pi-harness-runtime 1.1.396 → 1.1.398

package/packages/logging/test/classification.test.ts

@@ -0,0 +1,137 @@
+/**
+ * What may leave the machine.
+ *
+ * The local log file keeps everything; the centralized archive keeps the
+ * structured, sanitized events an operator needs.
+ */
+
+import { describe, expect, test } from "bun:test";
+import {
+	DEFAULT_CLASSIFICATION_POLICY,
+	classifyRecord,
+	isSanitizedMessage,
+	prepareRemoteRecord,
+} from "../src/classification.js";
+import { LogShipper } from "../src/shipper.js";
+import type { LogBatch, LogRecord, LogTransport } from "../src/types.js";
+
+function record(overrides: Partial<LogRecord> = {}): LogRecord {
+	return {
+		ts: "2026-10-24T09:00:00.000Z",
+		level: "info",
+		source: "harness.test",
+		event: "service.started",
+		...overrides,
+	};
+}
+
+describe("event classification", () => {
+	test("keeps structured service events remote", () => {
+		expect(classifyRecord(record({ event: "service.started" }))).toBe("remote");
+		expect(classifyRecord(record({ event: "harness.service-diagnostics.check" }))).toBe("remote");
+		expect(classifyRecord(record({ event: "validation.tier.run" }))).toBe("remote");
+	});
+
+	test("keeps the catch-all local log mirror local", () => {
+		expect(classifyRecord(record({ event: "harness.log" }))).toBe("local");
+	});
+
+	test("keeps prompt and response events local", () => {
+		expect(classifyRecord(record({ event: "prompt.received" }))).toBe("local");
+		expect(classifyRecord(record({ event: "assistant.response" }))).toBe("local");
+	});
+
+	test("keeps unknown events local by default", () => {
+		expect(classifyRecord(record({ event: "something.new" }))).toBe("local");
+	});
+});
+
+describe("message policy", () => {
+	test("keeps a short sanitized message", () => {
+		expect(isSanitizedMessage("service started in 12 ms", DEFAULT_CLASSIFICATION_POLICY)).toBe(true);
+	});
+
+	test("drops a multi line message", () => {
+		expect(isSanitizedMessage("line one\nline two", DEFAULT_CLASSIFICATION_POLICY)).toBe(false);
+	});
+
+	test("drops a message with an absolute path", () => {
+		expect(
+			isSanitizedMessage("failed to read /home/frappe/project/file.ts", DEFAULT_CLASSIFICATION_POLICY),
+		).toBe(false);
+	});
+
+	test("drops a message with a URL that has a query string", () => {
+		expect(
+			isSanitizedMessage("GET https://api.example.com/v1?token=abc failed", DEFAULT_CLASSIFICATION_POLICY),
+		).toBe(false);
+	});
+
+	test("drops a very long message", () => {
+		expect(isSanitizedMessage("x".repeat(500), DEFAULT_CLASSIFICATION_POLICY)).toBe(false);
+	});
+});
+
+describe("remote preparation", () => {
+	test("removes the fields with a private key name", () => {
+		const prepared = prepareRemoteRecord(
+			record({
+				fields: { durationMs: 12, prompt: "private", output: "private", reason: "ok" },
+			}),
+		);
+
+		expect(prepared?.fields?.prompt).toBeUndefined();
+		expect(prepared?.fields?.output).toBeUndefined();
+		expect(prepared?.fields?.durationMs).toBe(12);
+		expect(prepared?.fields?.reason).toBe("ok");
+	});
+
+	test("returns null for a local event", () => {
+		expect(prepareRemoteRecord(record({ event: "harness.log", message: "anything" }))).toBeNull();
+	});
+
+	test("drops the message but keeps the event", () => {
+		const prepared = prepareRemoteRecord(
+			record({ event: "service.started", message: "failed at /home/frappe/x/y.ts" }),
+		);
+
+		expect(prepared?.message).toBeUndefined();
+		expect(prepared?.event).toBe("service.started");
+	});
+});
+
+describe("shipper integration", () => {
+	test("does not ship a local-only record", async () => {
+		const batches: LogBatch[] = [];
+		const transport: LogTransport = {
+			name: "recorder",
+			async send(batch: LogBatch): Promise<void> {
+				batches.push(batch);
+			},
+		};
+		const shipper = new LogShipper({ transports: [transport], flushIntervalMs: 0 });
+
+		shipper.info("harness", "log", "a private local log line");
+		await shipper.flush();
+
+		expect(batches).toHaveLength(0);
+		expect(shipper.getStats().localOnly).toBe(1);
+	});
+
+	test("ships a structured record", async () => {
+		const batches: LogBatch[] = [];
+		const transport: LogTransport = {
+			name: "recorder",
+			async send(batch: LogBatch): Promise<void> {
+				batches.push(batch);
+			},
+		};
+		const shipper = new LogShipper({ transports: [transport], flushIntervalMs: 0 });
+
+		shipper.info("harness.service-diagnostics", "service.check", "service is up", { durationMs: 3 });
+		await shipper.flush();
+
+		expect(batches).toHaveLength(1);
+		expect(batches[0].records[0].event).toBe("service.check");
+	});
+});

package/packages/logging/test/identity-transport.test.ts

@@ -0,0 +1,197 @@
+/**
+ * Client side identity and transport semantics.
+ *
+ * The transports form a FALLBACK chain, not a broadcast: the first transport
+ * that accepts a batch wins and the later ones are never called. This file
+ * documents that behaviour explicitly, because a silent "broadcast" would
+ * duplicate every batch.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { LogShipper } from "../src/shipper.js";
+import { resolveInstallationId } from "../src/installation.js";
+import { resolveLogSinkConfig } from "../src/config.js";
+import { LOG_SCHEMA_VERSION, type LogBatch, type LogTransport } from "../src/types.js";
+
+const created: string[] = [];
+
+function tempDir(): string {
+	const dir = mkdtempSync(join(tmpdir(), "log-identity-"));
+	created.push(dir);
+	return dir;
+}
+
+afterEach(() => {
+	while (created.length > 0) {
+		rmSync(created.pop() as string, { recursive: true, force: true });
+	}
+});
+
+function recorder(name: string): { transport: LogTransport; batches: LogBatch[] } {
+	const batches: LogBatch[] = [];
+	return {
+		batches,
+		transport: {
+			name,
+			async send(batch: LogBatch): Promise<void> {
+				batches.push(batch);
+			},
+		},
+	};
+}
+
+describe("transport semantics", () => {
+	test("stops at the first successful transport - the chain is not a broadcast", async () => {
+		const first = recorder("first");
+		const second = recorder("second");
+		const shipper = new LogShipper({
+			transports: [first.transport, second.transport],
+			flushIntervalMs: 0,
+		});
+
+		shipper.info("unit", "service.started");
+		await shipper.flush();
+
+		expect(first.batches).toHaveLength(1);
+		expect(second.batches).toHaveLength(0);
+	});
+
+	test("uses the next transport only when the first one fails", async () => {
+		const failing = recorder("first");
+		failing.transport = {
+			name: "first",
+			async send(): Promise<void> {
+				throw new Error("transport down");
+			},
+		};
+		const second = recorder("second");
+		const shipper = new LogShipper({
+			transports: [failing.transport, second.transport],
+			flushIntervalMs: 0,
+		});
+
+		shipper.info("unit", "service.started");
+		await shipper.flush();
+
+		expect(second.batches).toHaveLength(1);
+	});
+});
+
+describe("batch schema v2", () => {
+	test("carries the schema version, the installation id and the app version", async () => {
+		const transport = recorder("only");
+		const shipper = new LogShipper({
+			app: "pi-harness",
+			appVersion: "9.9.9",
+			installationId: "11111111-2222-3333-4444-555555555555",
+			hostLabel: "laptop",
+			transports: [transport.transport],
+			flushIntervalMs: 0,
+		});
+
+		shipper.info("unit", "service.started");
+		await shipper.flush();
+
+		const batch = transport.batches[0];
+		expect(batch.schemaVersion).toBe(LOG_SCHEMA_VERSION);
+		expect(batch.installationId).toBe("11111111-2222-3333-4444-555555555555");
+		expect(batch.appVersion).toBe("9.9.9");
+		expect(batch.hostLabel).toBe("laptop");
+		expect(batch.batchId.length).toBeGreaterThan(0);
+	});
+
+	test("does not send the hostname as an identity", async () => {
+		const transport = recorder("only");
+		const shipper = new LogShipper({
+			installationId: "11111111-2222-3333-4444-555555555555",
+			transports: [transport.transport],
+			flushIntervalMs: 0,
+		});
+
+		shipper.info("unit", "service.started");
+		await shipper.flush();
+
+		const batch = transport.batches[0];
+		// The hostname may travel as a display label, but the identity is the
+		// installation id.
+		expect(batch.installationId).not.toBe(batch.hostLabel);
+	});
+});
+
+describe("installation identity", () => {
+	test("creates the id once and reuses it", () => {
+		const dir = tempDir();
+		const path = join(dir, "installation-id.txt");
+
+		const first = resolveInstallationId({ path });
+		const second = resolveInstallationId({ path });
+
+		expect(first).toBe(second);
+		expect(existsSync(path)).toBe(true);
+		expect(readFileSync(path, "utf8").trim()).toBe(first);
+	});
+
+	test("replaces an invalid id file", () => {
+		const dir = tempDir();
+		const path = join(dir, "installation-id.txt");
+		writeFileSync(path, "not-a-uuid\n");
+
+		const id = resolveInstallationId({ path });
+
+		expect(id).not.toBe("not-a-uuid");
+		expect(readFileSync(path, "utf8").trim()).toBe(id);
+	});
+});
+
+describe("transport selection", () => {
+	const env = {
+		PI_LOG_R2_BUCKET: "bucket",
+		PI_LOG_R2_ACCESS_KEY_ID: "ak",
+		PI_LOG_R2_SECRET_ACCESS_KEY: "sk",
+		PI_LOG_R2_ENDPOINT: "https://example.invalid",
+	};
+
+	test("auto prefers the webhook ingress so only the server writes to R2", () => {
+		const config = resolveLogSinkConfig({
+			env: { ...env, PI_LOG_WEBHOOK_URL: "https://logs.example.invalid/api/logs" },
+			keysDir: join(tempDir(), "keys"),
+			installationId: "install",
+		});
+
+		expect(config.transports.map((transport) => transport.name)).toEqual(["webhook"]);
+		expect(config.notes.join(" ")).toContain("client ingress point");
+	});
+
+	test("auto falls back to R2 when no webhook is configured", () => {
+		const config = resolveLogSinkConfig({
+			env,
+			keysDir: join(tempDir(), "keys"),
+			installationId: "install",
+		});
+
+		expect(config.transports.map((transport) => transport.name)).toEqual(["r2"]);
+	});
+
+	test("r2+webhook keeps the explicit order (R2 first, webhook as fallback)", () => {
+		const config = resolveLogSinkConfig({
+			env: { ...env, PI_LOG_SINK: "r2+webhook", PI_LOG_WEBHOOK_URL: "https://logs.example.invalid/api/logs" },
+			keysDir: join(tempDir(), "keys"),
+			installationId: "install",
+		});
+
+		expect(config.transports.map((transport) => transport.name)).toEqual(["r2", "webhook"]);
+	});
+
+	test("the installation id reaches the resolved config", () => {
+		const config = resolveLogSinkConfig({
+			env: { PI_LOG_SINK: "off" },
+			keysDir: join(tempDir(), "keys"),
+			installationId: "install",
+		});
+
+		expect(config.installationId).toBe("install");
+	});
+});

package/packages/logging/test/ingest-schema.test.ts

@@ -0,0 +1,184 @@
+/**
+ * The ingest contract: strict validation and allowlisted redaction.
+ *
+ * The acceptance rule is simple: a secret must not survive the trip, no
+ * matter where it hides - in the message, in a structured field, in the
+ * error message or in the stack.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { sanitizeRecord, validateBatch } from "../src/ingest/schema.js";
+import { LOG_SCHEMA_VERSION } from "../src/types.js";
+
+function batchWith(records: unknown[], overrides: Record<string, unknown> = {}): unknown {
+	return {
+		schemaVersion: LOG_SCHEMA_VERSION,
+		batchId: "batch-1",
+		app: "pi-harness",
+		installationId: "11111111-2222-3333-4444-555555555555",
+		sentAt: "2026-10-24T09:00:00.000Z",
+		records,
+		...overrides,
+	};
+}
+
+const SECRET = "sk-abcdefghijklmnopqrstuvwxyz012345";
+
+describe("validation", () => {
+	test("accepts a well formed batch", () => {
+		const result = validateBatch(
+			batchWith([
+				{
+					ts: "2026-10-24T09:00:00.000Z",
+					level: "info",
+					source: "harness.test",
+					event: "service.started",
+				},
+			]),
+		);
+
+		expect(result.ok).toBe(true);
+	});
+
+	test("accepts a legacy batch without a schema version", () => {
+		const result = validateBatch({
+			batchId: "batch-legacy",
+			app: "pi-harness",
+			sentAt: "2026-10-24T09:00:00.000Z",
+			records: [
+				{
+					ts: "2026-10-24T09:00:00.000Z",
+					level: "info",
+					source: "harness.test",
+					event: "service.started",
+				},
+			],
+		});
+
+		expect(result.ok).toBe(true);
+		if (result.ok) {
+			expect(result.warnings.length).toBeGreaterThan(0);
+			expect(result.batch.installationId).toBe("legacy");
+		}
+	});
+
+	test("rejects a newer schema version", () => {
+		const result = validateBatch(batchWith([], { schemaVersion: LOG_SCHEMA_VERSION + 1 }));
+
+		expect(result.ok).toBe(false);
+		if (!result.ok) expect(result.error.code).toBe("unsupported_schema_version");
+	});
+
+	test("rejects too many records", () => {
+		const records = Array.from({ length: 5 }, () => ({
+			ts: "2026-10-24T09:00:00.000Z",
+			level: "info",
+			source: "s",
+			event: "e",
+		}));
+		const result = validateBatch(batchWith(records), { limits: { maxRecords: 2 } });
+
+		expect(result.ok).toBe(false);
+		if (!result.ok) expect(result.error.code).toBe("too_many_records");
+	});
+
+	test("rejects an unknown level", () => {
+		const result = validateBatch(
+			batchWith([
+				{ ts: "2026-10-24T09:00:00.000Z", level: "verbose", source: "s", event: "e" },
+			]),
+		);
+
+		expect(result.ok).toBe(false);
+	});
+});
+
+describe("allowlist", () => {
+	test("drops unknown record properties", () => {
+		const result = sanitizeRecord({
+			ts: "2026-10-24T09:00:00.000Z",
+			level: "info",
+			source: "harness.test",
+			event: "service.started",
+			secretPayload: "should not survive",
+		});
+
+		expect(result.ok).toBe(true);
+		if (!result.ok) return;
+		expect((result.record as Record<string, unknown>).secretPayload).toBeUndefined();
+	});
+
+	test("drops field keys that can carry private content", () => {
+		const result = sanitizeRecord({
+			ts: "2026-10-24T09:00:00.000Z",
+			level: "info",
+			source: "harness.test",
+			event: "service.started",
+			fields: {
+				prompt: "the user asked something private",
+				output: "command output",
+				durationMs: 12,
+				reason: "timeout",
+			},
+		});
+
+		expect(result.ok).toBe(true);
+		if (!result.ok) return;
+		expect(result.record.fields?.prompt).toBeUndefined();
+		expect(result.record.fields?.output).toBeUndefined();
+		expect(result.record.fields?.durationMs).toBe(12);
+		expect(result.record.fields?.reason).toBe("timeout");
+	});
+});
+
+describe("redaction", () => {
+	test("redacts a secret in the message", () => {
+		const result = sanitizeRecord({
+			ts: "2026-10-24T09:00:00.000Z",
+			level: "info",
+			source: "harness.test",
+			event: "service.started",
+			message: `using ${SECRET} to authenticate`,
+		});
+
+		expect(result.ok).toBe(true);
+		if (!result.ok) return;
+		expect(result.record.message).not.toContain(SECRET);
+		expect(result.record.message).toContain("[REDACTED]");
+	});
+
+	test("redacts a secret in a structured field", () => {
+		const result = sanitizeRecord({
+			ts: "2026-10-24T09:00:00.000Z",
+			level: "info",
+			source: "harness.test",
+			event: "service.started",
+			fields: { token: SECRET, count: 3 },
+		});
+
+		expect(result.ok).toBe(true);
+		if (!result.ok) return;
+		expect(String(result.record.fields?.token)).not.toContain(SECRET);
+		expect(result.record.fields?.count).toBe(3);
+	});
+
+	test("redacts the error message and the stack", () => {
+		const result = sanitizeRecord({
+			ts: "2026-10-24T09:00:00.000Z",
+			level: "error",
+			source: "harness.test",
+			event: "service.failed",
+			error: {
+				name: "AuthError",
+				message: `token ${SECRET} rejected`,
+				stack: `Error: token ${SECRET} rejected\n    at run (app.js:1:1)`,
+			},
+		});
+
+		expect(result.ok).toBe(true);
+		if (!result.ok) return;
+		expect(result.record.error?.message).not.toContain(SECRET);
+		expect(result.record.error?.stack).not.toContain(SECRET);
+		expect(result.record.error?.name).toBe("AuthError");
+	});
+});

package/packages/logging/test/integration.test.ts

@@ -10,6 +10,7 @@ import {
 	shutdownCentralLogging,
 } from "../src/singleton.js";
 import type { LogBatch } from "../src/types.js";
+import { LOG_SCHEMA_VERSION } from "../src/types.js";
 
 const cleanup: string[] = [];
 
@@ -49,9 +50,11 @@ describe("webhook transport", () => {
 		try {
 			const transport = createWebhookTransport({ url: collector.url });
 			await transport.send({
+				schemaVersion: LOG_SCHEMA_VERSION,
 				batchId: "batch-1",
 				app: "test",
-				host: "localhost",
+				installationId: "11111111-2222-3333-4444-555555555555",
+				hostLabel: "localhost",
 				sentAt: new Date().toISOString(),
 				records: [
 					{
@@ -83,9 +86,11 @@ describe("webhook transport", () => {
 			const transport = createWebhookTransport({ url: `http://127.0.0.1:${port}/api/logs` });
 			await expect(
 				transport.send({
+					schemaVersion: LOG_SCHEMA_VERSION,
 					batchId: "batch-2",
 					app: "test",
-					host: "localhost",
+					installationId: "11111111-2222-3333-4444-555555555555",
+					hostLabel: "localhost",
 					sentAt: new Date().toISOString(),
 					records: [
 						{
@@ -123,11 +128,11 @@ describe("initCentralLogging", () => {
 			expect(config?.enabled).toBe(true);
 			expect(config?.transports).toHaveLength(1);
 
-			getCentralShipper()?.info("unit", "central", "hello");
+			getCentralShipper()?.info("unit", "service.central", "hello");
 			await getCentralShipper()?.flush();
 
 			expect(collector.batches).toHaveLength(1);
-			expect(collector.batches[0].records[0].event).toBe("central");
+			expect(collector.batches[0].records[0].event).toBe("service.central");
 		} finally {
 			collector.server.close();
 		}