@scrymore/scry-deployer 0.3.0 → 0.3.2

package/README.md

@@ -835,6 +835,31 @@ Then update the `if` condition in the notification steps:
 
 ---
 
+## 📊 Error Reporting
+
+When a deploy fails, this CLI reports the error to Scry so we can fix it. It runs on
+your machine, so it is worth being precise about what leaves it.
+
+**Sent:** the error and its stack trace, the CLI and Node versions, the platform, and
+the project id, deploy version, branch and whether analysis was enabled.
+
+**Not sent:** your API key, presigned upload URLs and their signatures, absolute file
+paths, your hostname or username, your component names, and your source code. Stack
+frames are reduced to file basenames, and anything resembling a credential is redacted
+before the report is sent — including the signed URLs that upload errors would
+otherwise quote in full.
+
+Nothing is reported on a successful run.
+
+**To opt out**, set either variable:
+
+```bash
+export SCRY_TELEMETRY=0     # Scry-specific
+export DO_NOT_TRACK=1       # respected across many CLI tools
+```
+
+Both are honoured everywhere, including CI.
+
 ## 🔧 Troubleshooting the Init Command
 
 ### Command fails with "Not a git repository"

package/bin/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-const Sentry = require('@sentry/node');
+const { initTelemetry, captureCliError, flushTelemetry } = require('../lib/telemetry.js');
 const yargs = require('yargs/yargs');
 const { hideBin } = require('yargs/helpers');
 const fs = require('fs');
@@ -166,21 +166,12 @@ async function handleError(error, argv) {
     const logger = createLogger(argv || {});
     logger.error(`\n❌ Error: ${error.message}`);
 
-    // Capture error in Sentry with additional context
-    Sentry.withScope((scope) => {
-        if (argv) {
-            scope.setTags({
-                project: argv.project,
-                version: argv.version,
-                command: argv._ ? argv._[0] : 'unknown',
-            });
-            scope.setExtra('argv', argv);
-        }
-        Sentry.captureException(error);
-    });
-    
+    // Report with an allowlisted subset of argv. Sending argv wholesale shipped
+    // the customer's --api-key to Sentry on every error.
+    captureCliError(error, argv);
+
     // Ensure the event is sent before the process exits
-    await Sentry.close(2000);
+    await flushTelemetry(2000);
 
     if (error instanceof ApiError) {
         if (error.statusCode === 401) {
@@ -198,12 +189,9 @@ async function handleError(error, argv) {
 }
 
 async function main() {
-    // Initialize Sentry
-    Sentry.init({
-        dsn: "https://c66ce229a1db2289f145eebd02436d9c@o4507889391828992.ingest.us.sentry.io/4510699330732032", // Fallback to hardcoded DSN for user reporting
-        tracesSampleRate: 1.0,
-        environment: process.env.NODE_ENV || 'production',
-    });
+    // Error reporting. Opt out with SCRY_TELEMETRY=0 or DO_NOT_TRACK=1.
+    // Configuration and scrubbing live in lib/telemetry.js.
+    initTelemetry();
 
     try {
         const args = await yargs(hideBin(process.argv))

package/lib/apiClient.js

@@ -16,10 +16,83 @@ const logger = createLogger({ verbose: isVerbose });
 const COVERAGE_UPLOAD_DELAY_MS = 5000;
 const COVERAGE_RETRY_DELAY_MS = 60000;
 
+// The upload is the last step of a deploy, so a blip here discards several
+// minutes of completed screenshot capture. Retrying is far cheaper than
+// redoing that work. See ISSUES.md #19.
+const UPLOAD_MAX_ATTEMPTS = 4;
+const UPLOAD_BACKOFF_BASE_MS = 2000;
+
+// Network-level failures that a later attempt can plausibly survive. Flapping
+// DNS reports EAI_AGAIN (and, mid-flap, ENOTFOUND) rather than a clean refusal.
+const TRANSIENT_CODES = new Set([
+  'EAI_AGAIN',
+  'ENOTFOUND',
+  'ECONNRESET',
+  'ECONNREFUSED',
+  'ETIMEDOUT',
+  'ECONNABORTED',
+  'EPIPE',
+  'EHOSTUNREACH',
+  'ENETUNREACH',
+  'ERR_NETWORK',
+]);
+
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+/**
+ * Whether a failed upload attempt is worth repeating.
+ *
+ * A 4xx other than 429 means the request itself is wrong — retrying it just
+ * burns time and produces the identical failure.
+ *
+ * @param {Error & {code?: string, response?: {status?: number}}} error
+ * @returns {boolean}
+ */
+function isTransientUploadError(error) {
+  const status = error?.response?.status;
+  if (typeof status === 'number') {
+    return status === 429 || status >= 500;
+  }
+  return TRANSIENT_CODES.has(error?.code);
+}
+
+/**
+ * Run an upload attempt, repeating it while the failure looks transient.
+ *
+ * @template T
+ * @param {(attempt: number) => Promise<T>} attemptFn
+ * @param {string} label Shown in logs so a retried upload does not look like a hang.
+ * @returns {Promise<T>}
+ */
+async function withUploadRetry(attemptFn, label) {
+  let lastError;
+
+  for (let attempt = 1; attempt <= UPLOAD_MAX_ATTEMPTS; attempt++) {
+    try {
+      return await attemptFn(attempt);
+    } catch (error) {
+      lastError = error;
+
+      if (!isTransientUploadError(error) || attempt === UPLOAD_MAX_ATTEMPTS) {
+        throw error;
+      }
+
+      const backoff = UPLOAD_BACKOFF_BASE_MS * Math.pow(2, attempt - 1);
+      const reason = error.code || `HTTP ${error?.response?.status}`;
+      // Deliberately at info level: a silent retry is indistinguishable from a
+      // hung deploy, which is its own reported failure mode.
+      logger.info(
+        `${label} attempt ${attempt}/${UPLOAD_MAX_ATTEMPTS} failed (${reason}); retrying in ${backoff / 1000}s...`
+      );
+      await sleep(backoff);
+    }
+  }
+
+  throw lastError;
+}
+
 /**
  * Creates a pre-configured axios instance for making API calls.
  * @param {string} apiUrl The base URL of the API.
@@ -205,9 +278,14 @@ async function uploadFileDirectly(apiClient, { project, version }, filePath, fil
   const contentType = file.contentType || 'application/zip';
 
   try {
-    const presigned = await requestPresignedUrl(apiClient, { project, version }, { fileName, contentType });
-    const upload = await putToPresignedUrl(presigned.url, fileBuffer, contentType);
-    return { success: true, url: presigned.url, status: upload.status, visibility: presigned.visibility };
+    // The presigned URL is signed at request time, so a retry after a long
+    // backoff must re-request it — reusing a stale one fails with a confusing
+    // signature error instead of the real network cause.
+    return await withUploadRetry(async () => {
+      const presigned = await requestPresignedUrl(apiClient, { project, version }, { fileName, contentType });
+      const upload = await putToPresignedUrl(presigned.url, fileBuffer, contentType);
+      return { success: true, url: presigned.url, status: upload.status, visibility: presigned.visibility };
+    }, `Upload of ${fileName}`);
   } catch (error) {
     logger.debug(`Upload failed. Error type: ${error.constructor.name}, Message: ${error.message}`);
     const details = getAxiosErrorDetails(error, apiClient.defaults.baseURL);
@@ -374,4 +452,7 @@ module.exports = {
   uploadBuild,
   requestPresignedUrl,
   putToPresignedUrl,
+  isTransientUploadError,
+  withUploadRetry,
+  UPLOAD_MAX_ATTEMPTS,
 };

package/lib/telemetry.js

@@ -0,0 +1,140 @@
+const Sentry = require('@sentry/node');
+
+/**
+ * Error reporting for a CLI that runs on other people's machines.
+ *
+ * This is not a server. Everything it sends left a customer's laptop or CI
+ * runner, so the default has to be "send the minimum that makes a crash
+ * diagnosable", not "send the context and sort it out later".
+ *
+ * Three things were being sent that should not have been:
+ *
+ *   1. `scope.setExtra('argv', argv)` shipped the whole parsed argv — which
+ *      contains `--api-key` under both `apiKey` and `api-key`. Every customer
+ *      error carried their project credential to a third party.
+ *   2. Upload failures embed the presigned URL in the message, query string and
+ *      all: `...storybook.zip?X-Amz-Signature=645e57...`. That signature is a
+ *      time-limited write credential for the bucket.
+ *   3. Absolute paths (`/home/alice/work/app`) leak usernames and, often,
+ *      unreleased product names.
+ *
+ * None of that is needed to know that an upload failed with EAI_AGAIN.
+ */
+
+const DSN =
+  'https://c66ce229a1db2289f145eebd02436d9c@o4507889391828992.ingest.us.sentry.io/4510699330732032';
+
+/**
+ * argv fields safe to attach to an error.
+ *
+ * An allowlist, not a denylist: a new option should be invisible to telemetry
+ * until someone deliberately adds it here. The reverse — remembering to exclude
+ * each new secret — is the failure mode that put an API key in Sentry.
+ */
+const SAFE_ARGV_FIELDS = ['project', 'deployVersion', 'withAnalysis', 'verbose', 'branch'];
+
+/** Anything that looks like a credential, wherever it appears in a string. */
+const SECRET_PATTERNS = [
+  // Presigned URL query strings. Keep the path so the failing operation is
+  // still identifiable; drop the signature and everything with it.
+  [/(https?:\/\/[^\s?]+)\?[^\s]*/g, '$1?<redacted>'],
+  [/scry_proj_[A-Za-z0-9_\-]+/g, 'scry_proj_<redacted>'],
+  [/(X-Amz-Signature=)[^&\s]+/gi, '$1<redacted>'],
+  [/(Bearer\s+)[A-Za-z0-9._\-]+/gi, '$1<redacted>'],
+];
+
+function scrub(value) {
+  if (typeof value !== 'string') return value;
+  return SECRET_PATTERNS.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), value);
+}
+
+/**
+ * Whether the user has asked not to be tracked.
+ *
+ * DO_NOT_TRACK is honoured as well as our own flag — it is the cross-tool
+ * convention (consoledonottrack.com), and a developer who has set it globally
+ * should not have to discover a Scry-specific variable to be heard.
+ */
+function telemetryDisabled() {
+  const off = (v) => v === '1' || v === 'true' || v === 'yes';
+  return off(process.env.DO_NOT_TRACK) || process.env.SCRY_TELEMETRY === '0' ||
+    process.env.SCRY_TELEMETRY === 'false';
+}
+
+/** Only the fields on the allowlist, and scrubbed even then. */
+function sanitizeArgv(argv) {
+  if (!argv) return {};
+  const safe = {};
+  for (const field of SAFE_ARGV_FIELDS) {
+    if (argv[field] !== undefined) safe[field] = scrub(argv[field]);
+  }
+  return safe;
+}
+
+function initTelemetry() {
+  if (telemetryDisabled()) return false;
+
+  Sentry.init({
+    dsn: DSN,
+    environment: process.env.NODE_ENV || 'production',
+
+    // Errors only. Traces from a CLI describe the customer's build pipeline,
+    // which is more than is needed to fix a crash.
+    tracesSampleRate: 0,
+
+    // No usernames, IPs, or machine hostnames.
+    sendDefaultPii: false,
+    serverName: false,
+
+    beforeSend(event) {
+      if (event.message) event.message = scrub(event.message);
+
+      for (const entry of event.exception?.values ?? []) {
+        if (entry.value) entry.value = scrub(entry.value);
+        // Stack frames carry absolute paths from the customer's disk. The
+        // filename is what makes a trace useful, so keep the basename only.
+        for (const frame of entry.stacktrace?.frames ?? []) {
+          if (frame.filename) frame.filename = frame.filename.replace(/^.*[\\/]/, '');
+          delete frame.abs_path;
+        }
+      }
+
+      // Belt and braces: whatever else ends up in extra, scrub its strings.
+      if (event.extra) {
+        for (const [k, v] of Object.entries(event.extra)) event.extra[k] = scrub(v);
+      }
+
+      return event;
+    },
+  });
+
+  return true;
+}
+
+/** Report an error with only the context that is safe to leave the machine. */
+function captureCliError(error, argv) {
+  if (telemetryDisabled()) return;
+
+  Sentry.withScope((scope) => {
+    const safe = sanitizeArgv(argv);
+    if (safe.project) scope.setTag('project', safe.project);
+    if (argv && argv._) scope.setTag('command', argv._[0] || 'deploy');
+    scope.setExtra('options', safe);
+    Sentry.captureException(error);
+  });
+}
+
+async function flushTelemetry(ms = 2000) {
+  if (telemetryDisabled()) return;
+  await Sentry.close(ms);
+}
+
+module.exports = {
+  initTelemetry,
+  captureCliError,
+  flushTelemetry,
+  telemetryDisabled,
+  sanitizeArgv,
+  scrub,
+  SAFE_ARGV_FIELDS,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrymore/scry-deployer",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "A CLI to automate the deployment of Storybook static builds.",
   "main": "index.js",
   "bin": {