@testdriverai/runner 7.8.0-canary.21 → 7.8.0-canary.23

package/lib/ably-service.js

@@ -23,6 +23,7 @@ const Sentry = require('@sentry/node');
 const http = require('http');
 const https = require('https');
 const { EventEmitter } = require('events');
+const { maskCommandPayload } = require('./mask-command');
 
 /**
  * Get the local runner version from package.json.
@@ -54,11 +55,13 @@ async function uploadToS3(apiRoot, apiKey, sandboxId, base64, label = 'screensho
     const fileName = `${label}-${Date.now()}.png`;
 
     // Get presigned upload URL from API
+    // Propagate Sentry trace context so this request appears under the active command span
+    const traceHeaders = Sentry.getTraceData ? Sentry.getTraceData() : {};
     const uploadUrlResponse = await httpPost(apiRoot, '/api/v7/runner/upload-url', {
       apiKey,
       sandboxId,
       fileName,
-    });
+    }, traceHeaders);
 
     if (!uploadUrlResponse || !uploadUrlResponse.uploadUrl) {
       console.warn('[ably-service] No upload URL returned for screenshot');
@@ -100,8 +103,12 @@ async function uploadToS3(apiRoot, apiKey, sandboxId, base64, label = 'screensho
 
 /**
  * HTTP POST helper
+ * @param {string} apiRoot - API base URL
+ * @param {string} path - URL path
+ * @param {object} body - JSON body
+ * @param {object} [extraHeaders] - Additional headers (e.g. Sentry trace)
  */
-async function httpPost(apiRoot, path, body) {
+async function httpPost(apiRoot, path, body, extraHeaders = {}) {
   const url = new URL(path, apiRoot);
   const transport = url.protocol === 'https:' ? https : http;
 
@@ -110,6 +117,7 @@ async function httpPost(apiRoot, path, body) {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
+        ...extraHeaders,
       },
     }, (res) => {
       let data = '';
@@ -309,8 +317,15 @@ class AblyService extends EventEmitter {
             success: true,
           });
           this.emit('log', `Command completed: ${type} (requestId=${requestId})`);
+          const span = Sentry.getActiveSpan();
+          if (span) span.setAttribute('command.success', true);
         } catch (err) {
           this.emit('log', `Command failed: ${type} — ${err.message}`);
+          const span = Sentry.getActiveSpan();
+          if (span) {
+            span.setAttribute('command.success', false);
+            span.setAttribute('command.error', err.message.slice(0, 256));
+          }
           Sentry.captureException(err);
           await this._sendResponse({
             requestId,
@@ -323,9 +338,10 @@ class AblyService extends EventEmitter {
       };
 
       if (sentryTrace) {
+        const spanAttributes = maskCommandPayload(message);
         await Sentry.continueTrace({ sentryTrace, baggage }, () => {
           return Sentry.startSpan(
-            { name: `runner.command.${type}`, op: 'runner.dispatch' },
+            { name: `runner.command.${type}`, op: 'runner.dispatch', attributes: spanAttributes },
             executeCommand,
           );
         });

package/lib/automation.js

@@ -18,6 +18,7 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 const { EventEmitter } = require('events');
+const Sentry = require('@sentry/node');
 
 const IS_WINDOWS = process.platform === 'win32';
 const IS_LINUX = process.platform === 'linux';
@@ -621,10 +622,13 @@ class Automation extends EventEmitter {
     // Use instance-level apiRoot (passed from runner) with fallback to module-level constant
     const apiRoot = this._apiRoot || API_ROOT;
 
+    // Propagate Sentry trace context so this request appears under the active command span
+    const traceHeaders = Sentry.getTraceData ? Sentry.getTraceData() : {};
+
     // Get presigned URL from API (30s timeout)
     const response = await fetch(`${apiRoot}/api/v7/runner/upload-url`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', ...traceHeaders },
       body: JSON.stringify({
         apiKey,
         sandboxId,

package/lib/mask-command.js

@@ -0,0 +1,80 @@
+'use strict';
+
+/**
+ * Keys that carry distributed-tracing or internal plumbing data and should
+ * never appear as Sentry span attributes.
+ */
+const STRIP_KEYS = new Set([
+  'sentryTrace',
+  'baggage',
+]);
+
+/**
+ * Keys whose values may contain credentials, tokens or other secrets.
+ * Values are replaced with a length indicator + truncated preview.
+ */
+const SENSITIVE_KEYS = new Set([
+  'text',      // write command — could be a password
+  'command',   // exec/run  — could embed env vars / tokens
+]);
+
+const MAX_PREVIEW = 80;
+const MAX_VALUE   = 256;
+
+/**
+ * Mask a single value so it's safe for Sentry span attributes.
+ * Returns a Sentry-compatible primitive (string | number | boolean).
+ */
+function maskValue(key, value) {
+  if (value == null) return undefined;
+
+  // Sensitive fields → length + truncated preview
+  if (SENSITIVE_KEYS.has(key) && typeof value === 'string') {
+    const preview = value.length > MAX_PREVIEW
+      ? value.slice(0, MAX_PREVIEW) + '…'
+      : value;
+    return `[${value.length} chars] ${preview}`;
+  }
+
+  // Primitives pass through (truncate long strings)
+  if (typeof value === 'number' || typeof value === 'boolean') return value;
+  if (typeof value === 'string') {
+    return value.length > MAX_VALUE ? value.slice(0, MAX_VALUE) + '…' : value;
+  }
+
+  // Arrays / objects → JSON-stringify for readability in Sentry UI
+  try {
+    const json = JSON.stringify(value);
+    return json.length > MAX_VALUE ? json.slice(0, MAX_VALUE) + '…' : json;
+  } catch {
+    return String(value);
+  }
+}
+
+/**
+ * Turn a raw Ably command message into a flat attribute map safe for
+ * Sentry span attributes.
+ *
+ * - Strips distributed-tracing headers (sentryTrace, baggage)
+ * - Masks sensitive fields (text, command)
+ * - Converts non-primitive values to JSON strings
+ * - Prefixes every key with `command.`
+ *
+ * @param {object} message  Raw command message from Ably
+ * @returns {Record<string, string|number|boolean>}
+ */
+function maskCommandPayload(message) {
+  if (!message || typeof message !== 'object') return {};
+
+  const attrs = {};
+  for (const [key, value] of Object.entries(message)) {
+    if (STRIP_KEYS.has(key)) continue;
+    const masked = maskValue(key, value);
+    if (masked !== undefined) {
+      attrs[`command.${key}`] = masked;
+    }
+  }
+  return attrs;
+}
+
+module.exports = { maskCommandPayload };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testdriverai/runner",
-  "version": "7.8.0-canary.21",
+  "version": "7.8.0-canary.23",
   "description": "TestDriver Runner - Ably-based remote automation agent with Node.js automation",
   "main": "index.js",
   "bin": {