Merge pull request #141 from codeflash-ai/connector-live-debug-diagnostics

Print sanitized live connector diagnostics

Author: mohammedahmed18

tests/live_connector_common.sh

@@ -16,6 +16,226 @@ _live_report_retained_log() {
   fi
 }
 
+_live_debug_sanitize_file() {
+  local path="$1"
+  local mode="${2:-text}"
+  local max_lines="${3:-${LOCALITY_LIVE_DEBUG_TAIL_LINES:-160}}"
+
+  if [[ ! -s "$path" ]]; then
+    return 0
+  fi
+
+  python3 - "$path" "$mode" "$max_lines" <<'PY'
+import json
+import os
+import pathlib
+import re
+import sys
+
+path = pathlib.Path(sys.argv[1])
+mode = sys.argv[2]
+max_lines = int(sys.argv[3])
+
+SENSITIVE_ENV_NAME = re.compile(
+    r"(TOKEN|SECRET|CREDENTIAL|PASSWORD|API_KEY|AUTH|ISSUE_ID|"
+    r"CONVERSATION_ID|TO_EMAIL|EMAIL|REFRESH)",
+    re.IGNORECASE,
+)
+SENSITIVE_KEY_FRAGMENTS = (
+    "token",
+    "secret",
+    "credential",
+    "authorization",
+    "api_key",
+    "password",
+    "refresh",
+    "client_secret",
+    "cookie",
+)
+IDENTIFIER_KEYS = {
+    "id",
+    "remote_id",
+    "remote_ids",
+    "changed_remote_ids",
+    "message_id",
+    "thread_id",
+    "draft_id",
+    "conversation_id",
+    "issue_id",
+    "document_id",
+    "event_id",
+    "channel_id",
+}
+PII_KEYS = {
+    "email",
+    "to",
+    "from",
+    "cc",
+    "bcc",
+    "recipient",
+    "recipients",
+    "account_label",
+}
+
+
+def sensitive_env_values():
+    values = []
+    for name, value in os.environ.items():
+        if not value or not SENSITIVE_ENV_NAME.search(name):
+            continue
+        value = str(value)
+        if len(value) < 4 or value in {"true", "false", "none", "null"}:
+            continue
+        values.append(value)
+    values.sort(key=len, reverse=True)
+    return values
+
+
+ENV_VALUES = sensitive_env_values()
+
+
+def redact_text(text):
+    if not text:
+        return text
+    for value in ENV_VALUES:
+        text = text.replace(value, "<redacted>")
+    replacements = [
+        (r"(?i)(authorization:\s*bearer\s+)[^\s]+", r"\1<redacted>"),
+        (r"(?i)(bearer\s+)[A-Za-z0-9._~+/=-]+", r"\1<redacted>"),
+        (r"lin_api_[A-Za-z0-9]+", "<redacted>"),
+        (r"ya29\.[A-Za-z0-9._-]+", "<redacted>"),
+        (r"xox[a-zA-Z]-[A-Za-z0-9-]+", "<redacted>"),
+        (r"gh[pousr]_[A-Za-z0-9_]+", "<redacted>"),
+        (r"AIza[0-9A-Za-z_-]{20,}", "<redacted>"),
+        (
+            r"(?i)\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b",
+            "<redacted>",
+        ),
+        (
+            r'(?i)("?(?:access_token|refresh_token_handle|api_key|token|secret|credential|authorization|client_secret|password)"?\s*[:=]\s*)("[^"]*"|[^,\s}]+)',
+            r"\1<redacted>",
+        ),
+    ]
+    for pattern, replacement in replacements:
+        text = re.sub(pattern, replacement, text)
+    return text
+
+
+def is_sensitive_key(key):
+    lowered = str(key).lower()
+    return any(fragment in lowered for fragment in SENSITIVE_KEY_FRAGMENTS)
+
+
+def sanitize_json(value, key=""):
+    key_lower = str(key).lower()
+    if isinstance(value, dict):
+        return {k: sanitize_json(v, k) for k, v in value.items()}
+    if isinstance(value, list):
+        if key_lower in IDENTIFIER_KEYS or key_lower in PII_KEYS or is_sensitive_key(key):
+            return ["<redacted>" for _ in value]
+        return [sanitize_json(item, key) for item in value]
+    if isinstance(value, str):
+        if key_lower in IDENTIFIER_KEYS or key_lower in PII_KEYS or is_sensitive_key(key):
+            return "<redacted>"
+        return redact_text(value)
+    return value
+
+
+try:
+    raw_text = path.read_text(encoding="utf-8", errors="replace")
+except OSError as error:
+    print(f"could not read {path}: {error}", file=sys.stderr)
+    raise SystemExit(0)
+
+if mode == "json":
+    try:
+        parsed = json.loads(raw_text)
+    except Exception:
+        text = raw_text
+    else:
+        text = json.dumps(sanitize_json(parsed), indent=2, sort_keys=True)
+        max_bytes = int(os.environ.get("LOCALITY_LIVE_DEBUG_JSON_BYTES", "20000"))
+        if len(text.encode("utf-8")) > max_bytes:
+            text = text.encode("utf-8")[:max_bytes].decode("utf-8", errors="replace")
+            text += "\n... <truncated>"
+else:
+    lines = raw_text.splitlines()
+    if max_lines > 0 and len(lines) > max_lines:
+        text = f"... showing last {max_lines} of {len(lines)} lines ...\n"
+        text += "\n".join(lines[-max_lines:])
+    else:
+        text = "\n".join(lines)
+
+print(redact_text(text))
+PY
+}
+
+_live_debug_emit_file() {
+  local label="$1"
+  local path="$2"
+  local mode="${3:-text}"
+  local max_lines="${4:-${LOCALITY_LIVE_DEBUG_TAIL_LINES:-160}}"
+
+  if [[ -z "$path" || ! -s "$path" ]]; then
+    return 0
+  fi
+
+  {
+    echo "::group::privacy-safe diagnostics: $label"
+    echo "path: $path"
+    _live_debug_sanitize_file "$path" "$mode" "$max_lines"
+    echo "::endgroup::"
+  } >&2
+}
+
+_live_debug_emit_var_file() {
+  local var_name="$1"
+  local label="$2"
+  local mode="${3:-text}"
+  local max_lines="${4:-${LOCALITY_LIVE_DEBUG_TAIL_LINES:-160}}"
+  local path="${!var_name:-}"
+
+  _live_debug_emit_file "$label" "$path" "$mode" "$max_lines"
+}
+
+emit_live_debug_diagnostics() {
+  local label="${1:-live connector}"
+  local report_var
+  local log_var
+
+  echo "privacy-safe diagnostics: $label" >&2
+  for report_var in \
+    mount_report \
+    connect_report \
+    initial_pull_report \
+    first_pull_report \
+    second_pull_report \
+    diff_report \
+    push_report \
+    pull_after_push_report \
+    edit_diff_report \
+    edit_push_report \
+    pull_after_edit_report \
+    restore_diff_report \
+    restore_push_report \
+    cleanup_diff_report \
+    cleanup_push_report \
+    cleanup_pull_report \
+    status_report \
+    info_report \
+    doctor_report \
+    drive_search_report \
+    calendar_search_report \
+    drafts_list_report \
+    draft_get_report; do
+    _live_debug_emit_var_file "$report_var" "$report_var" json
+  done
+
+  for log_var in command_log daemon_log fuse_log; do
+    _live_debug_emit_var_file "$log_var" "$log_var" text
+  done
+}
+
 require_live_env() {
   local name
   for name in "$@"; do

tests/live_connector_common_selftest.sh

@@ -195,6 +195,66 @@ if ! grep -Fq "self-test not-ok report did not report ok=true" "$not_ok_error";
   live_fail "assert_json_ok did not explain the ok=false failure"
 fi
 
+export LINEAR_API_KEY="lin_api_selftestsecret"
+export LOCALITY_LINEAR_LIVE_ISSUE_ID="lin_selftest_secret_issue"
+export LOCALITY_GMAIL_LIVE_TO_EMAIL="private-selftest@example.com"
+debug_report="$tmp_root/debug-report.json"
+debug_command_log="$tmp_root/debug-commands.err.log"
+debug_daemon_log="$tmp_root/debug-localityd.log"
+debug_fuse_log="$tmp_root/debug-locality-fuse.log"
+debug_output="$tmp_root/debug-output.err"
+cat >"$debug_report" <<'JSON'
+{
+  "ok": false,
+  "status": "error",
+  "code": "selftest_permission_denied",
+  "error": {
+    "code": "linear_push_failed",
+    "message": "failed to update lin_selftest_secret_issue for private-selftest@example.com with lin_api_selftestsecret"
+  },
+  "changed_remote_ids": ["lin_selftest_secret_issue"],
+  "access_token": "ya29.selftest-secret-access-token"
+}
+JSON
+cat >"$debug_command_log" <<'LOG'
+curl failed with Authorization: Bearer ya29.selftest-secret-access-token
+linear key was lin_api_selftestsecret
+LOG
+cat >"$debug_daemon_log" <<'LOG'
+localityd is running with private-selftest@example.com
+LOG
+cat >"$debug_fuse_log" <<'LOG'
+fuse saw lin_selftest_secret_issue
+LOG
+
+push_report="$debug_report" \
+  command_log="$debug_command_log" \
+  daemon_log="$debug_daemon_log" \
+  fuse_log="$debug_fuse_log" \
+  emit_live_debug_diagnostics "Self-test connector" 2>"$debug_output"
+if ! grep -Fq "privacy-safe diagnostics: Self-test connector" "$debug_output"; then
+  live_fail "debug diagnostics did not include the connector label"
+fi
+if ! grep -Fq "selftest_permission_denied" "$debug_output"; then
+  live_fail "debug diagnostics did not include the report error code"
+fi
+if ! grep -Fq "linear_push_failed" "$debug_output"; then
+  live_fail "debug diagnostics did not include the nested error code"
+fi
+if ! grep -Fq "<redacted>" "$debug_output"; then
+  live_fail "debug diagnostics did not show redaction placeholders"
+fi
+for leaked_debug_value in \
+  "lin_api_selftestsecret" \
+  "lin_selftest_secret_issue" \
+  "private-selftest@example.com" \
+  "ya29.selftest-secret-access-token"; do
+  if grep -Fq "$leaked_debug_value" "$debug_output"; then
+    live_fail "debug diagnostics leaked $leaked_debug_value"
+  fi
+done
+unset LINEAR_API_KEY LOCALITY_LINEAR_LIVE_ISSUE_ID LOCALITY_GMAIL_LIVE_TO_EMAIL
+
 init_live_state "$loc_bin" "$state_root"
 seed_connector_credential "$loc_bin" "$state_root" "google-docs" "google-docs-live" "$credential_json"
 

tests/live_gmail_vfs_roundtrip.sh

@@ -394,6 +394,7 @@ on_error() {
   local code=$?
   echo "live Gmail VFS round trip failed during: $step" >&2
   echo "privacy-safe diagnostics: exit=$code" >&2
+  emit_live_debug_diagnostics "Gmail VFS round trip" || true
   return "$code"
 }
 

tests/live_google_calendar_vfs_roundtrip.sh

@@ -217,6 +217,7 @@ on_error() {
   local code=$?
   echo "live Google Calendar VFS round trip failed during: $step" >&2
   echo "privacy-safe diagnostics: exit=$code" >&2
+  emit_live_debug_diagnostics "Google Calendar VFS round trip" || true
   return "$code"
 }
 

tests/live_google_docs_vfs_roundtrip.sh

@@ -196,6 +196,7 @@ on_error() {
   local code=$?
   echo "live Google Docs VFS round trip failed during: $step" >&2
   echo "privacy-safe diagnostics: exit=$code" >&2
+  emit_live_debug_diagnostics "Google Docs VFS round trip" || true
   return "$code"
 }
 

tests/live_granola_vfs_read.sh

@@ -6,6 +6,11 @@ if [[ "${LOCALITY_LIVE_GRANOLA_VFS:-}" != "1" ]]; then
   exit 0
 fi
 
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# shellcheck source=tests/live_connector_common.sh
+source "$script_dir/live_connector_common.sh"
+
 if [[ "$(uname -s)" != "Linux" ]]; then
   echo "skip: live Granola VFS test requires Linux"
   exit 0
@@ -71,6 +76,7 @@ on_error() {
   local code=$?
   echo "live Granola VFS test failed during: $step" >&2
   echo "privacy-safe diagnostics: exit=$code" >&2
+  emit_live_debug_diagnostics "Granola VFS read test" || true
   if [[ -n "$localityd_pid" ]]; then
     if kill -0 "$localityd_pid" >/dev/null 2>&1; then
       echo "privacy-safe diagnostics: daemon=running" >&2

tests/live_linear_vfs_roundtrip.sh

@@ -17,6 +17,7 @@ on_error() {
   local code=$?
   echo "live Linear VFS round trip failed during: $step" >&2
   echo "privacy-safe diagnostics: exit=$code" >&2
+  emit_live_debug_diagnostics "Linear VFS round trip" || true
   return "$code"
 }
 

tests/live_slack_vfs_read.sh

@@ -283,6 +283,7 @@ on_error() {
   local code=$?
   echo "live Slack VFS read-only test failed during: $step" >&2
   echo "privacy-safe diagnostics: exit=$code" >&2
+  emit_live_debug_diagnostics "Slack VFS read-only test" || true
   return "$code"
 }