fix: error-only Sentry telemetry, storm-proof capture, and crash fixes (#476)

Removes Sentry tracing entirely (BullMQ idle polling burned 4.8M transactions in 2 days at the baked 0.1 rate), decouples PostHog sampling, and replaces the type-only error scrub with a vetted-field sanitizer plus SafeError/ToolInputError contracts. One classified capture path with per-signature throttles and a per-process ceiling makes storms impossible (NODE-1E was 4,541 events from one 30s loop). Browser errors move to a dedicated web Sentry project with their own source maps. Adds the SNAPOTTER_TELEMETRY runtime kill switch and silences test fleets.

Crash fixes: remote 204/304 SSRF process kill (NODE-20), conversion-preset boot crash loop (NODE-21), Redis version preflight + unhandled subscribe rejection (NODE-1T), Sign PDF on plain-http origins (NODE-1K/1M), wavesurfer/pdf.js teardown rejections (NODE-1P/1N), bundle-import ZlibError to 400 (NODE-1Z), chart-maker input errors declassified (NODE-1H/1J), asset requests skip the session DB lookup (NODE-1D).
This commit is contained in:
SnapOtter
2026-07-10 21:41:49 +08:00
committed by GitHub
parent 3d1744aec8
commit ae6a4c8b7c
75 changed files with 2198 additions and 260 deletions
+3 -1
View File
@@ -14,7 +14,9 @@ test.describe("Privacy Policy Page", () => {
test("mentions PostHog as analytics provider", async ({ loggedInPage: page }) => {
await page.goto("/privacy");
await expect(page.getByText(/posthog/i)).toBeVisible({ timeout: 5_000 });
// The page legitimately mentions PostHog more than once; first() avoids a
// strict-mode collision without weakening the presence assertion.
await expect(page.getByText(/posthog/i).first()).toBeVisible({ timeout: 5_000 });
});
test("mentions Sentry as error tracking provider", async ({ loggedInPage: page }) => {