feat(selfhost): opt-in @sentry/node error tracking with boot/queue/review capture seams

[JSONbored]

Reconciles Sentry #1468 from the self-host batch onto current main. (The batch's original commit sat on top of the diverged lane-refactor, so cherry-pick wasn't clean — I re-applied the captures fresh to main's files.)

Modular opt-in via SENTRY_DSN — a complete no-op when unset; @sentry/node is dynamically imported so it never enters the Worker bundle. When on: boot crashes (uncaught/unhandled, flushed before exit), queue dead-letter on both backends, and degraded reviews tagged by repo/PR/SHA. beforeSend scrubs token/secret-like fields. 100% line+branch coverage, 10 tests.

First of the batch-reconciliation PRs (Sentry → dashboards → Discord → Redis → per-repo features).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.37%. Comparing base (8844796) to head (f8e665b).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1547      +/-   ##
==========================================
+ Coverage   95.36%   95.37%   +0.01%     
==========================================
  Files         197      198       +1     
  Lines       21464    21514      +50     
  Branches     7759     7776      +17     
==========================================
+ Hits        20470    20520      +50     
  Misses        416      416              
  Partials      578      578              

Files with missing lines	Coverage Δ
src/queue/processors.ts	87.43% <100.00%> (+<0.01%)	⬆️
src/selfhost/sentry.ts	100.00% <100.00%> (ø)
src/selfhost/sqlite-queue.ts	97.33% <100.00%> (+0.19%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[superagent-security]

P2: Sentry beforeSend scrubber misses secret-bearing event fields

beforeSend only scrubs headers, contexts, and extra, missing URL query params, breadcrumbs, and error messages where secrets often appear.

Expand scrubEvent to recursively redact secrets across the entire Sentry event, including request.url, breadcrumbs, and exception values.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name="src/selfhost/sentry.ts">
<violation number="1" location="src/selfhost/sentry.ts:47">
<priority>P2</priority>
<title>Sentry beforeSend scrubber misses secret-bearing event fields</title>
<evidence>The scrubEvent function only redacts request.headers, contexts, and extra, leaving many Sentry event fields unscrubbed. Secrets in error messages (exception.values[].value), request URLs with query parameters (request.url, request.query_string), breadcrumbs, user context, and stack-trace local variables can leak to the configured Sentry endpoint.</evidence>
<recommendation>Expand scrubEvent to recursively redact secret-patterned keys across the entire Sentry event object, not just a whitelist of three fields. Alternatively, specifically target additional secret-bearing fields such as request.url, request.query_string, breadcrumbs, exception.values[].value, and user context. Consider using Sentry&apos;s built-in sendDefaultPii: false and server-side data scrubbing as defense-in-depth.</recommendation>
</violation>
</file>