Ridvansirma/pgduck engine server side error logs

[sfc-gh-rsirma]

Problem

Postgres already logs a canned class for engine failures (out_of_memory, io_error, invalid_input, internal_error, other). Failures that never reach a client cleanly (fatal OOM, lost connection) only show up in pgduck_server stderr, mixed with DuckDB messages, query snippets, and client addresses, so a collector cannot take those lines as-is.

Solution

Emit the same class from handle_pgsession_error_message, the choke point for reportable DuckDB statuses, including fatal ones that exit() right after. The line is only pgduck_engine_error: . Collectors have to match that prefix; every other stderr line here may still carry PII.

--no_log_engine_errors turns the class line off without changing the SQLSTATE or error text. Startup logs that the classification is off, naming pgduck_engine_error without a trailing colon so a prefix-based collector does not treat the announcement as an error.

Protocol stubs (named prepared statements, COPY, Close) and type-conversion statuses with a NULL SQLSTATE stay off this line or land in other, same as today.

---

Checklist

• I have tested my changes and added tests if necessary
• I updated documentation if needed
• I confirm that all my commits are signed off (DCO)

---

DCO Reminder (important)

This project uses the Developer Certificate of Origin (DCO).
DCO is a simple way for you to confirm that you wrote your code and that you have the right to contribute it.

If the DCO check fails, please sign off your commits.

How to sign off

For your last commit:
git commit --amend -s
git push --force

For multiple commits:
git rebase --signoff main
git push --force

More info: https://developercertificate.org/

[sfc-gh-abozkurt]

try setting credentials in a pgduck_server session and make it throw some error. and lets verify if the credentials in the failing command show up in the log with the prefix. (we should not leak credential with this prefix)

[sfc-gh-rsirma]

try setting credentials in a pgduck_server session and make it throw some error. and lets verify if the credentials in the failing command show up in the log with the prefix. (we should not leak credential with this prefix)

In any failure that goes through this helper, the new line is only LOG pgduck_engine_error: . The class is the SQLSTATE mapping (out_of_memory / io_error / invalid_input / internal_error / other). No SQL, no DuckDB message, no credentials.

I also added a test that fails CREATE SECRET with a KEY_ID, SECRET, and SESSION_TOKEN and checks that none of those values appear on that line.