From 1d927a4590936528b55ea69af9aa3e3a81b68ead Mon Sep 17 00:00:00 2001
From: Khaliq <khaliqgant@gmail.com>
Date: Thu, 3 Sep 2026 21:33:28 +0200
Subject: [PATCH] test(fleet): guard control-plane error redaction

---
 src/fleet/control-plane-circuit.test.ts | 30 +++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/src/fleet/control-plane-circuit.test.ts b/src/fleet/control-plane-circuit.test.ts
index c7619174..ccde1fdf 100644
--- a/src/fleet/control-plane-circuit.test.ts
+++ b/src/fleet/control-plane-circuit.test.ts
@@ -8,12 +8,42 @@ import {
   DEFAULT_FLEET_ROSTER_TIMEOUT_MS,
   FleetControlPlaneCircuit,
   FleetControlPlaneCircuitOpenError,
+  describeControlPlaneError,
   guardFleetControlPlane,
   isFleetControlPlaneFailure,
 } from './control-plane-circuit'
 
 const roster: RosterEntry = { agents: [], nodes: [] }
 
+describe('describeControlPlaneError', () => {
+  it.each([
+    'request failed for https://relay.invalid/events?credential=example-secret',
+    'authorization failed for Bearer example.invalid.token',
+    'could not connect to postgres://example-user:example-password@db.invalid/factory',
+  ])('redacts transport text from an Error message', (message) => {
+    const error = new Error(message)
+    error.name = 'FleetTransportError'
+
+    expect(describeControlPlaneError(error)).toBe('FleetTransportError')
+  })
+
+  it('appends a well-formed error code', () => {
+    const error = Object.assign(new Error('transport details'), { code: 'ECONNREFUSED_42' })
+
+    expect(describeControlPlaneError(error)).toBe('Error (ECONNREFUSED_42)')
+  })
+
+  it.each([
+    'connection_refused',
+    'CONNECTION-REFUSED',
+    'A'.repeat(81),
+  ])('drops a malformed error code', (code) => {
+    const error = Object.assign(new Error('transport details'), { code })
+
+    expect(describeControlPlaneError(error)).toBe('Error')
+  })
+})
+
 describe('FleetControlPlaneCircuit', () => {
   afterEach(() => {
     vi.useRealTimers()