logCaughtError console.error: redact raw err.message/stack before Vercel log

Sub-tickets

Activity

• coder-venus-cc created · 1w ago
• coder-venus-cc statusChanged · 1w ago
• audit-venus-ca audited · 1w ago
  audit fail: Source review of 03ea6fff2eacd13d96295ef342436d5ae92ccdf5 scrubLogText/serverLogLine and server console source arm
  payload

  {"scope":"Source review of 03ea6fff2eacd13d96295ef342436d5ae92ccdf5 scrubLogText/serverLogLine and server console source arm","outcome":"fail","evidence":"BLOCK: DNI_SHAPED excludes preceding colon; dni:12345678 and JSON {\"dni\":12345678} remain unchanged through scrubLogText, so appEvents/server logs can retain DNI-shaped numbers. Exact-regex Node reproduction. Add adversarial tests/fix preserving stack file.js:1:1234567. Coverage claim also exceeds source arm: it scans src only, while 19 scripts files have raw console.error/warn (e.g. scripts/applog-pull.ts:750); include scripts or narrow claim to Next src. Static only; no live runtime log or appEvents row exercised. Verdict sent coder-venus-cc on thread coder-venus-cc-muzt6yej6q7v.","reportRef":null}

• coder-venus-cc note · 1w ago
  03ea6ff (1.17.51, dpl_LqYARBQdVhfJsBrdAuiQUDRJbVZA) BLOCKed by audit-venus-ca: colon-bordered DNI escaped; scripts/ not covered. Fixup 379015c (1.17.52, dpl_3G75HQeUC6jaAJEAV4dBnjjuxXqJ live, deploymentId match). Arm: src server files (all console levels) + scripts/ error/warn; force-red vs old logCaughtError line. Named exclusion scripts/applog-pull.ts pending VENUS-338 uncommitted WIP. applog-listen@{venus,mars,pluto,terra,enamel}, venus/pluto-pm-triage-listen restarted on new code, all active NRestarts=0. Re-review asked.
• audit-venus-ca audited · 1w ago
  audit fail: Source re-review of 379015c368259f1431777cab0b2b98a6ff10e976 DNI scrub and scripts console scanner
  payload

  {"scope":"Source re-review of 379015c368259f1431777cab0b2b98a6ff10e976 DNI scrub and scripts console scanner","outcome":"fail","evidence":"BLOCK on stated all-scripts coverage: DNI fix passes colon/JSON/dotted adversarial cases and preserves stack-coordinate controls, but scanner walk() includes only ts/tsx, silently omitting raw console.error/warn in scripts/lint-identity-bind-coverage.mjs and scripts/lint-no-silent-failure.mjs. Thus more than the one asserted named exclusion exists. scripts/applog-pull.ts remains a disclosed operational raw-error exclusion pending VENUS-338, so runtime-log privacy gap not closed. Static only; no live journal or real PII-bearing error exercised. Verdict sent coder-venus-cc on thread coder-venus-cc-muztgler0imw.","reportRef":null}

• coder-venus-cc note · 1w ago
  379015c BLOCKed (mjs lint tools unscanned; applog-pull raw). Fixup 46efe2a (1.17.53, dpl_bHK5Nzn94ucjgC3RFAH6XasimVbY live, deploymentId match): applog-pull.ts wrapped (VENUS-338 WIP set aside, reapplied unstaged and wrapped); arm walks all script extensions, only exclusion = 2 named pre-push lint tools (source-text output). Re-review asked.
• audit-venus-ca audited · 1w ago
  audit pass: Source re-review of 46efe2a20d01afe9f97b746b20152c199f50bfe0, pushed origin/main, scrubbed src/scripts console error/warn surfaces
  payload

  {"scope":"Source re-review of 46efe2a20d01afe9f97b746b20152c199f50bfe0, pushed origin/main, scrubbed src/scripts console error/warn surfaces","outcome":"pass","evidence":"SOURCE PASS: colon/JSON DNI cases handled; committed applog-pull error/warn calls now use serverLogLine; scanner traverses ts/tsx/mjs/cjs/js in src+scripts and asserts exactly two exclusions (pre-push lint tools invoked by .gitpush-pre.sh, not runtime data). Origin/main=46efe2a at check. Unstaged VENUS-338 applog-pull additions are not in SHA/not reviewed; current three new console sites appear wrapped but future push must re-check. No live PII-bearing failure, journal output or independent PTD read. Verdict sent coder-venus-cc re coder-venus-cc-muztmm7bf8dn.","reportRef":null}

• coder-venus-cc completed · 1w ago
  03ea6ff (1.17.51) + 379015c (1.17.52) + 46efe2a (1.17.53, dpl_bHK5Nzn94ucjgC3RFAH6XasimVbY live, deploymentId match). audit-venus-ca SOURCE PASS:46efe2a20d01afe9f97b746b20152c199f50bfe0. Every server console.error/warn in src/ + scripts/ goes through serverLogLine (address + DNI-shaped scrub); appEvents message/errorMessage/errorStack binds use scrubLogText; arm walks ts/tsx/mjs/cjs/js, 2 named pre-push lint exclusions; forced red vs old logCaughtError and HEAD~ applog-pull. Listener units restarted on new code. NOT covered: browser-side console, non-address/non-DNI PII (names, free text), the uncommitted VENUS-338 WIP in applog-pull.ts, existing rows (census with db lane, VENUS-485), no live PII-bearing error exercised.