feat(open-next): create cloudflare-sentry-tail package by flakey5 · Pull Request #8842 · nodejs/nodejs.org

flakey5 · 2026-04-25T01:17:04Z

Creates a cloudflare-sentry-tail package that enables us to add a tail worker to the open next deployment of the site.

This package should be publishable as well so that we can reuse it in the release worker.

Description

Validation

Related Issues

Check List

I have read the Contributing Guidelines and made commit messages that follow the guideline.
I have run pnpm format to ensure the code follows the style guide.
I have run pnpm test to check if all tests are passing.
I have run pnpm build to check if the website builds without errors.
I've covered new added functionality with unit tests if necessary.

Creates a `cloudflare-sentry-tail` package that enables us to add a tail worker to the open next deployment of the site. This package should be publishable as well so that we can reuse it in the release worker. Signed-off-by: flakey5 <73616808+flakey5@users.noreply.github.com>

vercel · 2026-04-25T01:17:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodejs-org	Ready	Preview	Apr 25, 2026 2:14am

cursor · 2026-04-25T01:17:10Z

PR Summary

Medium Risk
Adds new production error/trace reporting via a Cloudflare Tail handler, which can impact observability data volume, privacy (headers/logs), and runtime overhead if misconfigured.

Overview
Adds a new publishable package @node-core/cloudflare-sentry-tail that converts Cloudflare Workers Tail TraceItems into Sentry events (including request context, console logs, diagnostics channel events, and exceptions) with configurable sampling and header redaction.

Integrates this tail handler into the site’s Cloudflare worker-entrypoint.ts via withSentry tail, and wires the new workspace dependency/ownership into apps/site/package.json, .github/CODEOWNERS, and pnpm-lock.yaml.

^{Reviewed by Cursor Bugbot for commit c0468e2. Bugbot is set up for automated code reviews on this repo. Configure here.}

github-actions · 2026-04-25T01:17:15Z

👋 Codeowner Review Request

The following codeowners have been identified for the changed files:

Team reviewers: @nodejs/web-infra @nodejs/nodejs-website

Please review the changes when you have a chance. Thank you! 🙏

flakey5 · 2026-04-25T01:17:41Z

+  const buffer = new Uint32Array(1);
+  crypto.getRandomValues(buffer);
+
+  const random = buffer[0] / 4294967295;


idk where this number comes from but it works so 🤷

4294967295 is the maximum value that an element in an Unit32Array could have:
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray#typedarray_objects

maybe we can add a constant here instead of this magic number?

Also, let's be a bit more apparent in where it comes from:

const UINT_32_LIMIT = 2 ** 32

codecov · 2026-04-25T01:19:27Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.82%. Comparing base (97e28c5) to head (c0468e2).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8842      +/-   ##
==========================================
- Coverage   73.87%   73.82%   -0.05%     
==========================================
  Files         105      105              
  Lines        8883     8883              
  Branches      326      327       +1     
==========================================
- Hits         6562     6558       -4     
- Misses       2320     2324       +4     
  Partials        1        1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Signed-off-by: flakey5 <73616808+flakey5@users.noreply.github.com>

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c0468e2. Configure here.}

cursor · 2026-04-25T02:17:53Z

@@ -0,0 +1,3 @@
+{
+  "**/*.{ts}": ["prettier --check --write", "eslint --fix"]


Single-item brace glob fails to match TypeScript files

Medium Severity

The glob pattern **/*.{ts} uses a single-item brace expression, which micromatch (used by both lint-staged and turbo) does not expand — it is treated as a literal string. As a result, lint-staged will not run prettier/eslint on .ts files in this package, and turbo will not track .ts files as inputs for the lint:js task, silently breaking cache invalidation. The correct form requires multiple items, e.g. **/*.ts or **/*.{ts,tsx}, as used in sibling packages.

Additional Locations (1)

packages/cloudflare-sentry-tail/turbo.json#L5-L6

^{Reviewed by Cursor Bugbot for commit c0468e2. Configure here.}

cursor · 2026-04-25T02:17:53Z

+        tlsExportedAuthenticator: request.cf?.tlsExportedAuthenticator,
+        tlsVersion: request.cf?.tlsVersion,
+      },
+    };


Tail worker sends PII headers and geo data to Sentry

High Severity

The tail handler copies all request headers (only authorization and cookie are redacted) plus request.cf fields such as asn, colo, country, timezone, etc. into the Sentry event. Headers like user-agent, cf-connecting-ip, x-forwarded-for, and x-real-ip expose client IPs and fingerprinting data, which is exactly the PII that the project's Sentry policy forbids forwarding (the reason sendDefaultPii: true is disallowed). Redacting only auth/cookie does not address the IP and user-agent exposure.

Additional Locations (1)

apps/site/cloudflare/worker-entrypoint.ts#L50-L54

^{Triggered by learned rule: Sentry configuration rules for Cloudflare Workers}

^{Reviewed by Cursor Bugbot for commit c0468e2. Configure here.}

cursor · 2026-04-25T02:17:53Z

+    "lint:fix": "node --run lint:js:fix",
+    "lint:js": "eslint \"**/*.ts\"",
+    "lint:js:fix": "node --run lint:js -- --fix"
+  },


New package lacks lint:types script, skips type checking

Medium Severity

The new package registers a lint:types task in turbo.json but provides no corresponding lint:types script in package.json, so turbo lint:types (invoked in CI and the husky pre-commit hook) silently does nothing for this package. Combined with apps/site/tsconfig.json excluding cloudflare/worker-entrypoint.ts from type checking, neither the new 300+ line tail worker source nor its consumer is type-checked anywhere, letting type errors reach production undetected.

Additional Locations (1)

packages/cloudflare-sentry-tail/turbo.json#L10-L13

^{Reviewed by Cursor Bugbot for commit c0468e2. Configure here.}

this issue seems legit 🤔

dario-piotrowicz · 2026-04-25T16:26:39Z

+    "lint:fix": "node --run lint:js:fix",
+    "lint:js": "eslint \"**/*.ts\"",
+    "lint:js:fix": "node --run lint:js -- --fix"
+  },


this issue seems legit 🤔

dario-piotrowicz · 2026-04-25T16:36:54Z

+  const buffer = new Uint32Array(1);
+  crypto.getRandomValues(buffer);
+
+  const random = buffer[0] / 4294967295;


4294967295 is the maximum value that an element in an Unit32Array could have:
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray#typedarray_objects

maybe we can add a constant here instead of this magic number?

dario-piotrowicz · 2026-04-25T17:24:11Z

+  // Allocate space for the elements we're gonna add
+  sentryEvent.breadcrumbs.length +=
+    item.logs.length +
+    item.diagnosticsChannelEvents.length +
+    item.exceptions.length;


Arrays in JavaScript automatically expand as you add elements to them, see:

So I don't think we need to allocate memory for the new elements here 🤔

dario-piotrowicz · 2026-04-25T17:27:59Z

+  sentryEvent.fingerprint!.length += item.exceptions.length;
+  sentryEvent.exception!.values!.length += item.exceptions.length;


Like my other comment, I don't think that any "allocation" is needed for the arrays

avivkeller · 2026-04-25T20:31:56Z

@@ -0,0 +1,31 @@
+{
+  "name": "@node-core/cloudflare-sentry-tail",


Can you open an issue in admin for this package?

flakey5 requested review from a team as code owners April 25, 2026 01:17

flakey5 commented Apr 25, 2026

View reviewed changes

cursor Bot reviewed Apr 25, 2026

View reviewed changes

Comment thread packages/cloudflare-sentry-tail/src/index.ts

Comment thread packages/cloudflare-sentry-tail/src/index.ts

Comment thread packages/cloudflare-sentry-tail/src/index.ts Outdated

review

c0468e2

Signed-off-by: flakey5 <73616808+flakey5@users.noreply.github.com>

vercel Bot deployed to Preview April 25, 2026 02:14 View deployment

cursor Bot reviewed Apr 25, 2026

View reviewed changes

dario-piotrowicz reviewed Apr 25, 2026

View reviewed changes

avivkeller reviewed Apr 25, 2026

View reviewed changes

avivkeller approved these changes Apr 25, 2026

View reviewed changes

		@@ -0,0 +1,3 @@
		{
		"*/.{ts}": ["prettier --check --write", "eslint --fix"]

		sentryEvent.fingerprint!.length += item.exceptions.length;
		sentryEvent.exception!.values!.length += item.exceptions.length;

		@@ -0,0 +1,31 @@
		{
		"name": "@node-core/cloudflare-sentry-tail",

Conversation

flakey5 commented Apr 25, 2026

Description

Validation

Related Issues

Check List

Uh oh!

vercel Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

github-actions Bot commented Apr 25, 2026

👋 Codeowner Review Request

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Apr 25, 2026

Choose a reason for hiding this comment

Single-item brace glob fails to match TypeScript files

Uh oh!

cursor Bot Apr 25, 2026

Choose a reason for hiding this comment

Tail worker sends PII headers and geo data to Sentry

Uh oh!

cursor Bot Apr 25, 2026

Choose a reason for hiding this comment

New package lacks lint:types script, skips type checking

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel Bot commented Apr 25, 2026 •

edited

Loading

cursor Bot commented Apr 25, 2026 •

edited

Loading

codecov Bot commented Apr 25, 2026 •

edited

Loading