pcbjam/web/.env.example

33 lines
1.8 KiB
Shell
Raw Normal View History

# ---------------------------------------------------------------------------
# This is a standalone, frontend-only workspace: the `standalone` editor app
# and an example `backend`. Each app reads its OWN .env — see:
# standalone/.env.example (Vite frontend)
# backend/.env.example (thin reference backend)
# Copy each to a sibling `.env`. The values below are only a convenience
# overview; turbo passes these through to the apps.
# ---------------------------------------------------------------------------
# --- standalone editor (Vite, must be VITE_-prefixed) ---
# Backend implementing the @pcbjam/shared contract (the example backend, or any
# conforming backend such as the closed app's server). Leave unset to use only
# the local-folder loader.
VITE_API_BASE_URL=http://localhost:3060
# Where the WASM glue/artifacts are served from. SAME-ORIGIN "/wasm" is required
# because KiCad WASM pthread workers cannot be created cross-origin; on `dev` the
# artifacts are symlinked into standalone/public/wasm and served by Vite at /wasm.
# For prod, set to an absolute URL whose origin also satisfies the COEP rules.
VITE_WASM_ASSET_BASE_URL=/wasm
# Override the artifact source dir the dev symlink points at (default:
# <repo>/tests/apps/kicad, populated by tests/scripts/setup-kicad-wasm.sh).
# WASM_SRC_DIR=
feat(editor): report uncaught errors to Better Stack The editor reported nothing when a session died. Evidence lived only in-tab — an 800-line React array behind a "Show console" button — so diagnosis meant asking a user to paste a screenshot. Better Stack's Error Tracking ingests the Sentry wire protocol, so this runs the stock @sentry/browser against a Better Stack DSN. Sentry.init installs its own window error/unhandledrejection handlers, so uncaught main-thread errors and the wasm traps that escape emscripten's DOM event handlers are captured with no instrumentation at the throw sites. Not their JS tag: it has no beforeSend or fingerprint hooks, its runtime spawns workers from cross-origin CDN hosts (this page is COEP: require-corp), and it ships session replay on by default — which on a CAD canvas records customers' board geometry. @sentry/browser is imported in exactly one file so the vendor stays swappable, mirroring how lib/analytics.ts isolates Plausible. Also replaces the terminal-signature regex with a shared, unit-tested predicate (wasm/terminal-error.ts) used by BOTH the fatal overlay and the reporter, so they cannot disagree. The regex was a type check written as a string match and had three live holes: `RuntimeError` was listed but never appears IN `.message`; Chrome's bare "unreachable" and "null function" matched nothing (the v0.1.20 prod log is exactly those); and narrowing "table index is out of bounds" to `\bindex out of bounds` for Firefox in 197f317 silently stopped matching Chrome's spelling. Checking the TYPE — every trap in this family is a WebAssembly.RuntimeError — covers all engines and ends the spelling chase; the message patterns remain as a fallback for paths that lose the Error object, such as a worker ErrorEvent crossing the realm boundary with error: null. 197f317's pthread-worker tap, promote() and Firefox findings are kept as-is. Notes: - Off unless VITE_ERRORS_DSN is set AND VITE_ALLOW_USER_OVERRIDE !== "1" (dev servers and every Playwright harness set the latter, and production builds never do), so a production DSN in a local .env still cannot report. With no DSN the whole SDK is const-folded out: 1,193,080 vs 1,282,463 bytes of JS. - browserApiErrors integration removed. It wraps setTimeout/rAF/addEventListener in try/catch, which is exactly how KiCad-on-Emscripten drives its main loop. - Console breadcrumbs off (collab/debug.ts's clog fires per Yjs update and would evict the ring before any crash); dom/fetch/navigation breadcrumbs kept. - beforeSend redacts token/apiKey/Bearer — collab/provider.ts puts the collab token in the y-partyserver URL, so a connection-failure string carries a live credential — and guards the cascade: one wedge produced 8 errors in prod, and after the first terminal event the rest are dropped into cascade_count. Verified end to end against the real EU host from a cross-origin-isolated page: POST /api/<id>/envelope/ -> 200, and 4 terminal throws produce 1 event (control: 1 throw, same count). Privacy policy 9, cookie policy 6 and the licenses page are updated: Better Stack is disclosed as an EU processor, and the licenses page now describes the browser app's own JS dependencies, which it never did. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-03 12:24:30 +02:00
# Error tracking (Better Stack) — Sentry-format DSN; unset ⇒ nothing reported.
# See standalone/.env.example for the full note.
# VITE_ERRORS_DSN=
# --- example backend ---
# Absolute or relative path to a single KiCad project folder to serve.
PROJECT_DIR=../../tests/fixtures/demo
# Port the backend listens on (the standalone's VITE_API_BASE_URL must match).
PORT=3060
# Browser origin allowed to call the backend (the Vite dev server).
CORS_ORIGIN=http://localhost:3048