From f1add90c145a585fb054a4505be77ec2c01989fc Mon Sep 17 00:00:00 2001 From: Arham Wani Date: Fri, 31 Jul 2026 11:44:16 +0530 Subject: [PATCH] fix(server): surface cloudflared FTL/PNC relay logs as warnings, not debug MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `classifyRelayClientOutput` routes relay-connector (cloudflared) output to "connected" / "warning" / "debug" log severities, treating only `ERR` and `WRN` zerolog level tokens as warnings. cloudflared also emits `FTL` (fatal) and `PNC` (panic) — both strictly more severe than `ERR` — and those fell through to "debug", so a fatal connector failure (e.g. a bad origin certificate path or a runtime panic that takes T3 Connect down) was logged at the quietest level and effectively hidden while diagnosing an outage. Add `FTL` and `PNC` to the warning set so the most severe relay failures surface at least as loudly as ordinary errors. Extended the existing classifier test. Co-Authored-By: Claude Opus 4.8 (1M context) --- apps/server/src/cloud/ManagedEndpointRuntime.test.ts | 9 +++++++++ apps/server/src/cloud/ManagedEndpointRuntime.ts | 5 ++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/apps/server/src/cloud/ManagedEndpointRuntime.test.ts b/apps/server/src/cloud/ManagedEndpointRuntime.test.ts index e0d5924fcc2..b45b5099252 100644 --- a/apps/server/src/cloud/ManagedEndpointRuntime.test.ts +++ b/apps/server/src/cloud/ManagedEndpointRuntime.test.ts @@ -96,6 +96,15 @@ describe("CloudManagedEndpointRuntime", () => { "2026-06-17T02:00:00Z INF Starting metrics server", ), ).toBe("debug"); + // FTL (fatal) and PNC (panic) are more severe than ERR and must surface. + expect( + ManagedEndpointRuntime.classifyRelayClientOutput( + "2026-06-17T02:00:00Z FTL Cannot determine default origin certificate path", + ), + ).toBe("warning"); + expect( + ManagedEndpointRuntime.classifyRelayClientOutput("2026-06-17T02:00:00Z PNC runtime panic"), + ).toBe("warning"); }); it.effect("starts, deduplicates, rotates, and stops the Cloudflare connector", () => diff --git a/apps/server/src/cloud/ManagedEndpointRuntime.ts b/apps/server/src/cloud/ManagedEndpointRuntime.ts index a1d7112a929..89c0a23783c 100644 --- a/apps/server/src/cloud/ManagedEndpointRuntime.ts +++ b/apps/server/src/cloud/ManagedEndpointRuntime.ts @@ -72,7 +72,10 @@ export function classifyRelayClientOutput(line: string): "connected" | "warning" if (/\bRegistered tunnel connection\b/iu.test(line)) { return "connected"; } - return /\b(?:ERR|WRN)\b/u.test(line) ? "warning" : "debug"; + // cloudflared uses zerolog level tokens. FTL (fatal) and PNC (panic) are more + // severe than ERR, so they must surface at least as loudly — without them a + // fatal connector failure would be logged at debug and hidden. + return /\b(?:ERR|WRN|FTL|PNC)\b/u.test(line) ? "warning" : "debug"; } function runtimeConfigKey(config: RelayManagedEndpointRuntimeConfig): string {