feat(ui): add browser Sentry with private source maps

[JSONbored]

Summary

• Route errors, unhandled browser exceptions, and failed app-level resource loads in the operator UI were previously invisible outside the Lovable dev sandbox (reportLovableError's window.__lovableEvents bridge is a production no-op).
• Adds apps/gittensory-ui/src/lib/browser-sentry.ts: a DSN-gated (VITE_SENTRY_DSN) browser Sentry integration, off by default — a complete no-op, @sentry/react is never even fetched when unset (a lazy dynamic import, the browser-bundle equivalent of the self-host backend's dynamic @sentry/node import in src/selfhost/sentry.ts).
• No Session Replay in this pass — only init's default error-capture integrations are used; replayIntegration/@sentry/replay are never imported or referenced.
• Every event is scrubbed before send: request cookies/headers/body data are stripped outright, secret-shaped keys/values (tokens, bearer headers, JWTs) are redacted recursively, local filesystem paths are replaced with a placeholder, and user is always dropped — no PII ever leaves the browser. Tags stay a small allowlist: route (pathname only), release, environment, app_surface.
• Wired into client.ts (init before hydration) and __root.tsx's existing ErrorComponent (captureBrowserError alongside reportLovableError).
• Source maps are opt-in at the vite.config.ts level (SENTRY_BUILD_SOURCEMAPS=1, "hidden" mode) — verified empirically that the regular unflagged build produces zero .map files, and the flagged build produces maps with no sourceMappingURL comment embedded in the shipped JS. This matters because apps/gittensory-ui's production deploy runs through Cloudflare's own Workers Build git integration, not GitHub Actions (confirmed via research — no existing workflow drives it), so the regular build must never produce a servable .map file. A new, independent ui-sentry-release.yml workflow (behind the same protected release GitHub Environment as the Orb image release) does its own never-deployed build with source maps enabled and uploads them to Sentry as a release artifact whenever apps/gittensory-ui changes on main. It fails soft (skips, doesn't error) when SENTRY_AUTH_TOKEN isn't configured, since this is an opt-in operator feature, not a required release artifact.
• Documented in the self-hosting operations docs, including the operator-side wiring needed (VITE_SENTRY_RELEASE must match this workflow's release id in Cloudflare's own deploy build vars — an external system this repo doesn't control) for source-map symbolication to actually resolve.

Test plan

• apps/gittensory-ui/src/lib/browser-sentry.test.ts (new, 18 tests) — no-DSN no-op behavior, scrub coverage (cookies/headers/body/secrets/JWTs/local-paths/recursion-depth-cap/fail-closed), tag application, no-Replay/no-tracing assertion, captureBrowserError gating
• npx tsc --noEmit clean across apps/gittensory-ui
• eslint clean (0 errors) on all changed files
• Verified empirically: default build → 0 .map files; SENTRY_BUILD_SOURCEMAPS=1 build → 116 .map files with zero sourceMappingURL comments embedded in shipped JS
• Full local gate (npm run test:ci + npm audit --audit-level=moderate) green: 831 test files passed, 0 failed

Closes #1737

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	fce3815	Commit Preview URL Branch Preview URL	Jul 14 2026, 06:27 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.05%. Comparing base (40ce138) to head (fce3815).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5709   +/-   ##
=======================================
  Coverage   95.05%   95.05%           
=======================================
  Files         581      581           
  Lines       46164    46164           
  Branches    14810    14810           
=======================================
  Hits        43880    43880           
  Misses       1523     1523           
  Partials      761      761           

Flag	Coverage Δ
shard-1	43.97% <ø> (ø)
shard-2	35.70% <ø> (ø)
shard-3	32.28% <ø> (ø)
shard-4	33.02% <ø> (-0.03%)	⬇️
shard-5	31.59% <ø> (ø)
shard-6	44.47% <ø> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-14 06:32:12 UTC}

9 files · 1 AI reviewer · 1 blocker · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• AI review could not be completed: The dual-model AI review did not return a usable verdict for this change.

Review summary
This PR adds an opt-in, DSN-gated browser Sentry integration for the operator UI, with a lazy dynamic import so the SDK never ships when unconfigured, recursive PII/secret scrubbing on every event, a low-cardinality tag allowlist, and a separate release-only GitHub Actions workflow to upload hidden source maps without ever serving them publicly. The design mirrors the existing self-host backend's dynamic-import/DSN-gate pattern, the scrubbing logic is thorough (cookies/headers/body stripped, secret-shaped keys/values redacted recursively with depth cap, user always dropped, fail-closed on scrub errors), and the source-map handling correctly uses Vite's `hidden` mode plus a workflow-only build so the public deploy never gets `.map` files or `sourceMappingURL` comments. Test coverage in browser-sentry.test.ts is solid, covering the no-op path, init wiring, scrubbing edge cases (JWT, secret keys, nested depth, poisoned getters), and the boundary tag capture.

Nits — 7 non-blocking

• apps/gittensory-ui/src/lib/browser-sentry.ts:71-77's swallow-and-return-null on any scrubbing error silently drops the event with no console warning, making a scrub bug invisible in dev — consider at least a `console.warn` in non-prod before returning null.
• The external brief flags apps/gittensory-ui/src/lib/browser-sentry.test.ts:159-160 as containing a JWT-shaped string, but it's a synthetic test fixture (`eyJ...`) used to verify redaction, not a real leaked credential — worth double-checking it's not a real token from elsewhere, but it reads as intentional test data.
• apps/gittensory-ui/src/routes/docs.self-hosting-operations.tsx:604 hardcodes an example DSN host (`o0.ingest.sentry.io`) in a code sample — fine for docs, but confirm it's clearly a placeholder value (it is, via `examplePublicKey`).
• Consider logging a dev-only warning when scrubBrowserEvent catches and drops an event, so a scrubbing regression is discoverable locally instead of silently vanishing.
• The workflow's `Skip when Sentry isn't configured` step ends the job successfully but the subsequent `Upload Sentry source maps` step is correctly gated on the same condition — this is fine, just worth a comment noting the two steps are mutually exclusive by design (already partially documented).
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• AI review could not be completed — The gate is held for a human reviewer rather than passed automatically; it re-evaluates on the next update.

Concerns raised — review before merging

• Possible leaked secret in the diff (jwt) — Remove the secret from the diff, rotate the exposed credential, then re-run the gate.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. Possible leaked secret in the diff (jwt) — Remove the secret from the diff, rotate the exposed credential, then re-run the gate.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	✅ Linked	#1737
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 45 registered-repo PR(s), 37 merged, 321 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 45 PR(s), 321 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence. LLM value judgment: significant — This closes a real observability gap (production errors were previously invisible outside the Lovable dev sandbox) with a well-scoped, opt-in, privacy-conscious implementation that mirrors existing conventions and ships thorough tests, directly addressing linked issue #1737.

Linked issue satisfaction

Addressed
The diff adds a DSN-gated browser Sentry init with a lazy import (no-op when unset), strict beforeSend scrubbing of headers/cookies/auth/PII with tests, a low-cardinality tag allowlist, route-level error capture wired into the root error boundary, a hidden-sourcemap build flag plus a maintainer-only release workflow that uploads source maps without serving them publicly, and documentation for enab

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, Ruby, Go, JavaScript, MDX, Shell, Solidity
• Official Gittensor activity: 45 PR(s), 321 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/docs/self-hosting-operations	desktop			—
/docs/self-hosting-operations	mobile			—
/	desktop			—
/	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review