Renderer logging silently drops object arguments (universe-log bug)

Summary

The @hive/renderer package uses universe-log 5.2.0 for logging, which has a fundamental bug: objects passed as arguments are silently dropped from output.

Problem

Objects Are Lost

When logging with object arguments:

Log.log().debug('LinkSanitizer#sanitizeLink', 'phishing link detected', url, {
    url,
    urlTitle
});

Expected output (all arguments visible):

[debug]: LinkSanitizer#sanitizeLink phishing link detected https://... {url: "...", urlTitle: "..."}

Actual output (object dropped):

@hiveio/content-renderer | ... [debug]: LinkSanitizer#sanitizeLink; phishing link detected; phishing list; https://...

The {url, urlTitle} object is silently dropped because universe-log's OnelineLogFormat only outputs the message field, and parseObject() merges objects into the internal structure but never adds them to message.

All Logs Use console.error()

Additionally, ALL log levels (debug, info, warn, error) are output via console.error():

// StaticConfig.js
StaticConfig.DEFAULT_LOG_FN = (msg) => console.error(msg);

This causes:

• All logs appear as red errors in browser DevTools
• Cannot filter by log level in DevTools
• Misleading severity indication

Evidence

The bug was already discovered and worked around in LinkSanitizer.ts:28-29:

// Commented out: broken log that doesn't display url/urlTitle, just noise
// Log.log().debug('LinkSanitizer#sanitizeLink', {url, urlTitle});

Affected Log Calls

File	Call Pattern	Status
TagTransformingSanitizer.ts	.warn(\template`)`	✅ Works
*Embedder.ts (7 files)	.error(error)	✅ Works
LinkSanitizer.ts	.debug(str, str, str, url, obj)	❌ Object lost
DefaultRenderer.test.ts	.debug('rendered', rendered)	⚠️ May lose data

Root Cause

universe-log 5.2.0 is abandoned (last updated August 2019) and has design flaws:

1. ParseLogMsg.parseObject() merges objects into internal state but not into message
2. OnelineLogFormat.format() only outputs msg.message, ignoring other fields
3. DEFAULT_LOG_FN uses console.error() for everything

Solution

Replace universe-log with pino (already used elsewhere in denser). Pino:

• Passes all arguments directly to appropriate console methods
• Uses console.warn() for warnings, console.debug() for debug, etc.
• Objects are fully visible and expandable in DevTools

This will be fixed as part of the CSP compliance work (replacing universe-log due to its new Function() usage).

Labels

• bug
• renderer