Repository navigation
feat(cli): azureclaw audit tail — stream durable JSONL audit log (Slice 4b) - #289
Merged
Merged
Conversation
…ce 4b) Closes Slice 4 DoD #7. Slice 4a (PR #287) gave the router a sandbox-local JSONL audit sink at /var/log/azureclaw/audit/{YYYY-MM-DD}.jsonl; this slice gives operators a first-class way to read it. `azureclaw audit tail <sandbox>` shells into the sandbox's inference-router container and tails the day-keyed JSONL file. Flags mirror the practical operator workflow: --follow, --lines (cap 10000), --decision / --agent / --action filters, --date YYYY-MM-DD for historical files, --json for machine-readable output, --dir override for non-default AZURECLAW_AUDIT_DIR. The --date parameter is regex-validated (^\d{4}-\d{2}-\d{2}$) before shell interpolation; shell-metacharacter injection attempts are rejected at the CLI boundary. 26 vitest cases cover parseRow/parseLines/validateDateKey/matchesFilters/ renderPrettyLine, including malformed-line resilience (the tail keeps going) and forward-compat for future AuditRow fields. CLI test suite: 679 passing (was 652 — +26 audit, +1 elsewhere on dev). typecheck + lint clean. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Slice 4 DoD #7. Builds directly on Slice 4a (PR #287).
What
azureclaw audit tail <sandbox>shells into the sandbox'sinference-routercontainer and tails the day-keyed JSONL file theSlice 4a sink writes at
/var/log/azureclaw/audit/{YYYY-MM-DD}.jsonl.Flags:
-l, --lines N-f, --followtail -Fsemantics: stream as the router writes--decision <state>--agent <id>--action <substr>--date YYYY-MM-DD--dir <path>/var/log/azureclaw/auditAZURECLAW_AUDIT_DIR--json-n, --namespace <ns>azureclaw-<sandbox>Pretty render colours by decision (allowed/success green,
denied/flagged/rejected red, sanitized yellow), truncates long
agent_idandactionwith…, and prints a one-line header.Wire contract
Matches
audit_jsonl::JsonlRecordbyte-for-byte:sandbox, seq, ts, agent_id, action, decision, prev_hash, hash.parseRowisforward-compatible — extra fields are preserved on the row but ignored
by the renderer.
Safety
--dateis regex-validated (^\\d{4}-\\d{2}-\\d{2}$) beforeinterpolation into the in-pod shell command.
--diris single-quotedwith embedded-quote escape. There is no
--exec/raw-shell escapehatch.
Tests
26 new vitest cases (
cli/src/commands/audit.test.ts) cover:parseLinesboundary (default, valid, zero, negative, non-numeric, over-cap, cap-exact)todayUtcKeyformatting and zero-paddingvalidateDateKeyaccepting valid + rejecting metacharacter attemptsparseRowround-trip + forward-compat + malformed-JSON + wrong-type + missing-field pathsmatchesFiltersdecision / agent / action / AND-combined / no-filterrenderHeadercolumn set,renderPrettyLinecontent + truncationSuite total: 679 passing (was 652 on dev).
npm run typecheck+npm run lint+npm run buildall clean.DoD coverage
Slice 4 DoD #7 ✅. Remaining 4b deferrals (cross-day search, jq-friendly
alias) tracked under Slice 4c.
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com