Sanitize realtime log metadata

tests/log-broadcaster.test.ts

@@ -34,4 +34,37 @@ describe('LogBroadcaster realtime bridge', () => {
       expect.objectContaining({ timestamp: occurredAt.getTime() }),
     ]);
   });
+
+  it('sanitizes circular network errors before buffering or publishing them', () => {
+    const hub = new RealtimeEventHub({ capacity: 10 });
+    const received: RealtimeEvent[] = [];
+    hub.subscribe((event) => received.push(event));
+    const broadcaster = new LogBroadcaster(hub);
+    const socket: Record<string, unknown> = { constructorName: 'TLSSocket' };
+    const parser: Record<string, unknown> = { socket };
+    socket.parser = parser;
+    const networkError = Object.assign(new Error('upstream request failed'), {
+      code: 'ECONNRESET',
+      request: socket,
+    });
+    let serializedRecent = '';
+
+    broadcaster.push('error', 'Matrix request failed', {
+      error: networkError,
+      socket,
+      authorization: 'Bearer must-not-leak',
+    });
+    broadcaster.recent(
+      { query: {} } as never,
+      { json: (value: unknown) => { serializedRecent = JSON.stringify(value); } } as never,
+    );
+
+    expect(() => JSON.stringify(received)).not.toThrow();
+    expect(() => JSON.parse(serializedRecent)).not.toThrow();
+    expect(serializedRecent).toContain('ECONNRESET');
+    expect(serializedRecent).toContain('[Circular]');
+    expect(serializedRecent).toContain('[Redacted]');
+    expect(serializedRecent).not.toContain('must-not-leak');
+    expect(serializedRecent).not.toContain('"request"');
+  });
 });