p1: cap jq output, log refusals, fail contract without SDK

jq results are bounded (10k items / output cap) and return 400 when
exceeded. 401/403 log caller, host, and reason. make contract exits 1
unless firecrawl-py is present (SIFT_CONTRACT_SKIP_SDK=1 to skip).

tests/contract/sdk_test.py

@@ -26,6 +26,30 @@ class Handler(BaseHTTPRequestHandler):
         pass
 
     def do_GET(self):
+        if self.path.startswith("/forbid"):
+            body = b"nope"
+            self.send_response(403)
+            self.send_header("Content-Type", "text/plain")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            return
+        if self.path.startswith("/big"):
+            body = b"x" * (6 * 1024 * 1024)
+            self.send_response(200)
+            self.send_header("Content-Type", "text/plain")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            return
+        if self.path.startswith("/json"):
+            body = b'{"hello":"contract"}'
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            return
         body = b"<!doctype html><html><head><title>Contract</title></head><body><article><p>hello contract</p></article></body></html>"
         self.send_response(200)
         self.send_header("Content-Type", "text/html; charset=utf-8")
@@ -52,14 +76,14 @@ def main() -> int:
 
     tmp = Path(tempfile.mkdtemp(prefix="sift-contract-"))
     keys = tmp / "keys.toml"
-    keyfile = tmp / "key"
     raw = secrets.token_urlsafe(32)
-    keyfile.write_text(raw + "\n")
-    keyfile.chmod(0o600)
     digest = hashlib.sha256(raw.encode()).hexdigest()
-    keys.write_text(f'[[caller]]\nname = "contract"\nworkspace = "hermes-fleet"\nkey_sha256 = "{digest}"\n')
+    keys.write_text(
+        f'[[caller]]\nname = "contract"\nworkspace = "hermes-fleet"\nkey_sha256 = "{digest}"\n'
+    )
 
     listen = f"127.0.0.1:{free_port()}"
+    logf = tmp / "sift.log"
     proc = subprocess.Popen(
         [
             str(BIN),
@@ -71,8 +95,8 @@ def main() -> int:
             "-test-allow-prefix",
             "127.0.0.0/8",
         ],
-        stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
+        stdout=logf.open("w"),
+        stderr=subprocess.STDOUT,
     )
     try:
         for _ in range(50):
@@ -98,40 +122,42 @@ def main() -> int:
         with urllib.request.urlopen(req, timeout=10) as resp:
             env = json.loads(resp.read())
         assert env.get("success") is True, env
-        md = env["data"]["markdown"]
-        assert "hello" in md.lower() or "contract" in md.lower(), md
-        assert env["data"]["metadata"]["title"]
 
-        # 403 guard
-        req = urllib.request.Request(
-            f"http://{listen}/v2/scrape",
-            data=json.dumps({"url": "http://10.0.0.5/"}).encode(),
-            headers={
-                "Authorization": f"Bearer {raw}",
-                "Content-Type": "application/json",
-            },
-            method="POST",
-        )
-        try:
-            urllib.request.urlopen(req, timeout=10)
-            print("expected 403", file=sys.stderr)
-            return 1
-        except urllib.error.HTTPError as e:
-            if e.code != 403:
-                print("want 403 got", e.code, file=sys.stderr)
-                return 1
-
-        # Real SDK if installed.
+        skip = os.environ.get("SIFT_CONTRACT_SKIP_SDK") == "1"
         try:
             from firecrawl import Firecrawl  # type: ignore
         except ImportError:
-            print("firecrawl-py not installed; JSON contract passed")
-            return 0
+            if skip:
+                print("SIFT_CONTRACT_SKIP_SDK=1; SDK not installed")
+                return 0
+            print("firecrawl-py==4.17.0 is required for make contract", file=sys.stderr)
+            print("install it, or set SIFT_CONTRACT_SKIP_SDK=1", file=sys.stderr)
+            return 1
 
         app = Firecrawl(api_url=f"http://{listen}", api_key=raw)
         doc = app.scrape(page, formats=["markdown"])
-        text = getattr(doc, "markdown", None) or (doc.get("markdown") if isinstance(doc, dict) else None)
+        text = getattr(doc, "markdown", None) or (
+            doc.get("markdown") if isinstance(doc, dict) else None
+        )
         assert text, doc
+
+        def scrape_err(url: str, key: str | None = None):
+            c = Firecrawl(api_url=f"http://{listen}", api_key=key if key is not None else raw)
+            try:
+                c.scrape(url, formats=["markdown"])
+                raise AssertionError(f"expected error for {url}")
+            except Exception as e:
+                return str(e)
+
+        msg = scrape_err("http://10.0.0.5/")
+        assert "blocked:" in msg, msg
+        msg = scrape_err(f"http://127.0.0.1:{fx_port}/forbid")
+        assert "hint: browser" in msg, msg
+        msg = scrape_err(f"http://127.0.0.1:{fx_port}/big")
+        assert "413" in msg or "too large" in msg, msg
+        msg = scrape_err(page, key="wrong")
+        assert "401" in msg or "Unauthorized" in msg or "unauthorized" in msg.lower(), msg
+
         print("firecrawl-py SDK contract passed")
         return 0
     finally: