feat(scripts): Log global on the compile surface and both Test Run sandboxes; trust-gate pin (D4)

2026-09-09 12:21:23 -04:00
parent 964bb9b2d7
commit b2418b41e1
6 changed files with 169 additions and 0 deletions
@@ -212,6 +212,24 @@ public class ScriptTrustValidatorTests
        Assert.Empty(ScriptTrustValidator.FindViolations(code));
    }

+    [Fact]
+    public void Allows_TheLogGlobal()
+    {
+        // Flow Debugger step logs (design 2026-09-09 D4). The trust model is a DENY-list
+        // over API roots, not an allow-list of context members, so the `Log` global needs
+        // no policy entry — including the overload that attaches a System.Exception, which
+        // is a permitted BCL type. This pins that a logging script is not blocked.
+        const string code = """
+            Log.Info("x");
+            Log.Debug("d");
+            Log.Warn("w", new System.Exception("boom"));
+            Log.Error("e");
+            Instance.Log.Info("via instance");
+            """;
+
+        Assert.Empty(ScriptTrustValidator.FindViolations(code));
+    }
+
    [Fact]
    public void ForbiddenScopes_DoNotCover_TheCommonsScriptSurface()
    {