[DEV-113] Make errors in the devintern CLI and desktop app visible in Sentry so failures can be found and fixed quickly

[danii1]

Task: DEV-113

Summary: Make errors in the devintern CLI and desktop app visible in Sentry so failures can be found and fixed quickly

Implementation Details

Now let me launch parallel explorations of the codebase to audit catch sites while I read key files.
Thorough audit complete. Now let me read the key files I'll modify.
Let me read the remaining catch sites I plan to modify.
Now let me check docs structure, pm-desktop package.json, and how existing tests mock electron.
I now have the full picture. Let me check a few last details (renderer ui components, how captureError is imported in ipc.ts context, tests runner config for code package).
All research done. Starting implementation.
Now wire redaction into sentry.ts:
Now add redaction tests to the utils sentry test file:
The mock intercepts init, so beforeSend never runs. Let me test the beforeSend option directly instead:
Utils done. Now the code package — create lib/sentry-init.ts:
Now update index.ts — replace the local initSentryOnce with the shared one:
That wrapper is convoluted — let me do it cleanly instead:
Now update worker.ts:
Now the webhook-server standalone entry:
Static imports are cleaner for bundling — let me check webhook-server's imports and switch:
Now add captureError at the pipeline catch sites in index.ts. First, processSingleTask:
Now the estimation catch and its exit path:
Now the batch loop exit and main() catch:
Now the resolve-conflicts subcommand, PR creation failure, and commit failure:
Now gracefulShutdown flush:
Now the webhook-server review-processing failure. Let me check what's in scope at that catch:
Now pm-desktop. First the shared contract additions:
Now extend main/error-tracking.ts with context support and dedup:
Now update ipc.ts — the handle() wrapper and the new renderer-error handler:
Now add the reportRendererError handler in registerIpcHandlers:
Now the preload API addition:
Now window.ts — renderer crash and preload-error reporting:
Now the renderer error-reporting lib:
Now the React error boundary component. Let me check an existing component for style conventions first:
Now wire it all into main.tsx:
Now the tests. First, extend error-tracking.test.ts with dedup + forwarded-error tests:
Now the contract parser test and the renderer error-reporting test:
The installed guard is process-wide (by design). Let me restructure the tests to use a single install flow:
Now the code package sentry-init test:
All code tests pass. Now typecheck all touched packages:
Two type fixes. First sentry.ts — simplify the event typing:
Now the ErrorBoundary override modifiers:
All typechecks pass. Now the pm-desktop full test suite:
Now update the docs. First docs/code/configuration.md — expand the Error Reporting section:
Now run the full verification: pm-desktop tests, code tests, lint, and format:
The "1 error" is pre-existing (baseline shows the same react-dom window flake), and failures went from 1 → 0. Now lint and format:
Lint clean (0 errors). Now format:
Now run the full monorepo test suite to verify everything together:
Build passes. Let me do a final review of the complete diff:
Code package diff looks right. Now the pm-desktop diff:
Let me check the analytics settings UI copy — it should accurately say the toggle also gates error reporting:
Let me verify the pm-desktop electron-vite build compiles all three bundles:
Build passes. Final verification round after all edits:
All green. Completing the final todo:
DEV-113 is implemented and verified. Summary of what changed and why:

Shared (@devintern/utils)

• src/redact.ts (new): defense-in-depth secret scrubbing — token shapes (ghp_*, github_pat_*, sk-ant-*, Bearer headers, URL credentials, credential query params) and secret-shaped context keys.
• src/sentry.ts: beforeSend now redacts extra, messages, and exception values before events leave the machine; opt-out behavior unchanged.

packages/code

• Entry points: new lib/sentry-init.ts (initSentryOnce, once-guarded per process) used by the CLI (index.ts), worker.ts (startWorker), and the standalone webhook-server.ts entry (which also installs fatal handlers + signal flush). All failure exit paths (processSingleTask, batch, estimation, main catch, SIGINT/SIGTERM, worker shutdown) now flush before process.exit.
• Catch-site audit (67 sites in index.ts + ~100 in lib): classified as report-worthy (user action failed) → added captureError with taskKey/tracker/stage/command context: failed task run (process-task), failed estimation, PR creation failure (both the thrown and silent success:false paths), commit failure, resolve-conflicts thrown errors, webhook review swallow + PR-comment queue failures. Intentionally silent (left alone): cleanup (sandboxCleanup), best-effort tracker comments/status transitions, run-recorder, analytics, reactions, gitignore — degraded-but-continuing paths that would be noise. Already reported: process-level fatal handlers, address-review, acquirer spawn/poll/dispatch. No site is double-reported (batch rethrows are captured only in processSingleTask; usage-limit deferrals are excluded).

pm-desktop

• Renderer (previously invisible): lib/error-reporting.ts installs window error/unhandledrejection handlers; new ErrorBoundary reports React crashes (with component stack) and shows a reload fallback. Both forward via a new typed IPC channel pm:report-renderer-error (RendererErrorReport in the contract, validated/bounded by parseRendererErrorReport).
• Main: handle() wrapper now reports handler failures (deduped via captureErrorOnce, 60s window; invalid_input/auth_required/in_progress user mistakes excluded); render-process-gone (excluding clean-exit) and preload-error are reported in window.ts. Forwarded errors respect the live telemetry toggle and SENTRY_DISABLED=1 because capture stays in main's shared tracking state.

Tests & docs

• New tests: utils/sentry.test.ts (redaction via beforeSend), utils/redact unit tests, code/tests/sentry-init.test.ts (init-once), pm-desktop error-tracking.test.ts (context passthrough, dedup, opt-out suppression incl. forwarded errors), shared/renderer-error-report.test.ts (validation/bounding), renderer/src/lib/error-reporting.test.ts (global handlers, drop noise, swallow bridge failures).
• Docs: docs/code/configuration.md and docs/pm/configuration.md Error Reporting sections now describe what is reported, what is never reported, and both opt-outs; Settings toggle copy updated to mention error reports.

Verification: bun run lint (0 errors), bun run format, bun run typecheck (all packages), bun run build for both code and pm-desktop, and the full monorepo test suite (11/11 tasks, 0 failures — the one pm-desktop "unhandled error" between tests is pre-existing on main).

---

This PR was automatically created by @devintern/code