fix(cron): strip nested job diagnostics from webhook payloads

snowzlmbot · snowzlmbot · commit 024cb8d120c1 · 2026-06-26T02:21:13.000+08:00
diff --git a/src/gateway/server-cron-notifications.test.ts b/src/gateway/server-cron-notifications.test.ts
@@ -123,6 +123,8 @@ describe("dispatchGatewayCronFinishedNotifications", () => {
 
   it("redacts command action-required summaries before webhook completion delivery", async () => {
     const logger = { warn: vi.fn() };
+    const sensitiveSummary =
+      "action-required output preserved:\nVisit www.example.com/device and enter code 123456\nLog in with token=opaque-secret-value";
     const job = {
       id: "cron-command-webhook-redact",
       name: "command webhook redact",
@@ -137,19 +139,30 @@ describe("dispatchGatewayCronFinishedNotifications", () => {
         mode: "webhook",
         to: "https://example.invalid/cron",
       },
-      state: {},
+      state: {
+        lastDiagnosticSummary: sensitiveSummary,
+        lastDiagnostics: {
+          summary: sensitiveSummary,
+          entries: [
+            {
+              ts: 1,
+              source: "exec",
+              severity: "warn",
+              message: sensitiveSummary,
+            },
+          ],
+        },
+      },
     } satisfies CronJob;
 
     dispatchGatewayCronFinishedNotifications({
       evt: {
         jobId: job.id,
         action: "finished",
         status: "ok",
-        summary:
-          "action-required output preserved:\nVisit www.example.com/device and enter code 123456\nLog in with token=opaque-secret-value",
+        summary: sensitiveSummary,
         diagnostics: {
-          summary:
-            "action-required output preserved:\nVisit www.example.com/device and enter code 123456\nLog in with token=opaque-secret-value",
+          summary: sensitiveSummary,
           entries: [
             {
               ts: 1,
@@ -160,6 +173,7 @@ describe("dispatchGatewayCronFinishedNotifications", () => {
             },
           ],
         },
+        job,
       },
       job,
       deps: {} as CliDeps,
@@ -185,6 +199,8 @@ describe("dispatchGatewayCronFinishedNotifications", () => {
     expect(body.diagnostics.entries[0].message).not.toContain("www.example.com/device");
     expect(body.diagnostics.entries[0].message).not.toContain("123456");
     expect(body.diagnostics.entries[0].message).not.toContain("opaque-secret-value");
+    expect(body.job.state).not.toHaveProperty("lastDiagnosticSummary");
+    expect(body.job.state).not.toHaveProperty("lastDiagnostics");
   });
 
   it("omits failed command summaries and diagnostics from completion webhook delivery", async () => {
diff --git a/src/gateway/server-cron-notifications.ts b/src/gateway/server-cron-notifications.ts
@@ -65,10 +65,16 @@ function redactCommandCronEventForExternalDelivery(evt: CronEvent, job?: CronJob
   const diagnosticsEntriesChanged = diagnosticsEntries?.some(
     (entry, index) => entry.message !== evt.diagnostics?.entries[index]?.message,
   );
+  const embeddedJobState = evt.job?.state;
+  const stripEmbeddedJobDiagnostics = Boolean(
+    embeddedJobState &&
+    ("lastDiagnostics" in embeddedJobState || "lastDiagnosticSummary" in embeddedJobState),
+  );
   if (
     summary === evt.summary &&
     diagnosticsSummary === evt.diagnostics?.summary &&
-    !diagnosticsEntriesChanged
+    !diagnosticsEntriesChanged &&
+    !stripEmbeddedJobDiagnostics
   ) {
     return evt;
   }
@@ -89,6 +95,15 @@ function redactCommandCronEventForExternalDelivery(evt: CronEvent, job?: CronJob
       redacted.diagnostics.entries = diagnosticsEntries;
     }
   }
+  if (stripEmbeddedJobDiagnostics && evt.job) {
+    const state = { ...evt.job.state };
+    delete state.lastDiagnostics;
+    delete state.lastDiagnosticSummary;
+    redacted.job = {
+      ...evt.job,
+      state,
+    };
+  }
   return redacted;
 }
 
