
+    const dirtyEvent = {
+      platform: "node",
+      level: "error",
+      message: "Harness workspace provisioning failed.",
+      tags: {
+        product_error_code: "provision_failed",
+        lifecycle_phase: "provisioning",
+        installationId: "must-not-send",
+      },
+      user: { ip_address: "203.0.113.1" },
+    } as ErrorEvent;
+
+    expect(scrubOutboundSentryEvent(dirtyEvent)).toBeNull();
+    expect(() =>
+      findSentryPrivacyViolation({
+        user: { ip_address: "203.0.113.1" },
+      }),
+    ).not.toThrow();
+
+    transport.captureError(
+      {
+        lifecyclePhase: "provisioning",
+        productErrorCode: "provision_failed",
+        errorCategory: "server",
+      },
+      BASE_CONTEXT,
+    );
+    await transport.flush(2_000);
+    expect(captured).toHaveLength(1);
+    expect(transport.isActive()).toBe(true);
+  });
+});

package/workspace-snapshot/files/tests/observability/sentry-outbound-privacy.test.ts

@@ -0,0 +1,141 @@
+import { describe, expect, it } from "vitest";
+import {
+  assertSentryEnvelopePrivacy,
+  findSentryPrivacyViolation,
+  scrubOutboundSentryEnvelope,
+  scrubOutboundSentryEvent,
+} from "../../src/observability/sentry-outbound-privacy.js";
+import { ALLOWED_SENTRY_TAG_KEYS } from "../../src/observability/privacy-schema.js";
+import type { ErrorEvent } from "@sentry/node";
+
+const COMPLIANT_TAGS = {
+  observability_schema_version: "1",
+  package_version: "0.4.0",
+  release_sha: "abc",
+  session_id: "session",
+  runtime_mode: "packaged",
+  os_family: "linux",
+  cpu_arch_family: "x64",
+  node_major_version: "22",
+  lifecycle_phase: "provisioning",
+  product_error_code: "provision_failed",
+  error_category: "server",
+} as const;
+
+function compliantEvent(message = "Harness workspace provisioning failed."): ErrorEvent {
+  return {
+    message,
+    tags: { ...COMPLIANT_TAGS },
+    fingerprint: ["provision_failed", "provisioning"],
+  };
+}
+
+function compliantEnvelope(message = "Harness workspace provisioning failed.") {
+  return [
+    { event_id: "abc", sent_at: new Date().toISOString() },
+    [[{ type: "event" }, compliantEvent(message)]],
+  ] as never;
+}
+
+const CREDENTIAL_FIXTURES = [
+  { family: "ghp_", value: "ghp_1234567890abcdef" },
+  { family: "gho_", value: "gho_1234567890abcdef" },
+  { family: "ghu_", value: "ghu_1234567890abcdef" },
+  { family: "ghs_", value: "ghs_1234567890abcdef" },
+  { family: "ghr_", value: "ghr_1234567890abcdef" },
+  { family: "github_pat_", value: "github_pat_11ABCDEF1234567890" },
+  { family: "lin_api_", value: "lin_api_fakefixturetoken" },
+  { family: "cursor_", value: "cursor_fakefixturetoken" },
+  { family: "sk-", value: "sk-fakefixturetoken123" },
+  { family: "xoxb", value: "xoxb-fake-fixture-token" },
+  { family: "xoxa", value: "xoxa-fake-fixture-token" },
+  { family: "xoxp", value: "xoxp-fake-fixture-token" },
+  { family: "xoxr", value: "xoxr-fake-fixture-token" },
+  { family: "xoxs", value: "xoxs-fake-fixture-token" },
+  { family: "Bearer", value: "Bearer fake.jwt.fixture.token" },
+] as const;
+
+describe("sentry outbound privacy helpers", () => {
+  it("documents the allowlisted sentry tag contract", () => {
+    expect(ALLOWED_SENTRY_TAG_KEYS).toContain("package_version");
+    expect(ALLOWED_SENTRY_TAG_KEYS).toContain("release_sha");
+    expect(ALLOWED_SENTRY_TAG_KEYS).not.toContain("installationId");
+  });
+
+  it("throws loudly when assertions detect forbidden envelope fields", () => {
+    const envelope = [
+      { event_id: "abc", sent_at: new Date().toISOString(), trace: { trace_id: "1" } },
+      [[{ type: "event" }, { message: "x", tags: {} }]],
+    ] as never;
+
+    expect(() => assertSentryEnvelopePrivacy(envelope)).toThrow(/trace metadata/i);
+  });
+
+  it("strips forbidden trace metadata from structured envelopes", () => {
+    const envelope = [
+      {
+        event_id: "abc",
+        sent_at: new Date().toISOString(),
+        trace: { trace_id: "abc", public_key: "key" },
+      },
+      [
+        [
+          { type: "event" },
+          {
+            message: "Harness workspace provisioning failed.",
+            tags: {
+              ...COMPLIANT_TAGS,
+            },
+            fingerprint: ["provision_failed", "provisioning"],
+          } satisfies ErrorEvent,
+        ],
+      ],
+    ] as never;
+
+    const scrubbed = scrubOutboundSentryEnvelope(envelope);
+    expect(scrubbed).not.toBeNull();
+    expect(scrubbed?.[0].trace).toBeUndefined();
+    expect(() => assertSentryEnvelopePrivacy(scrubbed as never)).not.toThrow();
+    expect(findSentryPrivacyViolation({ trace_id: "abc" })).toEqual({
+      path: "$.trace_id",
+      reason: 'Forbidden key "trace_id"',
+    });
+  });
+
+  describe.each(CREDENTIAL_FIXTURES)(
+    "credential family $family",
+    ({ family, value }) => {
+      it("is detected by the final envelope assertion", () => {
+        const violation = findSentryPrivacyViolation({
+          message: `error with ${value}`,
+        });
+        expect(violation).not.toBeNull();
+        expect(violation?.reason).toMatch(/credential/i);
+
+        const envelope = compliantEnvelope(`error with ${value}`);
+        expect(() => assertSentryEnvelopePrivacy(envelope)).toThrow(/credential/i);
+      });
+
+      it("causes scrubOutboundSentryEvent and scrubOutboundSentryEnvelope to return null", () => {
+        const dirtyEvent = compliantEvent(`error with ${value}`);
+        expect(scrubOutboundSentryEvent(dirtyEvent)).toBeNull();
+        expect(scrubOutboundSentryEnvelope(compliantEnvelope(`error with ${value}`))).toBeNull();
+      });
+
+      it("never reaches the base transport", async () => {
+        const baseCaptured: unknown[] = [];
+        const baseSend = async (envelope: unknown) => {
+          baseCaptured.push(envelope);
+          return { statusCode: 200 };
+        };
+        const envelope = compliantEnvelope(`error with ${value}`);
+        const scrubbed = scrubOutboundSentryEnvelope(envelope);
+        if (scrubbed) {
+          await baseSend(scrubbed);
+        }
+        expect(scrubbed).toBeNull();
+        expect(baseCaptured).toHaveLength(0);
+      });
+    },
+  );
+});

package/workspace-snapshot/files/tests/observability/sentry-privacy-assertions.ts

@@ -0,0 +1,52 @@
+import { parseEnvelope } from "@sentry/core";
+import type { Envelope } from "@sentry/core";
+import type { ErrorEvent } from "@sentry/node";
+import {
+  assertSentryEnvelopePrivacy,
+  extractSentryEventsFromEnvelope,
+} from "../../src/observability/sentry-outbound-privacy.js";
+
+export { assertSentryEnvelopePrivacy, extractSentryEventsFromEnvelope };
+
+export function extractSentryEventsFromNdjson(body: string): ErrorEvent[] {
+  const events: ErrorEvent[] = [];
+  const lines = body.split("\n").filter((line) => line.trim().length > 0);
+  let index = 0;
+  while (index < lines.length) {
+    const headerLine = lines[index];
+    index += 1;
+    if (!headerLine) {
+      continue;
+    }
+    const header = JSON.parse(headerLine) as { type?: string; length?: number };
+    if (header.type === "event" || header.type === undefined) {
+      const payloadLine = lines[index];
+      index += 1;
+      if (!payloadLine) {
+        throw new Error("Missing Sentry envelope event payload line.");
+      }
+      events.push(JSON.parse(payloadLine) as ErrorEvent);
+      continue;
+    }
+    if (typeof header.length === "number") {
+      index += 1;
+    }
+  }
+  return events;
+}
+
+export function parseCapturedSentryEnvelope(envelope: unknown): Envelope {
+  return envelope as Envelope;
+}
+
+export function assertCapturedSentryEnvelopePrivacy(envelope: unknown): ErrorEvent[] {
+  const parsed = parseCapturedSentryEnvelope(envelope);
+  assertSentryEnvelopePrivacy(parsed);
+  return extractSentryEventsFromEnvelope(parsed);
+}
+
+export function assertNdjsonSentryBodyPrivacy(body: string): ErrorEvent[] {
+  const envelope = parseEnvelope(body);
+  assertSentryEnvelopePrivacy(envelope);
+  return extractSentryEventsFromEnvelope(envelope);
+}

package/workspace-snapshot/files/tests/observability/sentry-server-only.test.ts

@@ -0,0 +1,68 @@
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const repoRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "../..",
+);
+
+const FORBIDDEN_BUILD_PATTERNS = [
+  "@sentry/browser",
+  "@sentry/nextjs",
+  "withSentryConfig",
+  "sentry-cli",
+] as const;
+
+const INSPECT_PATHS = [
+  "package.json",
+  "packages/p-dev/package.json",
+  "apps/gui",
+  ".github/workflows",
+  "scripts",
+] as const;
+
+function listMatches(pattern: string): string[] {
+  try {
+    return execFileSync(
+      "rg",
+      [
+        "-l",
+        pattern,
+        ...INSPECT_PATHS.flatMap((entry) => ["--glob", `!${entry}/**/node_modules/**`]),
+        ...INSPECT_PATHS,
+      ],
+      { cwd: repoRoot, encoding: "utf8" },
+    )
+      .split("\n")
+      .map((line) => line.trim())
+      .filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+describe("sentry server-only build surface", () => {
+  it("does not initialize browser Sentry or source-map upload tooling", () => {
+    for (const pattern of FORBIDDEN_BUILD_PATTERNS) {
+      expect(listMatches(pattern)).toEqual([]);
+    }
+  });
+
+  it("does not require SENTRY_AUTH_TOKEN in package scripts or CI workflows", () => {
+    const matches = listMatches("SENTRY_AUTH_TOKEN");
+    expect(matches).toEqual([]);
+  });
+
+  it("keeps GUI instrumentation server-only", () => {
+    const instrumentation = readFileSync(
+      path.join(repoRoot, "apps/gui/instrumentation.ts"),
+      "utf8",
+    );
+    expect(instrumentation).not.toMatch(/@sentry\/browser|@sentry\/nextjs/);
+    expect(instrumentation).toContain('process.env.NEXT_RUNTIME !== "nodejs"');
+    expect(instrumentation).toContain("@harness/observability/facade.js");
+  });
+});

package/workspace-snapshot/files/tests/observability/sentry-transport.test.ts

@@ -0,0 +1,88 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  beginObservabilitySession,
+  captureProductError,
+  createObservabilityTestRecorder,
+  shutdownObservability,
+  writeObservabilityPreferences,
+} from "../../src/observability/facade.js";
+import { ALLOWED_SENTRY_TAG_KEYS } from "../../src/observability/privacy-schema.js";
+
+const tempDirs: string[] = [];
+
+afterEach(async () => {
+  await shutdownObservability();
+  await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+});
+
+async function makeWorkspace(): Promise<string> {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "p-dev-sentry-"));
+  tempDirs.push(dir);
+  return dir;
+}
+
+describe("observability sentry transport", () => {
+  it("groups errors by product code and lifecycle phase only", async () => {
+    const recorder = createObservabilityTestRecorder();
+    const workspaceDir = await makeWorkspace();
+    await writeObservabilityPreferences(workspaceDir, {
+      errorReportingPreference: "enabled",
+      disclosureShown: true,
+    });
+    await beginObservabilitySession({
+      workspaceDir,
+      env: {
+        P_DEV_RUNTIME_MODE: "packaged",
+        P_DEV_PACKAGE_VERSION: "0.4.0",
+      },
+      fakeRecorder: recorder,
+    });
+
+    captureProductError({
+      lifecyclePhase: "provisioning",
+      productErrorCode: "provision_failed",
+      errorCategory: "server",
+    });
+
+    expect(recorder.sentryEvents).toHaveLength(1);
+    expect(recorder.sentryEvents[0]?.fingerprint).toEqual([
+      "provision_failed",
+      "provisioning",
+    ]);
+  });
+
+  it("never includes installation ID in sentry payloads", async () => {
+    const recorder = createObservabilityTestRecorder();
+    const workspaceDir = await makeWorkspace();
+    await writeObservabilityPreferences(workspaceDir, {
+      analyticsPreference: "enabled",
+      errorReportingPreference: "enabled",
+      disclosureShown: true,
+    });
+    await beginObservabilitySession({
+      workspaceDir,
+      env: {
+        P_DEV_RUNTIME_MODE: "packaged",
+        P_DEV_PACKAGE_VERSION: "0.4.0",
+      },
+      fakeRecorder: recorder,
+    });
+
+    captureProductError({
+      lifecyclePhase: "configure_route",
+      productErrorCode: "configure_request_error",
+      errorCategory: "unexpected",
+      message: "token ghp_testtoken",
+    });
+
+    const serialized = JSON.stringify(recorder.sentryEvents[0]);
+    expect(serialized).not.toContain("installationId");
+    expect(serialized).not.toContain("ghp_testtoken");
+    for (const key of Object.keys(recorder.sentryEvents[0]?.tags ?? {})) {
+      expect(ALLOWED_SENTRY_TAG_KEYS).toContain(key);
+    }
+  });
+});