CL-7247 batch 1: route packages/connections catches through reportError

packages/connections/src/connected-hook.test.ts

@@ -1,7 +1,10 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
+import * as errorSink from "@corbits/error-sink";
 import {
+  fireConnectedHook,
   fireInferenceCredentialSeedableHook,
   type InferenceCredentialSeedableInfo,
+  type ServiceConnectedInfo,
 } from "./connected-hook";
 
 function seedableInfo(): InferenceCredentialSeedableInfo {
@@ -15,6 +18,46 @@ function seedableInfo(): InferenceCredentialSeedableInfo {
   };
 }
 
+function connectedInfo(): ServiceConnectedInfo {
+  return {
+    tenantId: "tenant_1",
+    principalId: "principal_1",
+    connectorId: "github",
+    displayName: "GitHub",
+  };
+}
+
+describe("fireConnectedHook", () => {
+  test("does nothing when no hook is wired", async () => {
+    await expect(
+      fireConnectedHook(undefined, () => {}, connectedInfo()),
+    ).resolves.toBeUndefined();
+  });
+
+  test("logs and reports a hook failure rather than breaking the connect", async () => {
+    const report = spyOn(errorSink, "reportError").mockReturnValue("ref_test");
+    const logged: string[] = [];
+    await expect(
+      fireConnectedHook(
+        () => {
+          throw new Error("card settle unavailable");
+        },
+        (line) => logged.push(line),
+        connectedInfo(),
+      ),
+    ).resolves.toBeUndefined();
+    expect(logged).toHaveLength(1);
+    expect(report).toHaveBeenCalledTimes(1);
+    expect(report.mock.calls[0]?.[0]).toBeInstanceOf(Error);
+    expect(report.mock.calls[0]?.[1]).toMatchObject({
+      operation: "fire_connected_hook",
+      tenantId: "tenant_1",
+      extra: { connectorId: "github" },
+    });
+    report.mockRestore();
+  });
+});
+
 describe("fireInferenceCredentialSeedableHook", () => {
   test("does nothing when no hook is wired", async () => {
     await expect(
@@ -34,7 +77,8 @@ describe("fireInferenceCredentialSeedableHook", () => {
     expect(calls).toEqual([seedableInfo()]);
   });
 
-  test("logs and swallows a hook failure rather than breaking the connect", async () => {
+  test("logs and reports a hook failure rather than breaking the connect", async () => {
+    const report = spyOn(errorSink, "reportError").mockReturnValue("ref_test");
     const logged: string[] = [];
     await expect(
       fireInferenceCredentialSeedableHook(
@@ -48,5 +92,13 @@ describe("fireInferenceCredentialSeedableHook", () => {
     expect(logged).toHaveLength(1);
     expect(logged[0]).toContain("tenant_1");
     expect(logged[0]).toContain("drain unavailable");
+    expect(report).toHaveBeenCalledTimes(1);
+    expect(report.mock.calls[0]?.[0]).toBeInstanceOf(Error);
+    expect(report.mock.calls[0]?.[1]).toMatchObject({
+      operation: "fire_inference_credential_seedable_hook",
+      tenantId: "tenant_1",
+      extra: { provider: "ollama" },
+    });
+    report.mockRestore();
   });
 });

packages/connections/src/connected-hook.ts

@@ -5,6 +5,7 @@
 // without knowing which door the connection came through. Best-effort
 // by contract: a hook failure is logged and never breaks the connect
 // itself — the credential is already stored when this fires.
+import { reportError } from "@corbits/error-sink";
 
 export type ServiceConnectedInfo = {
   readonly tenantId: string;
@@ -30,6 +31,11 @@ export async function fireConnectedHook(
     log(
       `onConnected hook failed for ${info.connectorId} on tenant ${info.tenantId}: ${message}`,
     );
+    reportError(cause, {
+      operation: "fire_connected_hook",
+      tenantId: info.tenantId,
+      extra: { connectorId: info.connectorId },
+    });
   }
 }
 
@@ -77,5 +83,10 @@ export async function fireInferenceCredentialSeedableHook(
     log(
       `onInferenceCredentialUsable hook failed for ${info.provider} on tenant ${info.tenantId}: ${message}`,
     );
+    reportError(cause, {
+      operation: "fire_inference_credential_seedable_hook",
+      tenantId: info.tenantId,
+      extra: { provider: info.provider },
+    });
   }
 }

packages/connections/src/github-connect.test.ts

@@ -3,7 +3,8 @@
 // surface GitHub's own `error`/`error_description` shape (distinct from
 // a non-2xx status — GitHub's token endpoint answers 200 with an `error`
 // field on a rejected code).
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
+import * as errorSink from "@corbits/error-sink";
 import {
   exchangeCodeForGithubToken,
   type ExchangeFetch,
@@ -101,6 +102,7 @@ describe("exchangeCodeForGithubToken", () => {
   });
 
   test("a transport failure is reported honestly", async () => {
+    const report = spyOn(errorSink, "reportError").mockReturnValue("ref_test");
     const fetchImpl: ExchangeFetch = async () => {
       throw new Error("getaddrinfo ENOTFOUND");
     };
@@ -118,5 +120,11 @@ describe("exchangeCodeForGithubToken", () => {
       expect(result.message).toContain("Could not reach GitHub");
       expect(result.message).toContain("getaddrinfo ENOTFOUND");
     }
+    expect(report).toHaveBeenCalledTimes(1);
+    expect(report.mock.calls[0]?.[0]).toBeInstanceOf(Error);
+    expect(report.mock.calls[0]?.[1]).toMatchObject({
+      operation: "exchange_code_for_github_token",
+    });
+    report.mockRestore();
   });
 });

packages/connections/src/github-connect.ts

@@ -12,6 +12,7 @@
 // still names `credentialPlugin: "http"`).
 
 import { type } from "arktype";
+import { reportError } from "@corbits/error-sink";
 
 export const GITHUB_AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
 export const GITHUB_TOKEN_EXCHANGE_URL =
@@ -69,6 +70,7 @@ export async function exchangeCodeForGithubToken(
       }),
     });
   } catch (cause) {
+    reportError(cause, { operation: "exchange_code_for_github_token" });
     return {
       ok: false,
       message:

packages/connections/src/gmail-connect.test.ts

@@ -2,7 +2,8 @@
 // entirely against a stubbed fetch — no Google credentials involved.
 // Live-key verification against a real Google OAuth app is a deploy
 // concern (`GMAIL_CLIENT_ID`/`GMAIL_CLIENT_SECRET`), not a test one.
-import { expect, test } from "bun:test";
+import { expect, spyOn, test } from "bun:test";
+import * as errorSink from "@corbits/error-sink";
 
 import {
   exchangeCodeForGoogleToken,
@@ -89,3 +90,25 @@ test("a Google error response maps to an honest failure that never echoes token
   expect(result.message).toContain("invalid_grant");
   expect(result.message).not.toContain("secret-1");
 });
+
+test("a transport failure is reported and never crashes", async () => {
+  const report = spyOn(errorSink, "reportError").mockReturnValue("ref_test");
+  const result = await exchangeCodeForGoogleToken({
+    code: "auth-code-1",
+    redirectUri: "https://bench.example.com/callback",
+    clientId: "client-1",
+    clientSecret: "secret-1",
+    fetchImpl: async () => {
+      throw new Error("getaddrinfo ENOTFOUND");
+    },
+  });
+  expect(result.ok).toBe(false);
+  if (result.ok) throw new Error("expected failure");
+  expect(result.message).toContain("getaddrinfo ENOTFOUND");
+  expect(report).toHaveBeenCalledTimes(1);
+  expect(report.mock.calls[0]?.[0]).toBeInstanceOf(Error);
+  expect(report.mock.calls[0]?.[1]).toMatchObject({
+    operation: "exchange_code_for_google_token",
+  });
+  report.mockRestore();
+});

packages/connections/src/gmail-connect.ts

@@ -11,6 +11,7 @@
 // authorize URL) for the credential row to keep alongside the secret.
 
 import { type } from "arktype";
+import { reportError } from "@corbits/error-sink";
 
 export const GOOGLE_AUTHORIZE_URL =
   "https://accounts.google.com/o/oauth2/v2/auth";
@@ -83,6 +84,7 @@ export async function exchangeCodeForGoogleToken(
       body: params.toString(),
     });
   } catch (cause) {
+    reportError(cause, { operation: "exchange_code_for_google_token" });
     const message = cause instanceof Error ? cause.message : String(cause);
     return { ok: false, message: `Google token exchange failed: ${message}` };
   }

packages/connections/src/huggingface-connect.test.ts

@@ -0,0 +1,61 @@
+// The exchange's own contract: parse Hugging Face's response at the trust
+// boundary without ever putting token material in a failure message, and
+// route a transport failure through reportError.
+import { describe, expect, spyOn, test } from "bun:test";
+import * as errorSink from "@corbits/error-sink";
+import {
+  exchangeCodeForToken,
+  type ExchangeFetch,
+} from "./huggingface-connect";
+
+describe("exchangeCodeForToken", () => {
+  test("trades the code and verifier for an access token", async () => {
+    const fetchImpl: ExchangeFetch = async () =>
+      new Response(
+        JSON.stringify({ access_token: "hf_minted_token", expires_in: 3600 }),
+        { status: 200 },
+      );
+
+    const result = await exchangeCodeForToken({
+      code: "auth_code_1",
+      codeVerifier: "verifier_1",
+      redirectUri: "https://hub.example.test/callback",
+      clientId: "client_1",
+      fetchImpl,
+      now: () => 0,
+    });
+
+    expect(result).toEqual({
+      ok: true,
+      accessToken: "hf_minted_token",
+      expiresAt: new Date(3600 * 1000).toISOString(),
+    });
+  });
+
+  test("a transport failure is reported, never token material", async () => {
+    const report = spyOn(errorSink, "reportError").mockReturnValue("ref_test");
+    const fetchImpl: ExchangeFetch = async () => {
+      throw new Error("getaddrinfo ENOTFOUND");
+    };
+
+    const result = await exchangeCodeForToken({
+      code: "auth_code_1",
+      codeVerifier: "verifier_1",
+      redirectUri: "https://hub.example.test/callback",
+      clientId: "client_1",
+      fetchImpl,
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.message).toContain("Could not reach Hugging Face");
+      expect(result.message).toContain("getaddrinfo ENOTFOUND");
+    }
+    expect(report).toHaveBeenCalledTimes(1);
+    expect(report.mock.calls[0]?.[0]).toBeInstanceOf(Error);
+    expect(report.mock.calls[0]?.[1]).toMatchObject({
+      operation: "exchange_code_for_huggingface_token",
+    });
+    report.mockRestore();
+  });
+});

packages/connections/src/huggingface-connect.ts

@@ -14,6 +14,7 @@
 // later expiry sweep reads.
 
 import { type } from "arktype";
+import { reportError } from "@corbits/error-sink";
 
 export const HUGGINGFACE_AUTHORIZE_URL =
   "https://huggingface.co/oauth/authorize";
@@ -90,6 +91,7 @@ export async function exchangeCodeForToken(
       body: body.toString(),
     });
   } catch (cause) {
+    reportError(cause, { operation: "exchange_code_for_huggingface_token" });
     return {
       ok: false,
       message: