feat: failed-node errors, job detail, redaction gaps and run history flags

clients/typescript/src/schema.d.ts

@@ -434,6 +434,22 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/control/locations/{location_id}/targets/{target}/jobs/{job_key}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["readPersonJob"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/control/locations/{location_id}/targets/{target}/maintenance": {
         parameters: {
             query?: never;
@@ -578,6 +594,22 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/control/locations/{location_id}/targets/{target}/runs/{run_id}/nodes/{node_key}/error": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["readPersonRunNodeError"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/control/locations/{location_id}/targets/{target}/runs/{run_id}/output": {
         parameters: {
             query?: never;
@@ -1479,6 +1511,31 @@ export interface components {
             failed: components["schemas"]["Table"][];
             failure?: string | null;
         };
+        /** @description One job or group as declared, for a person who may list the target; free-form setting values are withheld. */
+        JobDetailRecord: {
+            concurrency_groups: string[];
+            /** @description Selected nodes whose failure stops a group. */
+            critical_nodes: string[];
+            description: string;
+            job_key: string;
+            kind: components["schemas"]["RunKind"];
+            /** @description The groups this job belongs to. */
+            member_of: string[];
+            /** @description A group's member jobs in run order; empty for a job. */
+            members: components["schemas"]["JobMember"][];
+            selection: string[];
+            /** @description Command settings; `vars` and a `defer_*` value that is not a target name show as `[REDACTED]`, and text values pass through secret redaction. */
+            settings: {
+                [key: string]: unknown;
+            };
+            /** Format: uuid */
+            snapshot_id: string;
+        };
+        JobMember: {
+            job_key: string;
+            /** @description Members this one waits for, from lineage and from the group's `after`. */
+            waits_for: string[];
+        };
         /** @description A job or group of the current published snapshot. Settings are left out of person reads. */
         JobRecord: {
             concurrency_groups: string[];
@@ -1492,6 +1549,8 @@ export interface components {
         };
         /** @description A trusted operator names a published job; execution inputs are never supplied by the caller. */
         JobRunRequest: {
+            /** @description Rebuild every selected model from scratch; it rewrites history, as a window does. */
+            full_refresh?: boolean;
             job_key: string;
             /** Format: uuid */
             location_id: string;
@@ -2011,6 +2070,8 @@ export interface components {
             node_key: string;
         } | {
             error_code?: string | null;
+            /** @description Redacted and bounded on the way in, whoever sends it; absent from older workers. */
+            error_message?: string | null;
             /** @enum {string} */
             kind: "node_finished";
             node_key: string;
@@ -2114,6 +2175,15 @@ export interface components {
         };
         /** @enum {string} */
         RunKind: "job" | "group" | "adhoc";
+        /** @description A node's outcome error in one run: redacted, bounded text and the project file of the node, never its SQL. */
+        RunNodeFailure: {
+            error_code?: string | null;
+            /** @description Null when the worker reported none or the run's history has been pruned. */
+            message?: string | null;
+            node_key: string;
+            /** @description Relative to the project root, with `/` separators; null when the run's snapshot is gone. */
+            path?: string | null;
+        };
         RunNodeRecord: {
             /** Format: date-time */
             ended_at?: string | null;
@@ -3687,6 +3757,52 @@ export interface operations {
             };
         };
     };
+    readPersonJob: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                location_id: string;
+                target: string;
+                job_key: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["JobDetailRecord"];
+                };
+            };
+            /** @description Session rejected */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Needs view on every current node of the target */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiErrorBody"];
+                };
+            };
+            /** @description No published job by that name */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     readPersonMaintenance: {
         parameters: {
             query?: {
@@ -4071,6 +4187,53 @@ export interface operations {
             };
         };
     };
+    readPersonRunNodeError: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                location_id: string;
+                target: string;
+                run_id: string;
+                node_key: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RunNodeFailure"];
+                };
+            };
+            /** @description Session rejected */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Needs view.evidence on the node */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiErrorBody"];
+                };
+            };
+            /** @description Node not found in this run */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     readPersonRunOutput: {
         parameters: {
             query?: never;

crates/sqlbuild-cli/src/native_commands/_helpers/decision.rs

@@ -183,6 +183,7 @@ pub(crate) fn control_admin(namespace: &Namespace) -> Result<ControlAdmin, Contr
                     reason,
                     priority,
                     window,
+                    full_refresh: false,
                 }));
             }
             if action.as_deref() == Some("cancel-run") {

crates/sqlbuild-core/src/redaction/_helpers/patterns.rs

@@ -1,12 +1,12 @@
-//! The four secret patterns, compiled once per process.
+//! The secret patterns, compiled once per process.
 
 use std::sync::LazyLock;
 
-use regex::{Regex, RegexBuilder};
+use regex::{Captures, Regex, RegexBuilder};
 
 use crate::redaction::constants::{
-    AUTHORIZATION_PATTERN, BEARER_PATTERN, PATTERN_SIZE_LIMIT, SECRET_VALUE_PATTERN,
-    URI_CREDENTIAL_PATTERN,
+    AUTHORIZATION_PATTERN, BARE_USERINFO_PATTERN, BEARER_PATTERN, DDL_PASSWORD_PATTERN,
+    PATTERN_SIZE_LIMIT, SECRET_VALUE_PATTERN, URI_CREDENTIAL_PATTERN,
 };
 
 pub(crate) static AUTHORIZATION: LazyLock<Result<Regex, regex::Error>> =
@@ -15,8 +15,12 @@ pub(crate) static BEARER: LazyLock<Result<Regex, regex::Error>> =
     LazyLock::new(|| compiled(BEARER_PATTERN));
 pub(crate) static SECRET_VALUE: LazyLock<Result<Regex, regex::Error>> =
     LazyLock::new(|| compiled(SECRET_VALUE_PATTERN));
+pub(crate) static DDL_PASSWORD: LazyLock<Result<Regex, regex::Error>> =
+    LazyLock::new(|| compiled(DDL_PASSWORD_PATTERN));
 pub(crate) static URI_CREDENTIAL: LazyLock<Result<Regex, regex::Error>> =
     LazyLock::new(|| compiled(URI_CREDENTIAL_PATTERN));
+static BARE_USERINFO: LazyLock<Result<Regex, regex::Error>> =
+    LazyLock::new(|| compiled(BARE_USERINFO_PATTERN));
 
 fn compiled(pattern: &str) -> Result<Regex, regex::Error> {
     RegexBuilder::new(pattern)
@@ -35,3 +39,19 @@ pub(crate) fn substituted(
         Err(_) => text.to_owned(),
     }
 }
+
+/// A port is all digits and the authority ends after it (`/`, `?`, `#`); anything else may be a password.
+pub(crate) fn bare_userinfo_redacted(text: &str) -> String {
+    match BARE_USERINFO.as_ref() {
+        Ok(regex) => regex
+            .replace_all(text, |found: &Captures<'_>| {
+                if !found[3].is_empty() && found[2].bytes().all(|byte| byte.is_ascii_digit()) {
+                    found[0].to_owned()
+                } else {
+                    format!("{}[REDACTED]{}", &found[1], &found[3])
+                }
+            })
+            .into_owned(),
+        Err(_) => text.to_owned(),
+    }
+}

crates/sqlbuild-core/src/redaction/constants.rs

@@ -13,21 +13,36 @@ pub(crate) const SECRET_FIELD_PARTS: [&str; 11] = [
     "secret",
     "token",
 ];
+/// A key may be glued to a prefix, as in `db_password` or `PGPASSWORD`; `pwd` stands alone so `OLDPWD` and `cwd` keep their paths.
 pub(crate) const SECRET_VALUE_PATTERN: &str = concat!(
-    r"(?i)\b(api[-_]?key|access[-_]?key|private[-_]?key|authorization|",
+    r"(?i)\b([a-z0-9_.-]*?(?:api[-_]?key|access[-_]?key|private[-_]?key|authorization|",
     r"client[-_]?secret|refresh[-_]?token|",
-    r"password|passwd|pwd|secret|token|dsn|connection_string)",
+    r"password|passwd|secret|token|dsn|connection_string)|pwd)",
     r#"(\s*[=:]\s*)("[^"\r\n]{0,512}"|'[^'\r\n]{0,512}'|[^\s,;]{1,512})"#,
 );
 pub(crate) const AUTHORIZATION_PATTERN: &str = concat!(
     r"(?i)\b(authorization)(\s*[=:]\s*)(?:basic|bearer)\s+",
     r#"("[^"\r\n]{1,512}"|'[^'\r\n]{1,512}'|[^\s,;]{1,512})"#,
 );
 pub(crate) const BEARER_PATTERN: &str = r"(?i)\bbearer\s+[a-z0-9._~+/=-]{1,512}";
-pub(crate) const URI_CREDENTIAL_PATTERN: &str =
-    r"(?i)\b([a-z][a-z0-9+.-]*://[^\s:/@]+:)([^\s@]+)(@)";
+/// The password runs to the last `@` before the host, so an unencoded `@` inside it is covered.
+pub(crate) const URI_CREDENTIAL_PATTERN: &str = concat!(
+    r"(?i)\b([a-z][a-z0-9+.-]*://[^\s:/@]+:)([^\s]+?)",
+    r#"(@[^\s@/?#,;'"]*)([\s/?#,;'"]|$)"#,
+);
+/// SQL that sets a password: `PASSWORD '…'` (quoted only, so prose such as "password authentication" stays) and `IDENTIFIED [WITH plugin] BY …`.
+pub(crate) const DDL_PASSWORD_PATTERN: &str = concat!(
+    r#"(?i)\b(password)(\s+)("[^"\r\n]{0,512}"|'[^'\r\n]{0,512}')|"#,
+    r#"\b(identified\s+(?:with\s+\w+\s+)?by)(\s+)("[^"\r\n]{0,512}"|'[^'\r\n]{0,512}'|[^\s,;]{1,512})"#,
+);
+pub(crate) const DDL_REPLACEMENT: &str = "${1}${2}${4}${5}[REDACTED]";
 pub(crate) const PAIR_REPLACEMENT: &str = "${1}${2}[REDACTED]";
 pub(crate) const BEARER_REPLACEMENT: &str = "Bearer [REDACTED]";
-pub(crate) const URI_REPLACEMENT: &str = "${1}[REDACTED]${3}";
+pub(crate) const URI_REPLACEMENT: &str = "${1}[REDACTED]${3}${4}";
 /// Compiled size allowance for the bounded Unicode repetitions above.
 pub(crate) const PATTERN_SIZE_LIMIT: usize = 1 << 28;
+/// `scheme://name:value` with no `@` after it, as in a cut connection string; group 3 ends the authority.
+pub(crate) const BARE_USERINFO_PATTERN: &str =
+    r#"(?i)\b([a-z][a-z0-9+.-]*://[^\s:/@'"]+:)([^\s/?#@'"]+)([/?#]?)"#;
+/// The most characters of error text kept after redaction.
+pub(crate) const ERROR_TEXT_CHARS: usize = 2000;

crates/sqlbuild-core/src/redaction/main/mod.rs

@@ -1,2 +1,3 @@
+pub mod redact_error_text;
 pub mod redact_text;
 pub mod secret_field_name;

crates/sqlbuild-core/src/redaction/main/redact_error_text.rs

@@ -0,0 +1,17 @@
+//! `redact_error_text`: error text redacted before it is cut, so a cut can never expose part of a secret.
+
+use crate::redaction::_helpers::patterns::bare_userinfo_redacted;
+use crate::redaction::constants::ERROR_TEXT_CHARS;
+use crate::redaction::main::redact_text::redact_text;
+
+/// Named secrets and URI passwords redacted, even where a warehouse cut the URI before its host, then at most 2,000 characters; a second pass changes nothing.
+#[must_use]
+pub fn redact_error_text(text: &str) -> String {
+    let redacted = bare_userinfo_redacted(&redact_text(text));
+    if redacted.chars().count() <= ERROR_TEXT_CHARS {
+        return redacted;
+    }
+    let mut kept: String = redacted.chars().take(ERROR_TEXT_CHARS - 1).collect();
+    kept.push('…');
+    kept
+}

crates/sqlbuild-core/src/redaction/main/redact_text.rs

@@ -1,15 +1,18 @@
 //! `redact_text`: obvious named secrets and URI passwords removed from diagnostic text.
 
 use crate::redaction::_helpers::patterns::{
-    AUTHORIZATION, BEARER, SECRET_VALUE, URI_CREDENTIAL, substituted,
+    AUTHORIZATION, BEARER, DDL_PASSWORD, SECRET_VALUE, URI_CREDENTIAL, substituted,
+};
+use crate::redaction::constants::{
+    BEARER_REPLACEMENT, DDL_REPLACEMENT, PAIR_REPLACEMENT, URI_REPLACEMENT,
 };
-use crate::redaction::constants::{BEARER_REPLACEMENT, PAIR_REPLACEMENT, URI_REPLACEMENT};
 
-/// Authorization headers, bearer tokens, `name=value` secrets, then URI passwords redacted.
+/// Authorization headers, bearer tokens, `name=value` secrets, SQL passwords, then URI passwords redacted.
 #[must_use]
 pub fn redact_text(value: &str) -> String {
     let authorization: String = substituted(&AUTHORIZATION, value, PAIR_REPLACEMENT);
     let bearer: String = substituted(&BEARER, &authorization, BEARER_REPLACEMENT);
     let named: String = substituted(&SECRET_VALUE, &bearer, PAIR_REPLACEMENT);
-    substituted(&URI_CREDENTIAL, &named, URI_REPLACEMENT)
+    let statement: String = substituted(&DDL_PASSWORD, &named, DDL_REPLACEMENT);
+    substituted(&URI_CREDENTIAL, &statement, URI_REPLACEMENT)
 }