From 5192f777fe54c2a2a359f6c25ecf5fbde46d49b0 Mon Sep 17 00:00:00 2001 From: Arham Amin <132888838+arhxam@users.noreply.github.com> Date: Sun, 2 Aug 2026 01:40:25 +0530 Subject: [PATCH] fix(server): surface cloudflared FTL/PNC relay logs as warnings, not debug (#5076) Co-authored-by: Claude Opus 4.8 (1M context) --- apps/server/src/cloud/ManagedEndpointRuntime.test.ts | 9 +++++++++ apps/server/src/cloud/ManagedEndpointRuntime.ts | 5 ++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/apps/server/src/cloud/ManagedEndpointRuntime.test.ts b/apps/server/src/cloud/ManagedEndpointRuntime.test.ts index e0d5924fcc2c..b45b5099252a 100644 --- a/apps/server/src/cloud/ManagedEndpointRuntime.test.ts +++ b/apps/server/src/cloud/ManagedEndpointRuntime.test.ts @@ -96,6 +96,15 @@ describe("CloudManagedEndpointRuntime", () => { "2026-06-17T02:00:00Z INF Starting metrics server", ), ).toBe("debug"); + // FTL (fatal) and PNC (panic) are more severe than ERR and must surface. + expect( + ManagedEndpointRuntime.classifyRelayClientOutput( + "2026-06-17T02:00:00Z FTL Cannot determine default origin certificate path", + ), + ).toBe("warning"); + expect( + ManagedEndpointRuntime.classifyRelayClientOutput("2026-06-17T02:00:00Z PNC runtime panic"), + ).toBe("warning"); }); it.effect("starts, deduplicates, rotates, and stops the Cloudflare connector", () => diff --git a/apps/server/src/cloud/ManagedEndpointRuntime.ts b/apps/server/src/cloud/ManagedEndpointRuntime.ts index a1d7112a9299..89c0a23783c0 100644 --- a/apps/server/src/cloud/ManagedEndpointRuntime.ts +++ b/apps/server/src/cloud/ManagedEndpointRuntime.ts @@ -72,7 +72,10 @@ export function classifyRelayClientOutput(line: string): "connected" | "warning" if (/\bRegistered tunnel connection\b/iu.test(line)) { return "connected"; } - return /\b(?:ERR|WRN)\b/u.test(line) ? "warning" : "debug"; + // cloudflared uses zerolog level tokens. FTL (fatal) and PNC (panic) are more + // severe than ERR, so they must surface at least as loudly — without them a + // fatal connector failure would be logged at debug and hidden. + return /\b(?:ERR|WRN|FTL|PNC)\b/u.test(line) ? "warning" : "debug"; } function runtimeConfigKey(config: RelayManagedEndpointRuntimeConfig): string {