feat: add privacy-safe server diagnostics

control-plane/src/admin-cli.ts

@@ -1,6 +1,7 @@
 import { closePool } from './db.js';
 import { loadConfig } from './config.js';
 import { AuthService } from './auth.js';
+import { writeEmergencyDiagnostic } from './diagnostics.js';
 
 function readFlag(name: string): string {
   const index = process.argv.indexOf(name);
@@ -17,7 +18,13 @@ async function main(): Promise<void> {
       process.env.ADMIN_PASSWORD || readFlag('--password'),
       { force: process.argv.includes('--force') }
     );
-    console.log(JSON.stringify({ ok: true, action: 'bootstrap', username: user.username, organization_id: user.organizationId }));
+    console.log(JSON.stringify({
+      ok: true,
+      diagnostic_event: 'admin.bootstrap.completed',
+      diagnostic_stage: 'admin_cli',
+      action: 'bootstrap',
+      administrator_created: Boolean(user.id)
+    }));
     return;
   }
   if (command === 'reset-password') {
@@ -25,7 +32,12 @@ async function main(): Promise<void> {
       process.env.ADMIN_USERNAME || readFlag('--username'),
       process.env.ADMIN_PASSWORD || readFlag('--password')
     );
-    console.log(JSON.stringify({ ok: true, action: 'reset-password' }));
+    console.log(JSON.stringify({
+      ok: true,
+      diagnostic_event: 'admin.password_reset.completed',
+      diagnostic_stage: 'admin_cli',
+      action: 'reset-password'
+    }));
     return;
   }
   throw new Error('Usage: npm run admin -- bootstrap|reset-password (use ADMIN_USERNAME and ADMIN_PASSWORD)');
@@ -33,7 +45,9 @@ async function main(): Promise<void> {
 
 main()
   .catch((error) => {
-    console.error(JSON.stringify({ ok: false, error: error.message || String(error) }));
+    writeEmergencyDiagnostic('admin.command.failed', error, {
+      diagnostic_stage: 'admin_cli'
+    });
     process.exitCode = 1;
   })
   .finally(() => closePool());