@scrymore/scry-deployer 0.6.1-nightly.20260925022633 → 0.6.1

package/bin/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-const { initTelemetry, captureCliError, flushTelemetry } = require('../lib/telemetry.js');
+const { initTelemetry, captureCliError, flushTelemetry, redactArgv } = require('../lib/telemetry.js');
 const yargs = require('yargs/yargs');
 const { hideBin } = require('yargs/helpers');
 const fs = require('fs');
@@ -25,7 +25,8 @@ const { resolveBuildGitContext } = require('../lib/gitContext.js');
 async function runAnalysis(argv) {
     const logger = createLogger(argv);
     logger.info('📊 Starting Storybook analysis...');
-    logger.debug(`Received arguments: ${JSON.stringify(argv)}`);
+    // Credentials masked: this line is also a Sentry breadcrumb.
+    logger.debug(`Received arguments: ${JSON.stringify(redactArgv(argv))}`);
 
     const outPath = path.join(os.tmpdir(), `storybook-analysis-${Date.now()}.zip`);
 
@@ -85,7 +86,8 @@ async function runAnalysis(argv) {
 async function runDeployment(argv) {
     const logger = createLogger(argv);
     logger.info('🚀 Starting deployment...');
-    logger.debug(`Received arguments: ${JSON.stringify(argv)}`);
+    // Credentials masked: this line is also a Sentry breadcrumb.
+    logger.debug(`Received arguments: ${JSON.stringify(redactArgv(argv))}`);
 
     const outPath = path.join(os.tmpdir(), `storybook-deployment-${Date.now()}.zip`);
     let metadataZipPath = null;

package/lib/telemetry.js

@@ -21,6 +21,8 @@ const Sentry = require('@sentry/node');
  * None of that is needed to know that an upload failed with EAI_AGAIN.
  */
 
+const { version: PACKAGE_VERSION } = require('../package.json');
+
 const DSN =
   'https://c66ce229a1db2289f145eebd02436d9c@o4507889391828992.ingest.us.sentry.io/4510699330732032';
 
@@ -41,8 +43,58 @@ const SECRET_PATTERNS = [
   [/scry_proj_[A-Za-z0-9_\-]+/g, 'scry_proj_<redacted>'],
   [/(X-Amz-Signature=)[^&\s]+/gi, '$1<redacted>'],
   [/(Bearer\s+)[A-Za-z0-9._\-]+/gi, '$1<redacted>'],
+  // A credential flag echoed on a command line: --api-key X, --api-key=X,
+  // -k X, --token X, --openai-api-key X, ...
+  [/(--[\w-]*(?:api-key|apikey|token|secret|password)[\w-]*[=\s]+|(?:^|\s)-k[=\s]+)(?!<redacted>)[^\s"',]+/gi, '$1<redacted>'],
+  // A credential field inside serialized JSON: "apiKey":"X", "token": "X".
+  [/("[\w-]*(?:api[-_]?key|token|secret|password)[\w-]*"\s*:\s*)"[^"]*"/gi, '$1"<redacted>"'],
+  // An env echo: SCRY_API_KEY=X, STORYBOOK_DEPLOYER_API_KEY=X, JINA_API_KEY=X.
+  [/(\b[A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)[A-Z0-9_]*=)(?!<redacted>)[^\s"',]+/g, '$1<redacted>'],
 ];
 
+/** Field names whose values are credentials, in any spelling yargs produces. */
+const SECRET_FIELD = /(^k$|api[-_]?key|token|secret|password)/i;
+
+/**
+ * A copy of argv with every credential-named field masked, at any depth.
+ *
+ * For logging argv whole (the --verbose "Received arguments" line), which is
+ * also a Sentry breadcrumb. Unlike sanitizeArgv this keeps every field, so it
+ * must only be used for local diagnostics, never as event context.
+ */
+function redactArgv(value, depth = 0) {
+  if (depth > 5 || value === null || typeof value !== 'object') return value;
+  if (Array.isArray(value)) return value.map((v) => redactArgv(v, depth + 1));
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    out[k] = SECRET_FIELD.test(k) && v !== undefined && v !== null && v !== '' ? '<redacted>' : redactArgv(v, depth + 1);
+  }
+  return out;
+}
+
+/** Scrub every string in a JSON-like value (breadcrumb data), in place-safe copy. */
+function scrubDeep(value, depth = 0) {
+  if (typeof value === 'string') return scrub(value);
+  if (depth > 5 || value === null || typeof value !== 'object') return value;
+  if (Array.isArray(value)) return value.map((v) => scrubDeep(v, depth + 1));
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    out[k] = SECRET_FIELD.test(k) && typeof v === 'string' && v ? '<redacted>' : scrubDeep(v, depth + 1);
+  }
+  return out;
+}
+
+/**
+ * Breadcrumbs are sent with every event and beforeSend does not see them as
+ * separate items, so they get the same scrubbing on the way in.
+ */
+function scrubBreadcrumb(breadcrumb) {
+  if (!breadcrumb) return breadcrumb;
+  if (breadcrumb.message) breadcrumb.message = scrub(breadcrumb.message);
+  if (breadcrumb.data) breadcrumb.data = scrubDeep(breadcrumb.data);
+  return breadcrumb;
+}
+
 function scrub(value) {
   if (typeof value !== 'string') return value;
   return SECRET_PATTERNS.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), value);
@@ -77,6 +129,9 @@ function initTelemetry() {
   Sentry.init({
     dsn: DSN,
     environment: process.env.NODE_ENV || 'production',
+    // Which published deployer produced the event, so a fix can be matched to
+    // the versions still in the wild.
+    release: `@scrymore/scry-deployer@${PACKAGE_VERSION}`,
 
     // Errors only. Traces from a CLI describe the customer's build pipeline,
     // which is more than is needed to fix a crash.
@@ -86,8 +141,18 @@ function initTelemetry() {
     sendDefaultPii: false,
     serverName: false,
 
+    // The logger turns every line (including debug) into a breadcrumb, and
+    // Sentry's console integration does the same for console.*. None of that
+    // passed through beforeSend's scrubbing before.
+    beforeBreadcrumb(breadcrumb) {
+      return scrubBreadcrumb(breadcrumb);
+    },
+
     beforeSend(event) {
       if (event.message) event.message = scrub(event.message);
+      // Belt and braces for breadcrumbs added before init or by integrations
+      // that bypass beforeBreadcrumb.
+      if (Array.isArray(event.breadcrumbs)) event.breadcrumbs = event.breadcrumbs.map(scrubBreadcrumb);
 
       for (const entry of event.exception?.values ?? []) {
         if (entry.value) entry.value = scrub(entry.value);
@@ -135,6 +200,8 @@ module.exports = {
   flushTelemetry,
   telemetryDisabled,
   sanitizeArgv,
+  redactArgv,
   scrub,
+  scrubBreadcrumb,
   SAFE_ARGV_FIELDS,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrymore/scry-deployer",
-  "version": "0.6.1-nightly.20260925022633",
+  "version": "0.6.1",
   "description": "A CLI to automate the deployment of Storybook static builds.",
   "main": "index.js",
   "bin": {