[brentvatne]

Why

The worker masks job secrets in uploaded logs, but only in each record's msg (createTransformStream in packages/worker/src/logger.ts). Every other field was uploaded as is, for example:

• A logged error's err (message, stack, …). Unknown failures inside a build phase are logged as this.logger.error({ err }, '') (packages/build-tools/src/context.ts:310), so their cause, secrets included, is only in err. A comment there says the website displays err.stack for these records.
• Other structured fields: { error } in reportMaestroTestResults.ts, { code, data } in restoreCache.ts, and the job dump at build.ts:48, which can contain a copy of a secret's value.

Found while making eas simulator:start / simulator:get show why a session failed (#4693, #4694). The CLI prints only the masked msg for this reason.

How

• Which fields: mask every field of a record except bunyan's own fields and the ones that identify a log line (name, pid, level, time, v, phase, source, marker, result, buildStepId, buildStepInternalId).
• Masking:
  • each value is round-tripped through JSON first, which is what the upload streams send, so a toJSON method can't bring back the original value, and a Date becomes its string form;
  • strings, object keys, and numbers equal to a secret are then masked;
  • values nested more than 20 levels deep become [Truncated] instead of being uploaded unmasked;
  • values that can't be serialized become [Unserializable].
• The copy: the record is copied before masking. Bunyan passes the same record object to every raw stream, so the WorkerLogBuffer and the caller's objects are left alone.
• No secrets: nothing changes when no secrets are registered.
• Unchanged: context.ts:310. Filling msg for phase failures would change what the website shows, which is a separate decision.

Test Plan

• New tests in src/__unit__/logger.test.ts. For every record they assert that JSON.stringify(record) contains no secret. Cases:
  • errors logged as error({ err }, '') and error({ err }) have err.message and err.stack masked;
  • another field with a secret as a value, as a key, and as a number is masked, while metadata fields are unchanged and the caller's object is not modified;
  • a toJSON method that returns a secret is masked;
  • a deeply nested secret becomes [Truncated].
• Each fix is load-bearing: reverting any one (letting deep values through, skipping the JSON round-trip, or masking only err) fails one of these tests.
• packages/worker unit tests: 85 pass.
• yarn typecheck (worker), oxlint and oxfmt --check pass.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 85.29412% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.30%. Comparing base (d0cb5a2) to head (bf44cd8).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
packages/worker/src/logger.ts	85.30%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4698      +/-   ##
==========================================
+ Coverage   75.25%   75.30%   +0.05%     
==========================================
  Files        1053     1053              
  Lines       52045    52174     +129     
  Branches    11357    11395      +38     
==========================================
+ Hits        39162    39283     +121     
- Misses      11895    11903       +8     
  Partials      988      988              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

✅ Thank you for adding a changeset!

[gwdp]

🔥