Merge pull request #644 from kai392/fix/critical-issue-zero-tail-returns-all

fix(audit): kb.audit with tail=0 returns the entire log instead of nothing

Author: plind-junior

CHANGELOG.md

@@ -94,6 +94,13 @@ All notable changes to vouch are documented here. Format follows
   `prompt_gate_cfg` still used bare `bool()`, so a quoted
   `enabled: "false"` silently turned those features *on*. both now
   use `coerce_bool`.
+- **a zero `tail` on `kb.audit` returns no events, not every event**: the
+  window was `events[-tail:]`, and `-0` is `0`, so asking for zero events
+  sliced from the start and handed back the whole visible log — a negative
+  tail dropped that many off the front and returned the rest. all three
+  surfaces (mcp, jsonl, cli) now share `audit.tail_events`, so the clamp
+  cannot drift between them. `retrieval_events.read_events` carried the same
+  `[-limit:]` boundary and is fixed with it.
 - **digest drops archived followup pages** (#625):
   `followups_due` already skipped `done`/`dropped` metadata, but an
   `ARCHIVED` page with `followup_status=open` and a past `due_at` still

src/vouch/audit.py

@@ -240,6 +240,18 @@ def read_events(
             yield event
 
 
+def tail_events(events: list[AuditEvent], tail: int) -> list[AuditEvent]:
+    """The newest ``tail`` events; none when ``tail`` is not positive.
+
+    ``events[-tail:]`` is the obvious spelling and is wrong at the boundary:
+    ``-0`` is ``0``, so a zero tail slices from the start and hands back the
+    whole log — the opposite of the bound the caller asked for. A negative tail
+    is worse, dropping that many events off the front and returning the rest.
+    Shared by the three ``kb.audit`` surfaces so the clamp cannot drift.
+    """
+    return events[-tail:] if tail > 0 else []
+
+
 def count_events(kb_dir: Path) -> int:
     path = _audit_path(kb_dir)
     if not path.exists():

src/vouch/cli.py

@@ -3985,7 +3985,9 @@ def audit(tail: int, as_json: bool, project: str | None, agent: str | None) -> N
         project=project,
         agent=agent,
     )
-    events = list(audit_mod.read_events(store.kb_dir, store=store, viewer=viewer))[-tail:]
+    events = audit_mod.tail_events(
+        list(audit_mod.read_events(store.kb_dir, store=store, viewer=viewer)), tail
+    )
     if as_json:
         _emit_json({
             "viewer": {"project": viewer.project, "agent": viewer.agent},

src/vouch/jsonl_server.py

@@ -760,7 +760,9 @@ def _h_audit(p: dict) -> dict:
     s = _store()
     viewer = viewer_from_params(s, p)
     tail = int(p.get("tail", 50))
-    events = list(audit.read_events(s.kb_dir, store=s, viewer=viewer))[-tail:]
+    events = audit.tail_events(
+        list(audit.read_events(s.kb_dir, store=s, viewer=viewer)), tail
+    )
     return {
         "viewer": {"project": viewer.project, "agent": viewer.agent},
         "events": [e.model_dump(mode="json") for e in events],

src/vouch/retrieval_events.py

@@ -162,6 +162,7 @@ def read_events(store: KBStore, *, limit: int | None = None) -> list[dict[str, A
                 out.append(obj)
     except OSError:
         return []
-    if limit is not None and limit >= 0:
-        return out[-limit:]
-    return out
+    if limit is None:
+        return out
+    # `out[-0:]` is `out[:]`, so a zero limit would return the whole log.
+    return out[-limit:] if limit > 0 else []

src/vouch/server.py

@@ -1152,7 +1152,9 @@ def kb_audit(
         project=project,
         agent=agent,
     )
-    events = list(audit.read_events(store.kb_dir, store=store, viewer=viewer))[-tail:]
+    events = audit.tail_events(
+        list(audit.read_events(store.kb_dir, store=store, viewer=viewer)), tail
+    )
     return {
         "viewer": {"project": viewer.project, "agent": viewer.agent},
         "events": [e.model_dump(mode="json") for e in events],

tests/test_audit.py

@@ -17,6 +17,31 @@ def store(tmp_path: Path) -> KBStore:
     return KBStore.init(tmp_path)
 
 
+@pytest.mark.parametrize("tail,expected", [(3, 3), (1, 1), (99, 5), (0, 0), (-1, 0)])
+def test_tail_events_never_widens_the_window(
+    store: KBStore, tail: int, expected: int
+) -> None:
+    """A non-positive tail selects nothing.
+
+    `events[-tail:]` reads as "the last N" but `-0 == 0`, so a zero tail
+    sliced from the start and returned the entire log — the opposite of the
+    bound asked for. A negative tail dropped that many off the front instead.
+    """
+    for i in range(5):
+        audit.log_event(store.kb_dir, event=f"x.e{i}", actor="u")
+    events = list(audit.read_events(store.kb_dir))
+
+    assert len(audit.tail_events(events, tail)) == expected
+
+
+def test_tail_events_keeps_the_newest(store: KBStore) -> None:
+    for i in range(5):
+        audit.log_event(store.kb_dir, event=f"x.e{i}", actor="u")
+    events = list(audit.read_events(store.kb_dir))
+
+    assert [e.event for e in audit.tail_events(events, 2)] == ["x.e3", "x.e4"]
+
+
 def test_audit_log_appends(store: KBStore) -> None:
     audit.log_event(store.kb_dir, event="x.test", actor="u", object_ids=["a"])
     audit.log_event(store.kb_dir, event="x.test2", actor="u")

tests/test_jsonl_server.py

@@ -17,6 +17,26 @@ def store(tmp_path: Path) -> KBStore:
     return KBStore.init(tmp_path)
 
 
+def test_jsonl_audit_zero_tail_returns_no_events(store: KBStore, monkeypatch) -> None:
+    """`kb.audit` with tail=0 must return nothing, not the whole log.
+
+    The window was `events[-tail:]`, and `-0` is `0`, so asking for zero
+    events sliced from the start and dumped every event the viewer could see.
+    """
+    from vouch import audit
+
+    for i in range(4):
+        audit.log_event(store.kb_dir, event=f"x.e{i}", actor="u")
+    monkeypatch.chdir(store.root)
+
+    resp = handle_request({"id": "r1", "method": "kb.audit", "params": {"tail": 0}})
+    assert resp["ok"]
+    assert resp["result"]["events"] == []
+
+    bounded = handle_request({"id": "r2", "method": "kb.audit", "params": {"tail": 2}})
+    assert [e["event"] for e in bounded["result"]["events"]] == ["x.e2", "x.e3"]
+
+
 def test_jsonl_search_request(store: KBStore, monkeypatch) -> None:
     src = store.put_source(b"e")
     store.put_claim(Claim(id="c1", text="findable token", evidence=[src.id]))