[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Integrates Sentry across apps/app and apps/portal for error tracking, tracing, and session replay. Adds client, server, and edge setup with source map upload and a /monitoring tunnel.

• New Features

  • Added @sentry/nextjs on server, edge, and client with env-driven DSN and dev/prod trace sampling; removed sendDefaultPii and gated includeLocalVariables to non-production.
  • Wrapped Next configs with withSentryConfig for source maps, debug-log treeshake, and /monitoring tunnel; apps/app also enables automaticVercelMonitors.
  • Captures exceptions in each app’s global-error.tsx; exports onRequestError and router transition capture.
  • Session replay enabled (10% sessions; 100% on error). Unmasks text and media by default, with .sentry-mask, [data-sentry-mask], and [data-sentry-block] selectors for selective masking/blocking.
  • Merged botid init into apps/app/src/instrumentation-client.ts alongside Sentry.
  • Allowed Sentry env vars through Turbo (NEXT_PUBLIC_SENTRY_DSN, SENTRY_AUTH_TOKEN, SENTRY_DSN); added .mcp.json for the Sentry MCP server.

• Migration

  • Set SENTRY_AUTH_TOKEN in CI/Vercel to upload source maps.
  • Set SENTRY_DSN (server) and NEXT_PUBLIC_SENTRY_DSN (client) for production; dev falls back to the default DSN.
  • Ensure /monitoring does not clash with middleware or rewrites.
  • Use .sentry-mask / data-sentry-mask to hide sensitive UI in replays, or data-sentry-block to exclude sections.

^{Written for commit e985b8b. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Apr 29, 2026 9:32pm
comp-framework-editor (staging)	Canceled		Apr 29, 2026 9:32pm
portal (staging)	Ready	Preview, Comment	Apr 29, 2026 9:32pm

[cubic-dev-ai]

3 issues found across 18 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/sentry.server.config.ts">

<violation number="1" location="apps/app/sentry.server.config.ts:14">
P1: `includeLocalVariables` is enabled unconditionally on the server, which can leak sensitive request-scoped values in error payloads and add avoidable overhead in production.</violation>
</file>

<file name="apps/portal/sentry.server.config.ts">

<violation number="1" location="apps/portal/sentry.server.config.ts:14">
P2: `includeLocalVariables` is enabled for all environments; this adds debugger-based overhead on exceptions and can capture request-local data in production. Gate it to development (or an explicit opt-in env var).</violation>
</file>

<file name="apps/app/src/instrumentation-client.ts">

<violation number="1" location="apps/app/src/instrumentation-client.ts:12">
P1: Use route paths (e.g. `/api/...`) in BotID `protect` rules instead of absolute URLs; absolute URL patterns can fail to match and leave these POST calls unprotected.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Use route paths (e.g. /api/...) in BotID protect rules instead of absolute URLs; absolute URL patterns can fail to match and leave these POST calls unprotected.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/instrumentation-client.ts, line 12:

<comment>Use route paths (e.g. `/api/...`) in BotID `protect` rules instead of absolute URLs; absolute URL patterns can fail to match and leave these POST calls unprotected.</comment>

<file context>
@@ -0,0 +1,38 @@
+  protect: [
+    { path: '/api/chat', method: 'POST' },
+    {
+      path: `${process.env.NEXT_PUBLIC_ENTERPRISE_API_URL}/api/tasks-automations/chat`,
+      method: 'POST',
+    },
</file context>

[cubic-dev-ai]

1 issue found across 6 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/portal/sentry.server.config.ts">

<violation number="1" location="apps/portal/sentry.server.config.ts:18">
P1: `sendDefaultPii` is enabled unconditionally on the server, which can leak user PII (for example IP address and request metadata) to Sentry. This should be explicitly opt-in (env-gated) rather than always on.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[Marfuen]

Reviewed cubic's three findings:

P1 — includeLocalVariables: true (server, both apps) — agreed, fixed in #2710. The original skill recommendation didn't account for the fact that local variable scope at throw time can include DB rows, auth tokens being validated, and request bodies — broader exposure than sendDefaultPii. Now gated to process.env.NODE_ENV !== 'production' so it only runs in dev/test.

P1 — sendDefaultPii: true (server) — also dropping in #2710. It was originally added under the (mistaken) assumption it would unblur session replay text; that's actually controlled by replayIntegration({ maskAllText, blockAllMedia }) (handled in #2709). With replays already showing real text, all this flag adds is IP / UA / Referer metadata — not worth the sub-processor data exposure for a compliance product.

P1 — botid absolute URLs in instrumentation-client.ts — pre-existing dead config that fundamentally can't work. Verified by reading node_modules/botid/dist/client/core/index.js: the path matcher compares against c.pathname only (so absolute URLs never match), and a same-origin gate (l = c.origin === location.origin) bails before even reaching the matcher for cross-origin requests. The two cross-origin entries can't be protected from this app's initBotId regardless of path format. Tracked as ENG-226 for follow-up; the proper fix is bot protection on enterprise-api itself.

[claudfuen]

🎉 This PR is included in version 3.38.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀