From a6ca4bb9b08872056476f243cc3f7ece945b9307 Mon Sep 17 00:00:00 2001
From: Slate Rehm <slaterehm@pm.me>
Date: Thu, 30 Jul 2026 23:05:28 -0500
Subject: [PATCH 1/6] build: add the Sentry SDKs and source-map upload

The TanStack Start SDK cannot run here: its workerd and worker export
conditions resolve to a bundle that re-exports @sentry/node. Use
@sentry/react in the browser, @sentry/cloudflare in the Worker, and
@sentry/core for the isomorphic pieces instead.

Pin the three runtime packages to an exact version. They each hard-pin
@sentry/core 10.69.0, and a second copy would mean a second client and a
second scope, so the isomorphic captureException would report into a
client with no DSN.

Replace the dead PostHog sourcemap gate. There was no upload script and
CI never set those variables. Build maps as hidden, because the plugin
deletes them after upload and a live sourceMappingURL would 404.

CI keeps no auth token on purpose: Cloudflare builds and deploys the
Worker, so a release uploaded from CI would never match a shipped bundle.
---
 .env.example             |   9 +
 .github/workflows/ci.yml |   4 +
 package.json             |   4 +
 pnpm-lock.yaml           | 412 ++++++++++++++++++++++++++++++++++++++-
 pnpm-workspace.yaml      |   4 +-
 src/vite-env.d.ts        |   6 +
 vite.config.ts           |  34 +++-
 vitest.config.ts         |   4 +
 8 files changed, 465 insertions(+), 12 deletions(-)

diff --git a/.env.example b/.env.example
index a701fc3..2c25e16 100644
--- a/.env.example
+++ b/.env.example
@@ -1,3 +1,12 @@
 # --- Site ---
 # Canonical origin for metadata, robots, and the sitemap. Optional in development.
 # VITE_SITE_URL=https://errorwolf.dev
+
+# --- Error monitoring (build time only) ---
+# Uploads source maps to Sentry, so a stack trace in Sentry shows real function
+# names. Optional: a build without it succeeds and ships minified traces.
+# Set it as a secret build variable in the Cloudflare project.
+#
+# This is the only Sentry secret. The DSN is public by design and lives in
+# src/lib/sentry/constants.ts, together with the org and the project.
+# SENTRY_AUTH_TOKEN=
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a59ffec..d3abd1e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,6 +31,10 @@ jobs:
       - run: pnpm run typecheck
       - run: pnpm run test
 
+      # No SENTRY_AUTH_TOKEN here on purpose. Cloudflare builds and deploys the
+      # Worker, so a release uploaded from CI would never match a shipped
+      # bundle, and a fork PR cannot read the secret anyway. Without the token
+      # the Sentry Vite plugin disables itself and the build stays fast.
       - name: Build
         env:
           VITE_SITE_URL: ${{ vars.VITE_SITE_URL }}
diff --git a/package.json b/package.json
index c108935..261f26f 100644
--- a/package.json
+++ b/package.json
@@ -29,6 +29,9 @@
     "@fontsource/space-mono": "^5.3.0",
     "@hugeicons/core-free-icons": "^4.1.1",
     "@hugeicons/react": "^1.1.6",
+    "@sentry/cloudflare": "10.69.0",
+    "@sentry/core": "10.69.0",
+    "@sentry/react": "10.69.0",
     "@tailwindcss/vite": "^4.2.1",
     "@tanstack/react-router": "^1.170.18",
     "@tanstack/react-start": "^1.168.34",
@@ -45,6 +48,7 @@
     "@cloudflare/vite-plugin": "^1.49.0",
     "@resvg/resvg-js": "^2.6.2",
     "@rolldown/plugin-babel": "^0.2.3",
+    "@sentry/vite-plugin": "^5.4.0",
     "@types/babel__core": "^7.20.5",
     "@types/node": "^25.5.0",
     "@types/pngjs": "^6.0.5",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 9196217..a07fc96 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -20,6 +20,15 @@ importers:
       '@hugeicons/react':
         specifier: ^1.1.6
         version: 1.1.6(react@19.2.5)
+      '@sentry/cloudflare':
+        specifier: 10.69.0
+        version: 10.69.0(supports-color@10.2.2)(wrangler@4.116.0)
+      '@sentry/core':
+        specifier: 10.69.0
+        version: 10.69.0
+      '@sentry/react':
+        specifier: 10.69.0
+        version: 10.69.0(react@19.2.5)
       '@tailwindcss/vite':
         specifier: ^4.2.1
         version: 4.3.3(vite@8.2.0(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.46.1)(tsx@4.21.0))
@@ -63,6 +72,9 @@ importers:
       '@rolldown/plugin-babel':
         specifier: ^0.2.3
         version: 0.2.3(@babel/core@8.0.1)(@babel/runtime@7.29.2)(rolldown@1.2.1)(vite@8.2.0(@types/node@25.6.0)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.46.1)(tsx@4.21.0))
+      '@sentry/vite-plugin':
+        specifier: ^5.4.0
+        version: 5.4.0(rollup@4.60.2)(supports-color@10.2.2)(webpack@5.106.2(esbuild@0.28.1))
       '@types/babel__core':
         specifier: ^7.20.5
         version: 7.20.5
@@ -132,6 +144,17 @@ importers:
 
 packages:
 
+  '@apm-js-collab/code-transformer-bundler-plugins@0.7.3':
+    resolution: {integrity: sha512-qNbPwuMZ8f5ZuGj/ttPeB7a6C/S1bB6tNYaEL5vNiRKydSAxa4AU0gxCWgaP4fVju+AuwhcumSFjrEcGF9Dv7Q==}
+    engines: {node: '>=18.0.0'}
+
+  '@apm-js-collab/code-transformer@0.18.1':
+    resolution: {integrity: sha512-u1Hb6bHjWtkSpiprwVP6YaHC1DTN4RAU3zYkUDUe7WMnJwdyU1pwTL9dFKiSJB9IiLue/EQovmyx6xhU7FFtAQ==}
+    hasBin: true
+
+  '@apm-js-collab/tracing-hooks@0.13.0':
+    resolution: {integrity: sha512-mTvWz9rnQwx1U3h0XPTHaX7bgfkpipLLTQyjlC2cdhQpQEuoLT0AGzoydeoq2NxfEVv6fWOOETcSbb2nptleyw==}
+
   '@babel/code-frame@7.27.1':
     resolution: {integrity: sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==}
     engines: {node: '>=6.9.0'}
@@ -1921,6 +1944,124 @@ packages:
   '@sec-ant/readable-stream@0.4.1':
     resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==}
 
+  '@sentry/browser-utils@10.69.0':
+    resolution: {integrity: sha512-e/u1Abj0zRPwR/deGZAP3GOULrsx67/XXnM5Skniqs4uxTsdNtPek1Nef0tpxwaQJYxwh6pWdhswLPPbbPOgBQ==}
+    engines: {node: '>=18'}
+
+  '@sentry/browser@10.69.0':
+    resolution: {integrity: sha512-8391tnm96YbR7b8SYfEA/NEIZuyb2r3SZrtAT0bhZtjlujcYWjo7gugQvk8sWLU9cAa/euD00eJoIoJvNfpd7Q==}
+    engines: {node: '>=18'}
+
+  '@sentry/bundler-plugins@10.69.0':
+    resolution: {integrity: sha512-I1otnSJIH4IOugLp+kcBbT0Kcex+J8xnHuUyzMAwCYSpZ0FMVvA723uNmkMdW0PxRRw0oEhe0qDB+t+ZjHxUiA==}
+    engines: {node: '>= 18'}
+    peerDependencies:
+      rollup: '>=3.2.0'
+      webpack: '>=5.0.0'
+    peerDependenciesMeta:
+      rollup:
+        optional: true
+      webpack:
+        optional: true
+
+  '@sentry/cli-darwin@2.58.6':
+    resolution: {integrity: sha512-udAVvcyfNa0R+95GvPz/+43/N3TC0TYKdkQ7D7jhPSzbcMc7l2fxRNN5yB3UpCA5fWFnW4toeaqwDBhb/Wh3LA==}
+    engines: {node: '>=10'}
+    os: [darwin]
+
+  '@sentry/cli-linux-arm64@2.58.6':
+    resolution: {integrity: sha512-q8mEcNNmeXMy5i+jWT30TVpH7LcP4HD21CD5XRSPAd/a912HF6EpK0ybf/1USO14WOhoXbAGi9txwaWabSe33g==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux, freebsd, android]
+
+  '@sentry/cli-linux-arm@2.58.6':
+    resolution: {integrity: sha512-pD0LAt5PcUzAinBwvDqc66x9+2CabHEv486yP0gRjWO7SakbaxmfVq/EXd8VLq/Tzi39LAu422UYK1lpW3MILw==}
+    engines: {node: '>=10'}
+    cpu: [arm]
+    os: [linux, freebsd, android]
+
+  '@sentry/cli-linux-i686@2.58.6':
+    resolution: {integrity: sha512-q8vNJi1eOV/4vxAFWBsEwLHoSYapaZHIf4j76KJGJXFKTkEbsjCOOsKbwUIBTQQhRgV4DFWh3ryfsPS/que4Kg==}
+    engines: {node: '>=10'}
+    cpu: [x86, ia32]
+    os: [linux, freebsd, android]
+
+  '@sentry/cli-linux-x64@2.58.6':
+    resolution: {integrity: sha512-DZu956Mhi3ZRjTBe1WdbGV46ldVbA8d2rgp/fh51GsI25zjBHah4wZnPTSzpc+YqxU6pJpg579B/r3jrIK530Q==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux, freebsd, android]
+
+  '@sentry/cli-win32-arm64@2.58.6':
+    resolution: {integrity: sha512-nj0Ff/kmAB73EPDhR8B4O9r+NUHK5GkPCkGWC+kXVemqAJWL5jcJ5KdxG0l/S0z6RoEoltID8/43/B+TaMlT7A==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@sentry/cli-win32-i686@2.58.6':
+    resolution: {integrity: sha512-WNZiDzPbgsEMQWq4avsQ391v/xWKJDIWWWo9GYl+N/w5qcYKkoDW7wQG7T9FasI6ENn68phChTOAPXXxbfAdOg==}
+    engines: {node: '>=10'}
+    cpu: [x86, ia32]
+    os: [win32]
+
+  '@sentry/cli-win32-x64@2.58.6':
+    resolution: {integrity: sha512-R35WJ17oF4D2eqI1DR2sQQqr0fjRTt5xoP16WrTu91XM2lndRMFsnjh+/GttbxapLCBNlrjzia99MJ0PZHZpgA==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@sentry/cli@2.58.6':
+    resolution: {integrity: sha512-baBcNPLLfUi9WuL+Tpri9BFaAdvugZIKelC5X0tt0Zdy+K0K+PCVSrnNmwMWU/HyaF/SEv6b6UHnXIdqanBlcg==}
+    engines: {node: '>= 10'}
+    hasBin: true
+
+  '@sentry/cloudflare@10.69.0':
+    resolution: {integrity: sha512-CO6Tr74cw3Wx2DyWSfBCxR6EDcNfBjn52hxWacxHsLurpdfQ7Bp/J32m1KxzezR5CZXngfBTmemK3iZsMgt5uQ==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@cloudflare/workers-types': ^4.x || ^5.x
+      wrangler: ^4.x
+    peerDependenciesMeta:
+      '@cloudflare/workers-types':
+        optional: true
+      wrangler:
+        optional: true
+
+  '@sentry/conventions@0.16.0':
+    resolution: {integrity: sha512-fO9PLmHdVURcSPUpWCItWAtgKiMwGdJHbovoSEyLplX5sxs2ugvI4CBPTrkkgqhObnZOD0CnWBKDzSVQYBKEyQ==}
+    engines: {node: '>=14'}
+
+  '@sentry/core@10.69.0':
+    resolution: {integrity: sha512-+uuqVEeiDzYuAKjZLqsROKXvRTbl/QeH0gfGRtpYib1cud4rAFWRIkFmcR7Jb7JGFYwmReyQotiTj/hcDszTZg==}
+    engines: {node: '>=18'}
+
+  '@sentry/feedback@10.69.0':
+    resolution: {integrity: sha512-qrGz5Qaw93/IhMjlFN6uIaXeHwgHDaKGa6FkTAP6PonpkvSbGGqan6xfsENxzj9HUVoli1lZ6tMRDnt2qtSPhg==}
+    engines: {node: '>=18'}
+
+  '@sentry/react@10.69.0':
+    resolution: {integrity: sha512-f0Il/JMteHjdWPNZQB3rtp1Pcj2Leb3p0KSZuv3rh0EUril9CbWtQVy5zJhoAppi+MWWmgRWa+6BpHbQf+ABQA==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      react: ^16.14.0 || 17.x || 18.x || 19.x
+
+  '@sentry/replay-canvas@10.69.0':
+    resolution: {integrity: sha512-VF6nXvSninHcc7dC1Zme0RjkC7VgRMCixs6jKaQX5zTNeqTW3dZGSefSOVv+ZteRi3hJvVORq985VjUC9Z/0+A==}
+    engines: {node: '>=18'}
+
+  '@sentry/replay@10.69.0':
+    resolution: {integrity: sha512-uRhmNhtFGPOlM0iniVmWKAX3KVXI0le41yYK/iKdPjinT9jA3ZrmykO/Fv1v/KI5znOtwa9D6eHRnDTTMRxFrg==}
+    engines: {node: '>=18'}
+
+  '@sentry/server-utils@10.69.0':
+    resolution: {integrity: sha512-0MwHrA8+nNvMIsqf8m3cXwCBlUjr6AS7N6CZvHJtY1DkqEvQqEbD5VIrhzEyHN/KMZIgQ8XeDCQRhjnXFQGRhg==}
+    engines: {node: '>=18'}
+
+  '@sentry/vite-plugin@5.4.0':
+    resolution: {integrity: sha512-fFJgCxs5hDyAm9BbZJ+LbA+LK2tjX5OoD0v0ARU4StR6KQmGUduoPs69yJ9AfqZ0om3Rlp5JDliiwFcNkasORA==}
+    engines: {node: '>= 18'}
+
   '@sindresorhus/is@7.2.0':
     resolution: {integrity: sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw==}
     engines: {node: '>=18'}
@@ -2407,6 +2548,10 @@ packages:
     engines: {node: '>=0.4.0'}
     hasBin: true
 
+  agent-base@6.0.2:
+    resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
+    engines: {node: '>= 6.0.0'}
+
   agent-base@7.1.4:
     resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
     engines: {node: '>= 14'}
@@ -2465,6 +2610,10 @@ packages:
     resolution: {integrity: sha512-6t10qk83GOG8p0vKmaCr8eiilZwO171AvbROMtvvNiwrTly62t+7XkA8RdIIVbpMhCASAsxgAzdRSwh6nw/5Dg==}
     engines: {node: '>=4'}
 
+  astring@1.9.0:
+    resolution: {integrity: sha512-LElXdjswlqjWrPpJFg1Fx4wpkOCxj1TDHlSV4PlaRxHGWko024xICaa97ZkMfs6DRKlCguiAI+rbXv5GWwXIkg==}
+    hasBin: true
+
   babel-dead-code-elimination@1.0.12:
     resolution: {integrity: sha512-GERT7L2TiYcYDtYk1IpD+ASAYXjKbLTDPhBtYj7X1NuRMDTMtAx9kyBenub1Ev41lo91OHCKdmP+egTDmfQ7Ig==}
 
@@ -3079,6 +3228,10 @@ packages:
   glob-to-regexp@0.4.1:
     resolution: {integrity: sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==}
 
+  glob@13.0.6:
+    resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==}
+    engines: {node: 18 || 20 || >=22}
+
   globals@14.0.0:
     resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
     engines: {node: '>=18'}
@@ -3142,6 +3295,10 @@ packages:
     resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
     engines: {node: '>= 0.8'}
 
+  https-proxy-agent@5.0.1:
+    resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
+    engines: {node: '>= 6'}
+
   https-proxy-agent@7.0.6:
     resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
     engines: {node: '>= 14'}
@@ -3578,6 +3735,10 @@ packages:
     resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
     engines: {node: '>= 8'}
 
+  meriyah@6.1.4:
+    resolution: {integrity: sha512-Sz8FzjzI0kN13GK/6MVEsVzMZEPvOhnmmI1lU5+/1cGOiK3QUahntrNNtdVeihrO7t9JpoH75iMNXg6R6uWflQ==}
+    engines: {node: '>=18.0.0'}
+
   micromark-core-commonmark@2.0.3:
     resolution: {integrity: sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==}
 
@@ -3676,6 +3837,13 @@ packages:
   minimist@1.2.8:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
 
+  minipass@7.1.3:
+    resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==}
+    engines: {node: '>=16 || 14 >=14.17'}
+
+  module-details-from-path@1.0.4:
+    resolution: {integrity: sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==}
+
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
@@ -3718,6 +3886,15 @@ packages:
     engines: {node: '>=10.5.0'}
     deprecated: Use your platform's native DOMException instead
 
+  node-fetch@2.7.0:
+    resolution: {integrity: sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==}
+    engines: {node: 4.x || >=6.0.0}
+    peerDependencies:
+      encoding: ^0.1.0
+    peerDependenciesMeta:
+      encoding:
+        optional: true
+
   node-fetch@3.3.2:
     resolution: {integrity: sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -3839,6 +4016,10 @@ packages:
     resolution: {integrity: sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==}
     engines: {node: '>=12'}
 
+  path-scurry@2.0.2:
+    resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==}
+    engines: {node: 18 || 20 || >=22}
+
   path-to-regexp@6.3.0:
     resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
 
@@ -3905,6 +4086,10 @@ packages:
     resolution: {integrity: sha512-gjVS5hOP+M3wMm5nmNOucbIrqudzs9v/57bWRHQWLYklXqoXKrVfYW2W9+glfGsqtPgpiz5WwyEEB+ksXIx3gQ==}
     engines: {node: '>=18'}
 
+  progress@2.0.3:
+    resolution: {integrity: sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==}
+    engines: {node: '>=0.4.0'}
+
   prompts@2.4.2:
     resolution: {integrity: sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==}
     engines: {node: '>= 6'}
@@ -3916,6 +4101,9 @@ packages:
     resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
     engines: {node: '>= 0.10'}
 
+  proxy-from-env@1.1.0:
+    resolution: {integrity: sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==}
+
   punycode@2.3.1:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
@@ -4027,6 +4215,9 @@ packages:
     resolution: {integrity: sha512-eflK8wEtyOE6+hsaRVPxvUKYCpRgzLqDTb8krvAsRIwOGlHoSgYLgBXoubGgLd2fT41/OUYdb48v4k4WWHQurA==}
     engines: {node: '>= 10.13.0'}
 
+  semifies@1.0.0:
+    resolution: {integrity: sha512-xXR3KGeoxTNWPD4aBvL5NUpMTT7WMANr3EWnaS190QVkY52lqqcVRD7Q05UVbBhiWDGWMlJEUam9m7uFFGVScw==}
+
   semver@6.3.1:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
@@ -4294,6 +4485,9 @@ packages:
     resolution: {integrity: sha512-LktZQb3IeoUWB9lqR5EWTHgW/VTITCXg4D21M+lvybRVdylLrRMnqaIONLVb5mav8vM19m44HIcGq4qASeu2Qw==}
     engines: {node: '>=16'}
 
+  tr46@0.0.3:
+    resolution: {integrity: sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==}
+
   trim-lines@3.0.1:
     resolution: {integrity: sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==}
 
@@ -4554,6 +4748,9 @@ packages:
     resolution: {integrity: sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==}
     engines: {node: '>= 8'}
 
+  webidl-conversions@3.0.1:
+    resolution: {integrity: sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==}
+
   webpack-sources@3.3.4:
     resolution: {integrity: sha512-7tP1PdV4vF+lYPnkMR0jMY5/la2ub5Fc/8VQrrU+lXkiM6C4TjVfGw7iKfyhnTQOsD+6Q/iKw0eFciziRgD58Q==}
     engines: {node: '>=10.13.0'}
@@ -4571,6 +4768,9 @@ packages:
       webpack-cli:
         optional: true
 
+  whatwg-url@5.0.0:
+    resolution: {integrity: sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==}
+
   which@2.0.2:
     resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
     engines: {node: '>= 8'}
@@ -4687,6 +4887,30 @@ packages:
 
 snapshots:
 
+  '@apm-js-collab/code-transformer-bundler-plugins@0.7.3':
+    dependencies:
+      '@apm-js-collab/code-transformer': 0.18.1
+      es-module-lexer: 2.3.1
+      magic-string: 0.30.21
+      module-details-from-path: 1.0.4
+
+  '@apm-js-collab/code-transformer@0.18.1':
+    dependencies:
+      '@types/estree': 1.0.8
+      astring: 1.9.0
+      esquery: 1.7.0
+      meriyah: 6.1.4
+      semifies: 1.0.0
+      source-map: 0.6.1
+
+  '@apm-js-collab/tracing-hooks@0.13.0(supports-color@10.2.2)':
+    dependencies:
+      '@apm-js-collab/code-transformer': 0.18.1
+      debug: 4.4.3(supports-color@10.2.2)
+      module-details-from-path: 1.0.4
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/code-frame@7.27.1':
     dependencies:
       '@babel/helper-validator-identifier': 7.28.5
@@ -5675,8 +5899,7 @@ snapshots:
 
   '@open-draft/until@2.1.0': {}
 
-  '@opentelemetry/api@1.9.1':
-    optional: true
+  '@opentelemetry/api@1.9.1': {}
 
   '@oxc-project/types@0.142.0': {}
 
@@ -6020,6 +6243,137 @@ snapshots:
 
   '@sec-ant/readable-stream@0.4.1': {}
 
+  '@sentry/browser-utils@10.69.0':
+    dependencies:
+      '@sentry/conventions': 0.16.0
+      '@sentry/core': 10.69.0
+
+  '@sentry/browser@10.69.0':
+    dependencies:
+      '@sentry/browser-utils': 10.69.0
+      '@sentry/conventions': 0.16.0
+      '@sentry/core': 10.69.0
+      '@sentry/feedback': 10.69.0
+      '@sentry/replay': 10.69.0
+      '@sentry/replay-canvas': 10.69.0
+
+  '@sentry/bundler-plugins@10.69.0(rollup@4.60.2)(supports-color@10.2.2)(webpack@5.106.2(esbuild@0.28.1))':
+    dependencies:
+      '@babel/core': 7.29.0(supports-color@10.2.2)
+      '@sentry/cli': 2.58.6(supports-color@10.2.2)
+      '@sentry/core': 10.69.0
+      dotenv: 17.4.2
+      find-up: 5.0.0
+      glob: 13.0.6
+      magic-string: 0.30.21
+    optionalDependencies:
+      rollup: 4.60.2
+      webpack: 5.106.2(esbuild@0.28.1)
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
+  '@sentry/cli-darwin@2.58.6':
+    optional: true
+
+  '@sentry/cli-linux-arm64@2.58.6':
+    optional: true
+
+  '@sentry/cli-linux-arm@2.58.6':
+    optional: true
+
+  '@sentry/cli-linux-i686@2.58.6':
+    optional: true
+
+  '@sentry/cli-linux-x64@2.58.6':
+    optional: true
+
+  '@sentry/cli-win32-arm64@2.58.6':
+    optional: true
+
+  '@sentry/cli-win32-i686@2.58.6':
+    optional: true
+
+  '@sentry/cli-win32-x64@2.58.6':
+    optional: true
+
+  '@sentry/cli@2.58.6(supports-color@10.2.2)':
+    dependencies:
+      https-proxy-agent: 5.0.1(supports-color@10.2.2)
+      node-fetch: 2.7.0
+      progress: 2.0.3
+      proxy-from-env: 1.1.0
+      which: 2.0.2
+    optionalDependencies:
+      '@sentry/cli-darwin': 2.58.6
+      '@sentry/cli-linux-arm': 2.58.6
+      '@sentry/cli-linux-arm64': 2.58.6
+      '@sentry/cli-linux-i686': 2.58.6
+      '@sentry/cli-linux-x64': 2.58.6
+      '@sentry/cli-win32-arm64': 2.58.6
+      '@sentry/cli-win32-i686': 2.58.6
+      '@sentry/cli-win32-x64': 2.58.6
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
+  '@sentry/cloudflare@10.69.0(supports-color@10.2.2)(wrangler@4.116.0)':
+    dependencies:
+      '@opentelemetry/api': 1.9.1
+      '@sentry/core': 10.69.0
+      '@sentry/server-utils': 10.69.0(supports-color@10.2.2)
+      magic-string: 0.30.21
+    optionalDependencies:
+      wrangler: 4.116.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@sentry/conventions@0.16.0': {}
+
+  '@sentry/core@10.69.0':
+    dependencies:
+      '@sentry/conventions': 0.16.0
+
+  '@sentry/feedback@10.69.0':
+    dependencies:
+      '@sentry/core': 10.69.0
+
+  '@sentry/react@10.69.0(react@19.2.5)':
+    dependencies:
+      '@sentry/browser': 10.69.0
+      '@sentry/conventions': 0.16.0
+      '@sentry/core': 10.69.0
+      react: 19.2.5
+
+  '@sentry/replay-canvas@10.69.0':
+    dependencies:
+      '@sentry/core': 10.69.0
+      '@sentry/replay': 10.69.0
+
+  '@sentry/replay@10.69.0':
+    dependencies:
+      '@sentry/browser-utils': 10.69.0
+      '@sentry/core': 10.69.0
+
+  '@sentry/server-utils@10.69.0(supports-color@10.2.2)':
+    dependencies:
+      '@apm-js-collab/code-transformer-bundler-plugins': 0.7.3
+      '@apm-js-collab/tracing-hooks': 0.13.0(supports-color@10.2.2)
+      '@sentry/conventions': 0.16.0
+      '@sentry/core': 10.69.0
+      meriyah: 6.1.4
+    transitivePeerDependencies:
+      - supports-color
+
+  '@sentry/vite-plugin@5.4.0(rollup@4.60.2)(supports-color@10.2.2)(webpack@5.106.2(esbuild@0.28.1))':
+    dependencies:
+      '@sentry/bundler-plugins': 10.69.0(rollup@4.60.2)(supports-color@10.2.2)(webpack@5.106.2(esbuild@0.28.1))
+    transitivePeerDependencies:
+      - encoding
+      - rollup
+      - supports-color
+      - webpack
+
   '@sindresorhus/is@7.2.0': {}
 
   '@sindresorhus/merge-streams@4.0.0': {}
@@ -6618,6 +6972,12 @@ snapshots:
 
   acorn@8.16.0: {}
 
+  agent-base@6.0.2(supports-color@10.2.2):
+    dependencies:
+      debug: 4.4.3(supports-color@10.2.2)
+    transitivePeerDependencies:
+      - supports-color
+
   agent-base@7.1.4: {}
 
   ajv-formats@2.1.1(ajv@8.18.0):
@@ -6667,6 +7027,8 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
+  astring@1.9.0: {}
+
   babel-dead-code-elimination@1.0.12(supports-color@10.2.2):
     dependencies:
       '@babel/core': 7.29.0(supports-color@10.2.2)
@@ -6938,8 +7300,7 @@ snapshots:
 
   es-module-lexer@2.0.0: {}
 
-  es-module-lexer@2.3.1:
-    optional: true
+  es-module-lexer@2.3.1: {}
 
   es-object-atoms@1.1.1:
     dependencies:
@@ -7335,6 +7696,12 @@ snapshots:
   glob-to-regexp@0.4.1:
     optional: true
 
+  glob@13.0.6:
+    dependencies:
+      minimatch: 10.2.5
+      minipass: 7.1.3
+      path-scurry: 2.0.2
+
   globals@14.0.0: {}
 
   gopd@1.2.0: {}
@@ -7403,6 +7770,13 @@ snapshots:
       statuses: 2.0.2
       toidentifier: 1.0.1
 
+  https-proxy-agent@5.0.1(supports-color@10.2.2):
+    dependencies:
+      agent-base: 6.0.2(supports-color@10.2.2)
+      debug: 4.4.3(supports-color@10.2.2)
+    transitivePeerDependencies:
+      - supports-color
+
   https-proxy-agent@7.0.6(supports-color@10.2.2):
     dependencies:
       agent-base: 7.1.4
@@ -7779,6 +8153,8 @@ snapshots:
 
   merge2@1.4.1: {}
 
+  meriyah@6.1.4: {}
+
   micromark-core-commonmark@2.0.3:
     dependencies:
       decode-named-character-reference: 1.3.0
@@ -7949,6 +8325,10 @@ snapshots:
 
   minimist@1.2.8: {}
 
+  minipass@7.1.3: {}
+
+  module-details-from-path@1.0.4: {}
+
   ms@2.1.3: {}
 
   msw@2.13.4(@types/node@25.6.0)(typescript@5.9.3):
@@ -7991,6 +8371,10 @@ snapshots:
 
   node-domexception@1.0.0: {}
 
+  node-fetch@2.7.0:
+    dependencies:
+      whatwg-url: 5.0.0
+
   node-fetch@3.3.2:
     dependencies:
       data-uri-to-buffer: 4.0.1
@@ -8161,6 +8545,11 @@ snapshots:
 
   path-key@4.0.0: {}
 
+  path-scurry@2.0.2:
+    dependencies:
+      lru-cache: 11.3.5
+      minipass: 7.1.3
+
   path-to-regexp@6.3.0: {}
 
   path-to-regexp@8.4.2: {}
@@ -8212,6 +8601,8 @@ snapshots:
     dependencies:
       parse-ms: 4.0.0
 
+  progress@2.0.3: {}
+
   prompts@2.4.2:
     dependencies:
       kleur: 3.0.3
@@ -8224,6 +8615,8 @@ snapshots:
       forwarded: 0.2.0
       ipaddr.js: 1.9.1
 
+  proxy-from-env@1.1.0: {}
+
   punycode@2.3.1: {}
 
   qs@6.15.1:
@@ -8395,6 +8788,8 @@ snapshots:
       ajv-keywords: 5.1.0(ajv@8.18.0)
     optional: true
 
+  semifies@1.0.0: {}
+
   semver@6.3.1: {}
 
   semver@7.8.5: {}
@@ -8733,6 +9128,8 @@ snapshots:
     dependencies:
       tldts: 7.0.28
 
+  tr46@0.0.3: {}
+
   trim-lines@3.0.1: {}
 
   trough@2.2.0: {}
@@ -8935,6 +9332,8 @@ snapshots:
 
   web-streams-polyfill@3.3.3: {}
 
+  webidl-conversions@3.0.1: {}
+
   webpack-sources@3.3.4:
     optional: true
 
@@ -8972,6 +9371,11 @@ snapshots:
       - uglify-js
     optional: true
 
+  whatwg-url@5.0.0:
+    dependencies:
+      tr46: 0.0.3
+      webidl-conversions: 3.0.1
+
   which@2.0.2:
     dependencies:
       isexe: 2.0.0
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index cf041c9..6ed1612 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -7,8 +7,10 @@
 #
 # Postinstall scripts pnpm is allowed to run. Without these, `pnpm <script>`
 # aborts on its dependency-status check. esbuild backs Vitest, workerd backs the
-# Cloudflare Vite plugin and `wrangler dev`, and sharp backs vite-imagetools.
+# Cloudflare Vite plugin and `wrangler dev`, sharp backs vite-imagetools, and
+# the Sentry CLI downloads the binary that uploads source maps.
 allowBuilds:
+  "@sentry/cli": true
   esbuild: true
   msw: false
   sharp: true
diff --git a/src/vite-env.d.ts b/src/vite-env.d.ts
index f885635..ceaa32a 100644
--- a/src/vite-env.d.ts
+++ b/src/vite-env.d.ts
@@ -9,6 +9,12 @@ interface ImportMeta {
   readonly env: ImportMetaEnv
 }
 
+/**
+ * Sentry release name, injected by `define` in `vite.config.ts`. It is the
+ * commit SHA on Cloudflare Workers Builds and in Actions, and `null` locally.
+ */
+declare const __SENTRY_RELEASE__: string | null
+
 /**
  * vite-imagetools 10 ships no ambient types, so the `as=picture` output is
  * declared here. `sources` maps a format name to a srcset string.
diff --git a/vite.config.ts b/vite.config.ts
index 4ca7a6c..93bc541 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -1,19 +1,25 @@
 import { cloudflare } from "@cloudflare/vite-plugin"
 import babel from "@rolldown/plugin-babel"
+import { sentryVitePlugin } from "@sentry/vite-plugin"
 import tailwindcss from "@tailwindcss/vite"
 import { tanstackStart } from "@tanstack/react-start/plugin/vite"
 import viteReact, { reactCompilerPreset } from "@vitejs/plugin-react"
 import { defineConfig } from "vite"
 import { imagetools } from "vite-imagetools"
 
+import { SENTRY_ORG, SENTRY_PROJECT } from "./src/lib/sentry/constants.js"
+
 /**
- * Source maps are only built when `pnpm sourcemaps:upload` can send them to
- * PostHog. The repo is public, so the two upload variables stay CI-only and a
- * local build must still succeed without them (see `.env.example`).
+ * Source maps are only built when they can be uploaded to Sentry, because the
+ * plugin deletes them afterwards and a shipped `sourceMappingURL` pointing at a
+ * deleted file would 404. The repo is public, so the token stays out of it and
+ * a build without one still succeeds (see `.env.example`).
  */
-const shouldBuildSourcemaps = Boolean(
-  process.env.POSTHOG_CLI_API_KEY && process.env.POSTHOG_CLI_ENV_ID
-)
+const sentryAuthToken = process.env.SENTRY_AUTH_TOKEN
+
+/** Cloudflare Workers Builds sets the first; GitHub Actions sets the second. */
+const release =
+  process.env.WORKERS_CI_COMMIT_SHA ?? process.env.GITHUB_SHA ?? null
 
 export default defineConfig({
   /** Next.js used port 3000; keep the same local URL. `host` also binds 127.0.0.1. */
@@ -26,7 +32,10 @@ export default defineConfig({
     host: true,
   },
   build: {
-    sourcemap: shouldBuildSourcemaps,
+    sourcemap: sentryAuthToken ? "hidden" : false,
+  },
+  define: {
+    __SENTRY_RELEASE__: JSON.stringify(release),
   },
   /** Resolves the `@/*` alias from tsconfig.json in every environment. */
   resolve: {
@@ -42,5 +51,16 @@ export default defineConfig({
     // @vitejs/plugin-react v6 transforms with Oxc, so the compiler runs
     // through the Rolldown Babel bridge.
     babel({ presets: [reactCompilerPreset({ target: "19" })] }),
+    // Last on purpose: it injects debug IDs at chunk-render time and uploads on
+    // close, after the Cloudflare plugin has written `dist/server`.
+    sentryVitePlugin({
+      org: SENTRY_ORG,
+      project: SENTRY_PROJECT,
+      authToken: sentryAuthToken,
+      disable: !sentryAuthToken,
+      telemetry: false,
+      release: { name: release ?? undefined },
+      sourcemaps: { filesToDeleteAfterUpload: ["dist/**/*.js.map"] },
+    }),
   ],
 })
diff --git a/vitest.config.ts b/vitest.config.ts
index 29972c2..a3b698e 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -8,6 +8,10 @@ import { defineConfig } from "vitest/config"
  * would run the suite inside the Workers runtime.
  */
 export default defineConfig({
+  /** Mirrors the `define` in vite.config.ts so `lib/sentry/options.ts` builds. */
+  define: {
+    __SENTRY_RELEASE__: "null",
+  },
   test: {
     environment: "node",
     alias: {

From 79c7e8df5d133c9865a713bc95fd1770920568c5 Mon Sep 17 00:00:00 2001
From: Slate Rehm <slaterehm@pm.me>
Date: Thu, 30 Jul 2026 23:05:38 -0500
Subject: [PATCH 2/6] feat: report errors from the browser and the Worker

Anonymous by construction. Every dataCollection field is set explicitly
so a future change to a Sentry default cannot start sending headers,
cookies, or stack-frame variables. All three carry the OpenRouter key
here: it lives in a SameSite=Lax, Path=/ cookie, so every same-origin
request sends it to the Worker.

Scrubbing is aggressive because error messages carry user input. The
OpenRouter client builds messages out of OpenRouter's JSON error body,
and a moderation refusal echoes the flagged input back, so a pasted
stack trace ends up inside an exception value. Console breadcrumbs are
dropped twice over: the integration is removed on both runtimes, and
the scrubber drops the category as well.

src/server.ts typechecks with no cast. The options callback takes no
argument, so Env never has to resolve, which matters because
worker-configuration.d.ts is gitignored and absent in CI. fetch declares
one parameter, so TypeScript never compares Cloudflare's env against the
all-optional RequestOptions.

src/start.ts is bundled into both the browser and the Worker, so it uses
the isomorphic captureException from @sentry/core. Importing
@sentry/cloudflare there would pull node:async_hooks into the browser.

AppError only shows the event id. The router already reported the error
through defaultOnCatch, and capturing again would file it twice.
---
 src/components/app-error.tsx   |  14 +++
 src/lib/sentry/browser.ts      |  38 +++++++
 src/lib/sentry/constants.ts    |  24 +++++
 src/lib/sentry/options.test.ts | 118 ++++++++++++++++++++
 src/lib/sentry/options.ts      | 126 ++++++++++++++++++++++
 src/lib/sentry/scrub.test.ts   | 189 +++++++++++++++++++++++++++++++++
 src/lib/sentry/scrub.ts        | 189 +++++++++++++++++++++++++++++++++
 src/router.tsx                 |  23 ++++
 src/server.ts                  |  39 +++++--
 src/start.ts                   |  44 ++++++++
 10 files changed, 798 insertions(+), 6 deletions(-)
 create mode 100644 src/lib/sentry/browser.ts
 create mode 100644 src/lib/sentry/constants.ts
 create mode 100644 src/lib/sentry/options.test.ts
 create mode 100644 src/lib/sentry/options.ts
 create mode 100644 src/lib/sentry/scrub.test.ts
 create mode 100644 src/lib/sentry/scrub.ts
 create mode 100644 src/start.ts

diff --git a/src/components/app-error.tsx b/src/components/app-error.tsx
index 867fcfa..94788bc 100644
--- a/src/components/app-error.tsx
+++ b/src/components/app-error.tsx
@@ -1,4 +1,7 @@
+import { lastEventId } from "@sentry/core"
+
 import { Button } from "@/components/ui/button"
+import { useHydrated } from "@/hooks/use-hydrated"
 import { clearAll } from "@/lib/wipe"
 
 /**
@@ -14,6 +17,12 @@ export function AppError({
   error: Error & { digest?: string }
   reset: () => void
 }) {
+  // The router already reported this through `defaultOnCatch`. Reading the id
+  // only gives the user something to quote in a bug report. It has to wait for
+  // hydration, or the server HTML and the first client render disagree.
+  const hydrated = useHydrated()
+  const eventId = hydrated ? lastEventId() : undefined
+
   return (
     <div className="mx-auto flex w-full max-w-lg flex-col gap-6 px-4 py-16">
       <div className="space-y-2">
@@ -54,6 +63,11 @@ export function AppError({
         <p className="font-mono text-[0.6875rem] text-muted-foreground">
           Clearing removes your key, consent, and recent runs from this browser.
         </p>
+        {eventId ? (
+          <p className="font-mono text-[0.6875rem] text-muted-foreground">
+            Reference: {eventId}
+          </p>
+        ) : null}
       </div>
     </div>
   )
diff --git a/src/lib/sentry/browser.ts b/src/lib/sentry/browser.ts
new file mode 100644
index 0000000..ad10764
--- /dev/null
+++ b/src/lib/sentry/browser.ts
@@ -0,0 +1,38 @@
+import {
+  breadcrumbsIntegration,
+  init,
+  tanstackRouterBrowserTracingIntegration,
+} from "@sentry/react"
+
+import { browserSentryOptions } from "@/lib/sentry/options"
+
+/**
+ * The only module that imports `@sentry/react` at runtime. `src/router.tsx`
+ * calls it behind `if (!import.meta.env.SSR)`, which — together with the
+ * package's `sideEffects: false` — keeps the browser SDK out of the Worker
+ * bundle entirely.
+ *
+ * `router` is typed `unknown` rather than the concrete router type so this
+ * module does not have to import the route tree.
+ */
+export function initBrowserSentry(router: unknown): void {
+  init({
+    ...browserSentryOptions,
+    integrations: (defaults) => [
+      ...defaults.filter(
+        (integration) =>
+          // Replaced below with console capture off.
+          integration.name !== "Breadcrumbs" &&
+          // Locale and timezone are fingerprinting surface.
+          integration.name !== "CultureContext"
+      ),
+      tanstackRouterBrowserTracingIntegration(router, { enableInp: true }),
+      /**
+       * Console breadcrumbs are the biggest leak vector in this app: the
+       * OpenRouter client logs malformed stream frames, which are raw model
+       * output. DOM breadcrumbs stay on — they record CSS selectors, not text.
+       */
+      breadcrumbsIntegration({ console: false }),
+    ],
+  })
+}
diff --git a/src/lib/sentry/constants.ts b/src/lib/sentry/constants.ts
new file mode 100644
index 0000000..0479877
--- /dev/null
+++ b/src/lib/sentry/constants.ts
@@ -0,0 +1,24 @@
+/**
+ * Sentry identifiers. No imports and no `import.meta` on purpose: `vite.config.ts`
+ * reads this file at config-load time, so the org and the project have one home.
+ */
+
+/**
+ * Public by design. A DSN only grants permission to send events, so it ships in
+ * the browser bundle either way and there is nothing to protect. The one real
+ * secret is `SENTRY_AUTH_TOKEN`, which is build-time only.
+ */
+export const SENTRY_DSN =
+  "https://5acd315994aa7dbf371fc6690440205e@o4510046563663872.ingest.us.sentry.io/4511827764445184"
+
+export const SENTRY_ORG = "bearfire"
+
+export const SENTRY_PROJECT = "error-wolf"
+
+/**
+ * Path of the first-party envelope proxy. The browser posts here instead of
+ * posting to Sentry, and the Worker forwards it. The name is opaque on purpose:
+ * an ad blocker matches on "sentry". Changing it breaks reporting for every
+ * browser still running an older bundle.
+ */
+export const SENTRY_TUNNEL_PATH = "/wdyd"
diff --git a/src/lib/sentry/options.test.ts b/src/lib/sentry/options.test.ts
new file mode 100644
index 0000000..11e6ae5
--- /dev/null
+++ b/src/lib/sentry/options.test.ts
@@ -0,0 +1,118 @@
+import type { TracesSamplerSamplingContext } from "@sentry/core"
+import { describe, expect, it } from "vitest"
+
+import {
+  browserSentryOptions,
+  browserTracesSampler,
+  workerSentryOptions,
+  workerTracesSampler,
+} from "@/lib/sentry/options"
+import { scrubBreadcrumb, scrubEvent } from "@/lib/sentry/scrub"
+
+/**
+ * Guards on the anonymity settings. A regression in any of these is a live PII
+ * leak rather than a style problem, so they are asserted instead of reviewed.
+ */
+
+/**
+ * Records the fallback rate the sampler offers, so a test can tell "returned 0
+ * outright" apart from "delegated and the parent said no".
+ */
+function samplingContext(name: string) {
+  const offered: number[] = []
+  const ctx = {
+    name,
+    inheritOrSampleWith: (fallback: number) => {
+      offered.push(fallback)
+      // Stand in for a parent that sampled the trace in.
+      return 1
+    },
+  } as unknown as TracesSamplerSamplingContext
+  return { ctx, offered }
+}
+
+describe("tracesSampler", () => {
+  it("drops the tunnel outright, without consulting the parent", () => {
+    for (const sampler of [workerTracesSampler, browserTracesSampler]) {
+      const { ctx, offered } = samplingContext("POST /wdyd")
+      expect(sampler(ctx)).toBe(0)
+      expect(offered).toEqual([])
+    }
+  })
+
+  it("drops robots and sitemap", () => {
+    for (const name of ["GET /robots.txt", "GET /sitemap.xml"]) {
+      const { ctx } = samplingContext(name)
+      expect(workerTracesSampler(ctx)).toBe(0)
+    }
+  })
+
+  it("honours an upstream sampling decision for a normal route", () => {
+    const { ctx, offered } = samplingContext("GET /hunt")
+    expect(workerTracesSampler(ctx)).toBe(1)
+    // Delegated rather than deciding alone, so a browser-to-Worker trace stays
+    // whole instead of being sampled independently at each end.
+    expect(offered).toHaveLength(1)
+  })
+
+  it("offers the browser a higher fallback rate than the Worker", () => {
+    const browser = samplingContext("GET /hunt")
+    const worker = samplingContext("GET /hunt")
+    browserTracesSampler(browser.ctx)
+    workerTracesSampler(worker.ctx)
+    expect(browser.offered[0]).toBeGreaterThanOrEqual(worker.offered[0] ?? 0)
+  })
+})
+
+describe("tunnel wiring", () => {
+  it("tunnels the browser and not the Worker", () => {
+    // The Worker posting straight to Sentry is what stops an error thrown
+    // while handling a tunnel request from tunnelling itself.
+    expect(browserSentryOptions.tunnel).toBe("/wdyd")
+    expect(workerSentryOptions.tunnel).toBeUndefined()
+  })
+})
+
+describe("worker integrations", () => {
+  it("drops the Console integration that captures console output", () => {
+    const defaults = [
+      { name: "Console", setupOnce: () => {} },
+      { name: "Dedupe", setupOnce: () => {} },
+    ]
+    const configure = workerSentryOptions.integrations
+    // Narrowed rather than asserted: the option also accepts a plain array.
+    if (typeof configure !== "function") {
+      throw new Error("worker integrations must stay a filter function")
+    }
+    expect(configure(defaults).map((i) => i.name)).toEqual(["Dedupe"])
+  })
+})
+
+describe("anonymous mode", () => {
+  for (const [label, options] of [
+    ["browser", browserSentryOptions],
+    ["worker", workerSentryOptions],
+  ] as const) {
+    it(`keeps ${label} reporting anonymous`, () => {
+      expect(options.sendDefaultPii).toBe(false)
+      expect(options.enableLogs).toBe(false)
+
+      const collection = options.dataCollection
+      expect(collection?.userInfo).toBe(false)
+      expect(collection?.cookies).toBe(false)
+      expect(collection?.httpHeaders?.request).toBe(false)
+      expect(collection?.httpHeaders?.response).toBe(false)
+      expect(collection?.httpBodies).toEqual([])
+      expect(collection?.urlQueryParams).toBe(false)
+      expect(collection?.stackFrameVariables).toBe(false)
+      expect(collection?.databaseQueryData).toBe(false)
+      expect(collection?.frameContextLines).toBe(0)
+    })
+
+    it(`routes every ${label} event through the scrubber`, () => {
+      expect(options.beforeSend).toBe(scrubEvent)
+      expect(options.beforeSendTransaction).toBe(scrubEvent)
+      expect(options.beforeBreadcrumb).toBe(scrubBreadcrumb)
+    })
+  }
+})
diff --git a/src/lib/sentry/options.ts b/src/lib/sentry/options.ts
new file mode 100644
index 0000000..45ded4a
--- /dev/null
+++ b/src/lib/sentry/options.ts
@@ -0,0 +1,126 @@
+import type { CloudflareOptions } from "@sentry/cloudflare"
+import type { DataCollection, TracesSamplerSamplingContext } from "@sentry/core"
+import type { BrowserOptions } from "@sentry/react"
+
+import { SENTRY_DSN, SENTRY_TUNNEL_PATH } from "@/lib/sentry/constants"
+import { scrubBreadcrumb, scrubEvent } from "@/lib/sentry/scrub"
+
+/**
+ * Option objects for both runtimes. Every SDK import is type-only, so a
+ * mistyped key fails `pnpm typecheck` while nothing from the SDK enters either
+ * bundle from this file.
+ */
+
+const isDev = import.meta.env.DEV
+
+/** Trace rates in production. Dev always samples everything. */
+const BROWSER_TRACE_RATE = 0.2
+const WORKER_TRACE_RATE = 0.1
+
+/**
+ * Anonymous mode, stated field by field. Leaving these to the defaults would
+ * mean a future change in Sentry could silently start sending headers, cookies,
+ * or stack-frame variables — all of which carry the OpenRouter key here.
+ */
+const dataCollection = {
+  userInfo: false,
+  cookies: false,
+  httpHeaders: { request: false, response: false },
+  httpBodies: [],
+  urlQueryParams: false,
+  graphQL: { document: false, variables: false },
+  genAI: { inputs: false, outputs: false },
+  databaseQueryData: false,
+  stackFrameVariables: false,
+  frameContextLines: 0,
+} as const satisfies DataCollection
+
+/**
+ * Errors that are expected behaviour rather than bugs. A cancelled run is the
+ * common one: the hunt view aborts its own fetch when the user stops a run.
+ */
+const ignoreErrors = [
+  "ResizeObserver loop limit exceeded",
+  "ResizeObserver loop completed with undelivered notifications",
+  /^AbortError/,
+  "The user aborted a request.",
+  "signal is aborted without reason",
+  /^Non-Error promise rejection captured/,
+]
+
+/** Transactions that are pure noise, plus the tunnel itself. */
+const NON_SAMPLED_ROUTES =
+  /\s\/(wdyd|robots\.txt|sitemap\.xml|favicon|manifest)/
+
+function makeTracesSampler(productionRate: number) {
+  return function tracesSampler(ctx: TracesSamplerSamplingContext): number {
+    if (NON_SAMPLED_ROUTES.test(ctx.name)) return 0
+    // Honour an upstream sampling decision so a browser-to-Worker trace stays
+    // whole instead of being sampled independently at each end.
+    return ctx.inheritOrSampleWith(isDev ? 1 : productionRate)
+  }
+}
+
+export const browserTracesSampler = makeTracesSampler(BROWSER_TRACE_RATE)
+export const workerTracesSampler = makeTracesSampler(WORKER_TRACE_RATE)
+
+const sharedOptions = {
+  dsn: SENTRY_DSN,
+  release: __SENTRY_RELEASE__ ?? undefined,
+  environment: isDev ? "development" : "production",
+  sendDefaultPii: false,
+  dataCollection,
+  /** Console output here can echo pasted logs and raw model output. */
+  enableLogs: false,
+  /** Default is 100. Fewer breadcrumbs, less leak surface. */
+  maxBreadcrumbs: 20,
+  /** Default is 250. Truncates OpenRouter error bodies that quote user input. */
+  maxValueLength: 200,
+  /** Stops deep serialization of request and response objects. */
+  normalizeDepth: 3,
+  /** Never sample errors: the volume is tiny and every crash matters. */
+  sampleRate: 1,
+  ignoreErrors,
+  beforeSend: scrubEvent,
+  beforeSendTransaction: scrubEvent,
+  beforeBreadcrumb: scrubBreadcrumb,
+}
+
+export const browserSentryOptions: BrowserOptions = {
+  ...sharedOptions,
+  /**
+   * The reverse proxy. Set on the browser only — the Worker posts straight to
+   * Sentry, which is what stops a tunnel error from tunnelling itself.
+   */
+  tunnel: SENTRY_TUNNEL_PATH,
+  tracesSampler: browserTracesSampler,
+  /**
+   * Same-origin only. Without this the SDK appends `sentry-trace` and `baggage`
+   * to the openrouter.ai fetches, which changes the CORS preflight on the
+   * streaming completion request.
+   */
+  tracePropagationTargets: [/^\//],
+  /** Browser extensions are the top noise source for a public site. */
+  denyUrls: [
+    /^chrome-extension:\/\//,
+    /^moz-extension:\/\//,
+    /^safari-(web-)?extension:\/\//,
+  ],
+  /** Only reports counts of discarded events, which we do not use. */
+  sendClientReports: false,
+}
+
+export const workerSentryOptions: CloudflareOptions = {
+  ...sharedOptions,
+  tracesSampler: workerTracesSampler,
+  /**
+   * The Worker SDK installs a `Console` integration by default, which turns
+   * every `console.*` call into a breadcrumb. `scrubBreadcrumb` drops those
+   * anyway, but not collecting them is cheaper and mirrors the browser, where
+   * `breadcrumbsIntegration({ console: false })` does the same job.
+   */
+  integrations: (defaults) =>
+    defaults.filter((integration) => integration.name !== "Console"),
+  /** Belt and braces behind the sampler, in case a span escapes it. */
+  ignoreTransactions: ["POST /wdyd", "GET /robots.txt", "GET /sitemap.xml"],
+}
diff --git a/src/lib/sentry/scrub.test.ts b/src/lib/sentry/scrub.test.ts
new file mode 100644
index 0000000..3fdbab4
--- /dev/null
+++ b/src/lib/sentry/scrub.test.ts
@@ -0,0 +1,189 @@
+import type { Breadcrumb, Event as SentryEvent } from "@sentry/core"
+import { describe, expect, it } from "vitest"
+
+import {
+  redactSecrets,
+  scrubBreadcrumb,
+  scrubEvent,
+  scrubUrl,
+  truncate,
+} from "@/lib/sentry/scrub"
+
+/**
+ * These assertions are the privacy contract, not style checks. Weakening one
+ * means a real key or a user's pasted stack trace reaches Sentry.
+ */
+
+const FAKE_KEY = "sk-or-v1-0123456789abcdef0123456789abcdef"
+
+describe("redactSecrets", () => {
+  it("redacts an OpenRouter key inside a longer sentence", () => {
+    const result = redactSecrets(`request failed for ${FAKE_KEY} on attempt 2`)
+    expect(result).not.toContain("0123456789abcdef")
+    expect(result).toContain("sk-or-v1-[redacted]")
+    expect(result).toContain("on attempt 2")
+  })
+
+  it("redacts a bearer token but keeps the scheme", () => {
+    const result = redactSecrets("Authorization: Bearer abcdef0123456789xyz")
+    expect(result).toBe("Authorization: Bearer [redacted]")
+  })
+
+  it("leaves ordinary prose alone", () => {
+    const prose = "TypeError: cannot read properties of undefined"
+    expect(redactSecrets(prose)).toBe(prose)
+  })
+})
+
+describe("truncate", () => {
+  it("keeps text under the limit unchanged", () => {
+    expect(truncate("short", 200)).toBe("short")
+  })
+
+  it("cuts longer text and marks the cut", () => {
+    expect(truncate("a".repeat(500))).toHaveLength(201)
+    expect(truncate("a".repeat(500)).endsWith("…")).toBe(true)
+  })
+})
+
+describe("scrubUrl", () => {
+  it("drops the query string and the fragment", () => {
+    expect(scrubUrl("https://errorwolf.dev/hunt?key=abc#frag")).toBe(
+      "https://errorwolf.dev/hunt"
+    )
+  })
+})
+
+describe("scrubEvent", () => {
+  it("removes every identifying field", () => {
+    const event = scrubEvent({
+      user: { id: "42", ip_address: "203.0.113.7" },
+      server_name: "worker-1",
+      extra: { note: "anything" },
+      contexts: { culture: { locale: "en-US", timezone: "America/Denver" } },
+      request: {
+        url: "https://errorwolf.dev/hunt?token=abc",
+        cookies: { error_wolf_openrouter_key: FAKE_KEY },
+        headers: { authorization: `Bearer ${FAKE_KEY}` },
+        data: { pasted: "a stack trace" },
+        query_string: "token=abc",
+      },
+    } satisfies SentryEvent)
+
+    expect(event.user).toBeUndefined()
+    expect(event.server_name).toBeUndefined()
+    expect(event.extra).toBeUndefined()
+    expect(event.contexts?.culture).toBeUndefined()
+    expect(event.request?.cookies).toBeUndefined()
+    expect(event.request?.headers).toBeUndefined()
+    expect(event.request?.data).toBeUndefined()
+    expect(event.request?.query_string).toBeUndefined()
+    expect(event.request?.url).toBe("https://errorwolf.dev/hunt")
+    expect(JSON.stringify(event)).not.toContain("0123456789abcdef")
+  })
+
+  it("redacts and truncates a pasted stack trace in an exception value", () => {
+    const pasted = `at Object.<anonymous> key=${FAKE_KEY}\n${"noise ".repeat(1000)}`
+    const event = scrubEvent({
+      exception: { values: [{ type: "Error", value: pasted }] },
+    } satisfies SentryEvent)
+
+    const value = event.exception?.values?.[0]?.value ?? ""
+    expect(value).not.toContain("0123456789abcdef")
+    expect(value).toContain("sk-or-v1-[redacted]")
+    expect(value.length).toBeLessThanOrEqual(201)
+  })
+
+  it("drops frame variables and browser-extension frames", () => {
+    const event = scrubEvent({
+      exception: {
+        values: [
+          {
+            type: "Error",
+            stacktrace: {
+              frames: [
+                { filename: "chrome-extension://abc/content.js" },
+                { filename: "/src/routes/hunt.tsx", vars: { key: FAKE_KEY } },
+              ],
+            },
+          },
+        ],
+      },
+    } satisfies SentryEvent)
+
+    const frames = event.exception?.values?.[0]?.stacktrace?.frames ?? []
+    expect(frames).toHaveLength(1)
+    expect(frames[0]?.filename).toBe("/src/routes/hunt.tsx")
+    expect(frames[0]?.vars).toBeUndefined()
+  })
+
+  it("scrubs a transaction event, proving the generic serves both hooks", () => {
+    const event = scrubEvent({
+      type: "transaction",
+      transaction: "/hunt?token=abc",
+      spans: [
+        {
+          description: "POST https://openrouter.ai/api/v1/chat?key=abc",
+          span_id: "a",
+          trace_id: "b",
+          start_timestamp: 0,
+          data: {},
+        },
+      ],
+    } satisfies SentryEvent)
+
+    expect(event.transaction).toBe("/hunt")
+    expect(event.spans?.[0]?.description).toBe(
+      "POST https://openrouter.ai/api/v1/chat"
+    )
+  })
+
+  it("filters breadcrumbs through scrubBreadcrumb", () => {
+    const event = scrubEvent({
+      breadcrumbs: [
+        { category: "console", message: `raw model output ${FAKE_KEY}` },
+        { category: "navigation", data: { from: "/", to: "/hunt" } },
+      ],
+    } satisfies SentryEvent)
+
+    expect(event.breadcrumbs).toHaveLength(1)
+    expect(event.breadcrumbs?.[0]?.category).toBe("navigation")
+  })
+})
+
+describe("scrubBreadcrumb", () => {
+  it("drops console breadcrumbs", () => {
+    expect(
+      scrubBreadcrumb({ category: "console", message: "anything" })
+    ).toBeNull()
+  })
+
+  it("drops typed input", () => {
+    expect(
+      scrubBreadcrumb({ category: "ui.input", message: "anything" })
+    ).toBeNull()
+  })
+
+  it("drops an unrecognized category rather than guessing", () => {
+    expect(scrubBreadcrumb({ category: "something.new" })).toBeNull()
+  })
+
+  it("keeps navigation and strips the query string from a url", () => {
+    const crumb = scrubBreadcrumb({
+      category: "fetch",
+      data: { url: "https://errorwolf.dev/api?token=abc", method: "POST" },
+    } satisfies Breadcrumb)
+
+    expect(crumb?.data?.url).toBe("https://errorwolf.dev/api")
+    expect(crumb?.data?.method).toBe("POST")
+  })
+
+  it("drops data keys outside the allowlist", () => {
+    const crumb = scrubBreadcrumb({
+      category: "fetch",
+      data: { url: "https://errorwolf.dev/api", body: `key ${FAKE_KEY}` },
+    } satisfies Breadcrumb)
+
+    expect(crumb?.data?.body).toBeUndefined()
+  })
+})
diff --git a/src/lib/sentry/scrub.ts b/src/lib/sentry/scrub.ts
new file mode 100644
index 0000000..a7f2e97
--- /dev/null
+++ b/src/lib/sentry/scrub.ts
@@ -0,0 +1,189 @@
+import type { Breadcrumb, Event as SentryEvent } from "@sentry/core"
+
+/**
+ * The privacy layer. Every event and every breadcrumb passes through here
+ * before it leaves the browser or the Worker.
+ *
+ * Two things in this app make aggressive scrubbing necessary:
+ *
+ * 1. The OpenRouter key lives in a `SameSite=Lax; Path=/` cookie, so every
+ *    same-origin request carries `sk-or-v1-…` in the `Cookie` header.
+ * 2. Users paste stack traces and build logs. `src/lib/simplify/openrouter`
+ *    builds error messages out of OpenRouter's JSON error body, and a
+ *    moderation refusal echoes the flagged input back — that is, the pasted
+ *    trace ends up inside an exception message.
+ *
+ * The imports are type-only, so `src/lib/` keeps no runtime SDK dependency.
+ */
+
+/** Longest error message or breadcrumb text that leaves the browser. */
+const MAX_TEXT_LENGTH = 200
+
+const REDACTED = "[redacted]"
+
+const SECRET_PATTERNS: Array<[RegExp, string]> = [
+  [/sk-or-v1-[A-Za-z0-9._-]{8,}/g, `sk-or-v1-${REDACTED}`],
+  [/\bsk-[A-Za-z0-9._-]{16,}/g, `sk-${REDACTED}`],
+  [/\b([Bb]earer)\s+[A-Za-z0-9._-]{8,}/g, `$1 ${REDACTED}`],
+]
+
+const EXTENSION_SCHEMES = [
+  "chrome-extension:",
+  "moz-extension:",
+  "safari-extension:",
+  "safari-web-extension:",
+]
+
+/**
+ * Breadcrumb categories worth keeping. Everything else is dropped rather than
+ * filtered, because an unknown category is an unknown payload.
+ */
+const ALLOWED_BREADCRUMB_CATEGORIES = new Set([
+  "navigation",
+  "fetch",
+  "xhr",
+  "ui.click",
+  "sentry.event",
+  "sentry.transaction",
+])
+
+/** Breadcrumb `data` keys that carry no user input. */
+const ALLOWED_BREADCRUMB_DATA_KEYS = new Set([
+  "url",
+  "method",
+  "status_code",
+  "from",
+  "to",
+])
+
+export function redactSecrets(text: string): string {
+  let result = text
+  for (const [pattern, replacement] of SECRET_PATTERNS) {
+    result = result.replace(pattern, replacement)
+  }
+  return result
+}
+
+export function truncate(text: string, max: number = MAX_TEXT_LENGTH): string {
+  return text.length <= max ? text : `${text.slice(0, max)}…`
+}
+
+/** Redact, then truncate. Order matters: truncating first can split a key. */
+function clean(text: string): string {
+  return truncate(redactSecrets(text))
+}
+
+/**
+ * Drop the query string and the fragment. A URL in this app can carry a model
+ * id or a provider token, and neither is worth the risk.
+ */
+export function scrubUrl(url: string): string {
+  const cut = url.search(/[?#]/)
+  const trimmed = cut === -1 ? url : url.slice(0, cut)
+  return redactSecrets(trimmed)
+}
+
+function isExtensionFrame(filename: string | undefined): boolean {
+  if (!filename) return false
+  return EXTENSION_SCHEMES.some((scheme) => filename.startsWith(scheme))
+}
+
+/**
+ * Returns `null` to drop the breadcrumb.
+ *
+ * `console` is the single biggest leak vector here: the OpenRouter client logs
+ * malformed stream frames, which are raw model output. Console breadcrumbs are
+ * also off at the integration level — this is the second lock.
+ */
+export function scrubBreadcrumb<T extends Breadcrumb>(crumb: T): T | null {
+  const category = crumb.category ?? ""
+  if (!ALLOWED_BREADCRUMB_CATEGORIES.has(category)) return null
+
+  if (typeof crumb.message === "string") {
+    crumb.message = clean(crumb.message)
+  }
+
+  if (crumb.data) {
+    for (const key of Object.keys(crumb.data)) {
+      if (!ALLOWED_BREADCRUMB_DATA_KEYS.has(key)) {
+        delete crumb.data[key]
+        continue
+      }
+      const value = crumb.data[key]
+      if (typeof value === "string") {
+        crumb.data[key] = key === "url" ? scrubUrl(value) : redactSecrets(value)
+      }
+    }
+  }
+
+  return crumb
+}
+
+/**
+ * The `beforeSend` and `beforeSendTransaction` body. The generic is what lets
+ * one function serve both hooks without a cast: it instantiates as `ErrorEvent`
+ * for the first and `TransactionEvent` for the second.
+ *
+ * Mutates in place and returns the same reference.
+ */
+export function scrubEvent<T extends SentryEvent>(event: T): T {
+  // Anonymous mode. `dataCollection` should already prevent these, but a
+  // future SDK default must not be able to turn them back on.
+  delete event.user
+  delete event.server_name
+  delete event.extra
+
+  if (event.contexts) {
+    // Locale and timezone are fingerprinting surface.
+    delete event.contexts.culture
+  }
+
+  if (event.request) {
+    delete event.request.cookies
+    delete event.request.headers
+    delete event.request.data
+    delete event.request.query_string
+    delete event.request.env
+    if (event.request.url) {
+      event.request.url = scrubUrl(event.request.url)
+    }
+  }
+
+  if (event.transaction) {
+    event.transaction = scrubUrl(event.transaction)
+  }
+
+  if (event.message) {
+    event.message = clean(event.message)
+  }
+
+  for (const exception of event.exception?.values ?? []) {
+    if (exception.value) {
+      exception.value = clean(exception.value)
+    }
+    const stacktrace = exception.stacktrace
+    if (stacktrace?.frames) {
+      for (const frame of stacktrace.frames) {
+        // Local variables can hold the pasted trace or the API key.
+        delete frame.vars
+      }
+      stacktrace.frames = stacktrace.frames.filter(
+        (frame) => !isExtensionFrame(frame.filename ?? frame.abs_path)
+      )
+    }
+  }
+
+  if (event.breadcrumbs) {
+    event.breadcrumbs = event.breadcrumbs
+      .map((crumb) => scrubBreadcrumb(crumb))
+      .filter((crumb) => crumb !== null)
+  }
+
+  for (const span of event.spans ?? []) {
+    if (span.description) {
+      span.description = scrubUrl(span.description)
+    }
+  }
+
+  return event
+}
diff --git a/src/router.tsx b/src/router.tsx
index d4968b9..2be95a7 100644
--- a/src/router.tsx
+++ b/src/router.tsx
@@ -1,5 +1,8 @@
+import { captureException } from "@sentry/core"
 import { createRouter as createTanStackRouter } from "@tanstack/react-router"
 
+import { initBrowserSentry } from "@/lib/sentry/browser"
+
 import { routeTree } from "./routeTree.gen"
 
 export function getRouter() {
@@ -10,8 +13,28 @@ export function getRouter() {
     // Replaces React's <ViewTransition> from the old root layout. See the
     // `.ew-vt-main` rule and the ::view-transition selectors in globals.css.
     defaultViewTransition: true,
+    // Fires from the router's CatchBoundary `componentDidCatch`, which is what
+    // renders `AppError`. `captureException` comes from `@sentry/core` rather
+    // than `@sentry/react` so this import does not pull the browser SDK into
+    // the Worker bundle.
+    defaultOnCatch: (error, errorInfo) => {
+      captureException(error, {
+        mechanism: { type: "tanstack-router", handled: true },
+        // Scope data has to travel under `captureContext`: the hint type
+        // rejects a mix of `EventHint` and scope fields at the top level.
+        captureContext: {
+          contexts: { react: { componentStack: errorInfo.componentStack } },
+        },
+      })
+    },
   })
 
+  // Sentry initializes here rather than in `client.tsx` because the TanStack
+  // router integration needs the instance. `@sentry/react` is `sideEffects:
+  // false` and `import.meta.env.SSR` is a build-time literal, so the Worker
+  // build drops the browser SDK entirely.
+  if (!import.meta.env.SSR) initBrowserSentry(router)
+
   return router
 }
 
diff --git a/src/server.ts b/src/server.ts
index d365908..80433cb 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -1,14 +1,41 @@
+import { withSentry } from "@sentry/cloudflare"
 import handler, { createServerEntry } from "@tanstack/react-start/server-entry"
 import type { ServerEntry } from "@tanstack/react-start/server-entry"
 
+import { workerSentryOptions } from "@/lib/sentry/options"
+
 /**
- * Worker entry. It only forwards to the TanStack Start handler.
+ * Worker entry. It forwards to the TanStack Start handler, wrapped so Sentry
+ * sees every request.
  *
  * `wrangler.jsonc` points `main` here rather than straight at
- * `@tanstack/react-start/server-entry`, so there is one place to wrap the
- * handler when the app needs request middleware or error reporting.
+ * `@tanstack/react-start/server-entry`, which is what makes the wrapping
+ * possible.
  */
-const fetch: ServerEntry["fetch"] = (request, opts) =>
-  handler.fetch(request, opts)
+const fetch: ServerEntry["fetch"] = (request) => handler.fetch(request)
+
+const entry = createServerEntry({ fetch })
 
-export default createServerEntry({ fetch })
+/**
+ * Two details make this typecheck with no cast:
+ *
+ * 1. The options callback takes no argument. `withSentry` infers `Env` from it,
+ *    and `Env` defaults to the `cloudflare:workers` env type, which does not
+ *    exist in CI — `worker-configuration.d.ts` is gitignored. A zero-argument
+ *    callback is assignable for any `Env`, so nothing needs inferring. The DSN
+ *    lives in code, so there is nothing to read from `env` anyway.
+ * 2. `fetch` declares one parameter. Cloudflare calls `fetch(request, env, ctx)`
+ *    while the Start entry takes `(request, opts)`, and `env` is not assignable
+ *    to the all-optional `RequestOptions`. TypeScript never compares parameters
+ *    a function does not declare.
+ *
+ * Nothing changes at runtime. `withSentry` replaces `fetch` with a proxy that
+ * reads `(request, env, ctx)` off its own arguments for the options callback and
+ * for `ctx.waitUntil(flush)`, then applies the original. Dropping `opts` is
+ * safer than passing `env` into it, which is what this file used to do — every
+ * `RequestOptions` field was absent, so it was a no-op that would have collided
+ * had a binding ever been named `context`.
+ */
+export default withSentry(() => workerSentryOptions, {
+  fetch: (request: Request) => entry.fetch(request),
+})
diff --git a/src/start.ts b/src/start.ts
new file mode 100644
index 0000000..68f44d5
--- /dev/null
+++ b/src/start.ts
@@ -0,0 +1,44 @@
+import { captureException } from "@sentry/core"
+import { createMiddleware, createStart } from "@tanstack/react-start"
+
+import { SENTRY_TUNNEL_PATH } from "@/lib/sentry/constants"
+
+/**
+ * Global request middleware. TanStack Start discovers this file by name — there
+ * is no config entry for it.
+ *
+ * It reports server-function throws and anything else that escapes a request
+ * handler. The Worker `fetch` wrapper in `src/server.ts` catches what escapes
+ * further still, and `defaultOnCatch` in `src/router.tsx` catches React render
+ * errors in the browser. The three layers together are the coverage.
+ *
+ * `captureException` comes from `@sentry/core`, never `@sentry/cloudflare`.
+ * This file is bundled into both the browser and the Worker, and
+ * `@sentry/cloudflare` pulls in `node:async_hooks` and `cloudflare:workers`,
+ * which would break the browser build. The core helper resolves whichever
+ * client is on the current scope, so the same code reports through the
+ * Cloudflare client on the server and the browser client on the client.
+ */
+const sentryRequestMiddleware = createMiddleware({ type: "request" }).server(
+  async ({ next, pathname, handlerType }) => {
+    // The tunnel reports its own failures through the Worker wrapper. Catching
+    // them here too would file the same error twice under different tags.
+    if (pathname.startsWith(SENTRY_TUNNEL_PATH)) return next()
+
+    try {
+      return await next()
+    } catch (error) {
+      captureException(error, {
+        mechanism: { type: "tanstack-start.request", handled: false },
+        // Tags have to travel under `captureContext`: the hint type rejects a
+        // mix of `EventHint` and scope fields at the top level.
+        captureContext: { tags: { handler_type: handlerType } },
+      })
+      throw error
+    }
+  }
+)
+
+export const startInstance = createStart(() => ({
+  requestMiddleware: [sentryRequestMiddleware],
+}))

From 902d88a5b72cbcb2dff8a4b3cb7a2fcfe0ea5b37 Mon Sep 17 00:00:00 2001
From: Slate Rehm <slaterehm@pm.me>
Date: Thu, 30 Jul 2026 23:05:47 -0500
Subject: [PATCH 3/6] feat: proxy Sentry envelopes through /wdyd

The browser posts reports to this site instead of to Sentry, so an ad
blocker sees a first-party request to a path it does not recognise. The
Worker forwards them, which also means Sentry receives the report from
Cloudflare and never sees a visitor IP.

handleTunnelRequest validates each envelope's DSN against an allowlist.
That is the only thing keeping this from being an open relay into
somebody else's Sentry project.

Every method except POST answers 405. Without those handlers the router
falls through to the SPA shell and serves the whole app as HTML with a
200, which robots.txt (Allow: /) then invites crawlers to index.

Four guards keep the tunnel out of its own telemetry. The Worker SDK
sets no tunnel, so it posts to Sentry directly and an error thrown while
handling a tunnel request cannot tunnel itself. The traces sampler
returns 0 for the path, ignoreTransactions repeats that behind it, and
the request middleware skips the path so the error is not filed twice.
---
 src/routeTree.gen.ts | 35 +++++++++++++++++++++---
 src/routes/wdyd.ts   | 64 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 95 insertions(+), 4 deletions(-)
 create mode 100644 src/routes/wdyd.ts

diff --git a/src/routeTree.gen.ts b/src/routeTree.gen.ts
index 93f70cf..bf4506e 100644
--- a/src/routeTree.gen.ts
+++ b/src/routeTree.gen.ts
@@ -14,6 +14,7 @@ import { Route as HuntRouteImport } from './routes/hunt'
 import { Route as PrivacyRouteImport } from './routes/privacy'
 import { Route as RobotsDottxtRouteImport } from './routes/robots[.]txt'
 import { Route as SitemapDotxmlRouteImport } from './routes/sitemap[.]xml'
+import { Route as WdydRouteImport } from './routes/wdyd'
 
 const IndexRoute = IndexRouteImport.update({
   id: '/',
@@ -40,6 +41,11 @@ const SitemapDotxmlRoute = SitemapDotxmlRouteImport.update({
   path: '/sitemap.xml',
   getParentRoute: () => rootRouteImport,
 } as any)
+const WdydRoute = WdydRouteImport.update({
+  id: '/wdyd',
+  path: '/wdyd',
+  getParentRoute: () => rootRouteImport,
+} as any)
 
 export interface FileRoutesByFullPath {
   '/': typeof IndexRoute
@@ -47,6 +53,7 @@ export interface FileRoutesByFullPath {
   '/privacy': typeof PrivacyRoute
   '/robots.txt': typeof RobotsDottxtRoute
   '/sitemap.xml': typeof SitemapDotxmlRoute
+  '/wdyd': typeof WdydRoute
 }
 export interface FileRoutesByTo {
   '/': typeof IndexRoute
@@ -54,6 +61,7 @@ export interface FileRoutesByTo {
   '/privacy': typeof PrivacyRoute
   '/robots.txt': typeof RobotsDottxtRoute
   '/sitemap.xml': typeof SitemapDotxmlRoute
+  '/wdyd': typeof WdydRoute
 }
 export interface FileRoutesById {
   __root__: typeof rootRouteImport
@@ -62,13 +70,22 @@ export interface FileRoutesById {
   '/privacy': typeof PrivacyRoute
   '/robots.txt': typeof RobotsDottxtRoute
   '/sitemap.xml': typeof SitemapDotxmlRoute
+  '/wdyd': typeof WdydRoute
 }
 export interface FileRouteTypes {
   fileRoutesByFullPath: FileRoutesByFullPath
-  fullPaths: '/' | '/hunt' | '/privacy' | '/robots.txt' | '/sitemap.xml'
+  fullPaths:
+    '/' | '/hunt' | '/privacy' | '/robots.txt' | '/sitemap.xml' | '/wdyd'
   fileRoutesByTo: FileRoutesByTo
-  to: '/' | '/hunt' | '/privacy' | '/robots.txt' | '/sitemap.xml'
-  id: '__root__' | '/' | '/hunt' | '/privacy' | '/robots.txt' | '/sitemap.xml'
+  to: '/' | '/hunt' | '/privacy' | '/robots.txt' | '/sitemap.xml' | '/wdyd'
+  id:
+    | '__root__'
+    | '/'
+    | '/hunt'
+    | '/privacy'
+    | '/robots.txt'
+    | '/sitemap.xml'
+    | '/wdyd'
   fileRoutesById: FileRoutesById
 }
 export interface RootRouteChildren {
@@ -77,6 +94,7 @@ export interface RootRouteChildren {
   PrivacyRoute: typeof PrivacyRoute
   RobotsDottxtRoute: typeof RobotsDottxtRoute
   SitemapDotxmlRoute: typeof SitemapDotxmlRoute
+  WdydRoute: typeof WdydRoute
 }
 
 declare module '@tanstack/react-router' {
@@ -116,6 +134,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof SitemapDotxmlRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/wdyd': {
+      id: '/wdyd'
+      path: '/wdyd'
+      fullPath: '/wdyd'
+      preLoaderRoute: typeof WdydRouteImport
+      parentRoute: typeof rootRouteImport
+    }
   }
 }
 
@@ -125,16 +150,18 @@ const rootRouteChildren: RootRouteChildren = {
   PrivacyRoute: PrivacyRoute,
   RobotsDottxtRoute: RobotsDottxtRoute,
   SitemapDotxmlRoute: SitemapDotxmlRoute,
+  WdydRoute: WdydRoute,
 }
 export const routeTree = rootRouteImport
   ._addFileChildren(rootRouteChildren)
   ._addFileTypes<FileRouteTypes>()
 
 import type { getRouter } from './router.tsx'
-import type { createStart } from '@tanstack/react-start'
+import type { startInstance } from './start.ts'
 declare module '@tanstack/react-start' {
   interface Register {
     ssr: true
     router: Awaited<ReturnType<typeof getRouter>>
+    config: Awaited<ReturnType<typeof startInstance.getOptions>>
   }
 }
diff --git a/src/routes/wdyd.ts b/src/routes/wdyd.ts
new file mode 100644
index 0000000..1307fc2
--- /dev/null
+++ b/src/routes/wdyd.ts
@@ -0,0 +1,64 @@
+import { handleTunnelRequest } from "@sentry/core"
+import { createFileRoute } from "@tanstack/react-router"
+
+import { SENTRY_DSN } from "@/lib/sentry/constants"
+
+/**
+ * Sentry envelope proxy. The browser SDK posts here instead of posting to
+ * `ingest.us.sentry.io`, so an ad blocker sees a first-party request to a path
+ * it does not recognize. The Worker then forwards the envelope.
+ *
+ * A side effect worth keeping: because the Worker re-issues the request, Sentry
+ * receives it from Cloudflare and never sees a visitor IP.
+ *
+ * `handleTunnelRequest` validates the envelope header against `allowedDsns`, so
+ * this cannot be used as an open relay to some other Sentry project.
+ */
+
+/** Envelopes are a few KB. This only bounds abuse. */
+const MAX_ENVELOPE_BYTES = 512_000
+
+/**
+ * Anything other than POST. Without these the router has no handler for the
+ * method, falls through to the SPA shell, and answers `GET /wdyd` with 200 and
+ * the full app HTML — a phantom page that `robots.txt` (`Allow: /`) invites
+ * crawlers to index.
+ */
+const methodNotAllowed = () =>
+  new Response("Method not allowed", {
+    status: 405,
+    headers: { allow: "POST", "cache-control": "no-store" },
+  })
+
+export const Route = createFileRoute("/wdyd")({
+  server: {
+    handlers: {
+      GET: methodNotAllowed,
+      HEAD: methodNotAllowed,
+      PUT: methodNotAllowed,
+      PATCH: methodNotAllowed,
+      DELETE: methodNotAllowed,
+      OPTIONS: methodNotAllowed,
+      POST: async ({ request }) => {
+        const declaredLength = Number(
+          request.headers.get("content-length") ?? 0
+        )
+        if (declaredLength > MAX_ENVELOPE_BYTES) {
+          return new Response("Payload too large", { status: 413 })
+        }
+
+        const upstream = await handleTunnelRequest({
+          request,
+          allowedDsns: [SENTRY_DSN],
+        })
+
+        const headers = new Headers(upstream.headers)
+        headers.set("cache-control", "no-store")
+        return new Response(upstream.body, {
+          status: upstream.status,
+          headers,
+        })
+      },
+    },
+  },
+})

From 56ec840b2cdc2578e15762295d15637b7f635e0a Mon Sep 17 00:00:00 2001
From: Slate Rehm <slaterehm@pm.me>
Date: Thu, 30 Jul 2026 23:05:53 -0500
Subject: [PATCH 4/6] docs: describe anonymous crash reporting

The privacy page claimed no telemetry of any kind and no error tracking,
and the hunt panel said nothing about your visit leaves your browser.
Both are false now, so both are rewritten. The new section states what a
report contains, what it never contains, and why the proxy hides the
visitor IP.

AGENTS.md records the pieces that are easy to break by accident: the
tunnel path is compiled into browser bundles already in the wild, the
405 handlers stop the SPA shell from serving /wdyd as an indexable page,
and the untyped shape of src/server.ts is what keeps CI and a local
typecheck in agreement.
---
 AGENTS.md                        | 49 +++++++++++++++++++++++++++-----
 README.md                        | 16 +++++++++++
 src/routes/-hunt/hunt-client.tsx | 12 ++++++--
 src/routes/privacy.tsx           | 39 +++++++++++++++++++++----
 4 files changed, 102 insertions(+), 14 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 52872ec..408469f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -47,6 +47,7 @@ that way.
 | **Lint**              | **Oxlint** (`.oxlintrc.json`): TypeScript and React rules, **`--type-aware`** through **`oxlint-tsgolint`** |
 | **Format**            | **Oxfmt** (`.oxfmtrc.json`): Prettier-compatible options plus **`sortTailwindcss`**                         |
 | **Test**              | **Vitest** (`vitest.config.ts`), unit tests beside the sources in `src/lib/`                                |
+| **Error monitoring**  | **@sentry/react** (browser), **@sentry/cloudflare** (Worker), **@sentry/core** (tunnel), proxied at `/wdyd` |
 
 **Module system:** ESM. `package.json` sets `"type": "module"`.
 
@@ -59,12 +60,19 @@ that way.
   estimation, cost models, and token estimation. No framework imports.
 - **`src/lib/server/`** — the only server-side modules. They adapt the TanStack
   request helpers to the framework-free helpers in `src/lib/`.
+- **`src/lib/sentry/`** — the DSN, org, project, tunnel path, option objects,
+  and the scrubber. Only `browser.ts` imports a Sentry SDK at runtime, and it is
+  browser-only. Everywhere else the SDK imports are type-only.
 - **`src/components/`** — shared UI. `ui/` holds the shadcn primitives.
 - **`src/hooks/`** — shared hooks.
 - **`src/assets/`** — images that the build processes. Files in `public/` ship
   as-is, so do not put a large source image there.
 - **`src/client.tsx`**, **`src/router.tsx`**, **`src/server.ts`** — the browser
   entry, the router factory, and the Worker entry.
+- **`src/start.ts`** — global request middleware, discovered by file name. It is
+  bundled into **both** the browser and the Worker, so it must never import
+  `@sentry/cloudflare`, which pulls in `node:async_hooks` and
+  `cloudflare:workers`. Use the isomorphic helpers from `@sentry/core`.
 
 Colocate by feature as the app grows. Keep route-local UI under `src/routes/`
 with a `-` prefix.
@@ -78,12 +86,19 @@ with a `-` prefix.
 | `/privacy`     | `src/routes/privacy.tsx`      |                                            |
 | `/robots.txt`  | `src/routes/robots[.]txt.ts`  | Square brackets escape the dot in a path.  |
 | `/sitemap.xml` | `src/routes/sitemap[.]xml.ts` |                                            |
+| `/wdyd`        | `src/routes/wdyd.ts`          | Sentry envelope proxy. POST only.          |
 
-Do not change these URLs. The consent flow and the sitemap reference them.
+Do not change these URLs. The consent flow and the sitemap reference them, and
+the tunnel path is compiled into every browser bundle already in the wild —
+renaming it silently stops crash reports from older tabs.
+
+`/wdyd` answers every method except POST with 405. Without those handlers the
+router falls through to the SPA shell and serves the whole app as HTML with a
+200, which `robots.txt` (`Allow: /`) then invites crawlers to index.
 
 ## Server touchpoints
 
-There are three. Handle each with care.
+There are four. Handle each with care.
 
 1. `src/lib/server/consent.ts` sets the consent cookie. The home route then
    navigates to /hunt. The cookie attributes must not change.
@@ -94,8 +109,17 @@ There are three. Handle each with care.
 2. `src/routes/hunt.tsx` reads the consent cookie and the OpenRouter key cookie
    in a server function. It must keep the legacy cookie names. If you drop them,
    existing users lose their consent.
-3. `src/server.ts` wraps the TanStack Start server entry. It adds nothing
-   today. It exists so request middleware or error reporting has one home.
+3. `src/server.ts` wraps the TanStack Start server entry with
+   `withSentry`. Its `fetch` deliberately declares one parameter and its options
+   callback deliberately takes none. Both are what let it typecheck with no
+   cast: `Env` never has to resolve, which matters because
+   `worker-configuration.d.ts` is gitignored and absent in CI. Annotating it
+   with `ExportedHandler` or `Env` breaks CI only, never a local typecheck.
+4. `src/routes/wdyd.ts` forwards Sentry envelopes. `handleTunnelRequest`
+   validates each envelope's DSN against an allowlist, which is the only thing
+   stopping it from being an open relay into somebody else's Sentry project.
+   The Worker SDK must never set `tunnel`: it posts to Sentry directly, so an
+   error thrown while handling a tunnel request cannot tunnel itself.
 
 ## UI
 
@@ -187,9 +211,14 @@ login`.
 
 Vite inlines every `VITE_*` variable into both bundles at build time.
 
-| Name            | Where | Purpose                                        |
-| --------------- | ----- | ---------------------------------------------- |
-| `VITE_SITE_URL` | Build | Canonical origin for metadata and the sitemap. |
+| Name                | Where | Purpose                                        |
+| ------------------- | ----- | ---------------------------------------------- |
+| `VITE_SITE_URL`     | Build | Canonical origin for metadata and the sitemap. |
+| `SENTRY_AUTH_TOKEN` | Build | Uploads source maps. Optional.                 |
+
+`SENTRY_AUTH_TOKEN` is the only Sentry secret. The DSN, the org, and the project
+are public by design and live in `src/lib/sentry/constants.ts`. Without the
+token the Vite plugin disables itself and the build still succeeds.
 
 Vite inlines a `VITE_*` value into the browser bundle, so never put a secret in
 one. **The repo is public.**
@@ -220,6 +249,12 @@ endpoint fetching, preprocessing, the OpenRouter client, recent results, and run
 deadlines. Keep them passing. If a test needs a change, change its framework
 assumptions and never the expected behavior.
 
+`src/lib/sentry/scrub.test.ts` and `src/lib/sentry/options.test.ts` are a
+different kind of test. They assert the privacy contract: no user info, no
+cookies, no headers, no bodies, no console breadcrumbs, and API keys redacted
+out of every message. A failure there is a live data leak, not a style problem.
+Do not weaken an assertion to make a change pass.
+
 ## Git
 
 Use standard git workflows. This repo defines no mandatory commit-message
diff --git a/README.md b/README.md
index a9ef214..98f0f7e 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,18 @@ Error Wolf is a small, open-source web app that shrinks noisy console logs and s
 
 All OpenRouter traffic is initiated from your browser. If verification, rankings, or completions cannot reach OpenRouter (network, DNS, or blocked IP), the app surfaces that as a client-side error. This project does not expose internal proxy routes for OpenRouter.
 
+### Anonymous crash reporting
+
+The app sends crash reports to Sentry. Reports carry no account, no cookies, no
+request headers, no request bodies, and no console output. Your OpenRouter key
+and the text you paste never leave the browser: messages are scrubbed for
+key-shaped strings and truncated first.
+
+The browser posts reports to `/wdyd` on this site, and the Worker forwards them.
+No third-party script loads in the page, and Sentry sees the report arrive from
+Cloudflare rather than from your IP address. Details are on the
+[privacy page](https://errorwolf.dev/privacy).
+
 ## Feedback and issues
 
 Suggestions, product feedback, and bug reports are welcome. Please **[open a GitHub issue](https://github.com/slate-rehm/error-wolf/issues/new)** so we can track them in one place.
@@ -38,6 +50,10 @@ Actions and no Cloudflare API token in the repo.
 Vite inlines it at build time, so a value set only in GitHub Actions never
 reaches the deployed bundle.
 
+`SENTRY_AUTH_TOKEN` is optional. Set it as a secret build variable in the same
+place to upload source maps, which makes stack traces in Sentry readable. The
+build succeeds without it.
+
 ## License
 
 Licensed under the [O'Saasy License](./LICENSE.md). You may use, modify, and distribute the software broadly, but you may not offer it to third parties as a hosted SaaS or cloud service whose primary value is the software itself (see the license for the exact terms).
diff --git a/src/routes/-hunt/hunt-client.tsx b/src/routes/-hunt/hunt-client.tsx
index 5d4af78..15a48ac 100644
--- a/src/routes/-hunt/hunt-client.tsx
+++ b/src/routes/-hunt/hunt-client.tsx
@@ -5,6 +5,7 @@ import {
   ThumbsUpIcon,
 } from "@hugeicons/core-free-icons"
 import { HugeiconsIcon } from "@hugeicons/react"
+import { Link } from "@tanstack/react-router"
 
 import { Button } from "@/components/ui/button"
 import { ButtonGroup } from "@/components/ui/button-group"
@@ -603,8 +604,15 @@ function KeyStep({
             (and their providers). We do not collect your key, input, or output.
           </p>
           <p className="font-mono text-sm leading-snug text-pretty text-foreground max-sm:text-base md:text-xs">
-            We run no analytics and no error tracking. Nothing about your visit
-            leaves your browser.
+            We run no analytics. If the app crashes it sends an anonymous crash
+            report with no key, no input, and no IP address. See our{" "}
+            <Link
+              to="/privacy"
+              className="underline underline-offset-2 hover:text-primary"
+            >
+              privacy page
+            </Link>
+            .
           </p>
           <p className="font-mono text-sm leading-snug text-pretty text-foreground max-sm:text-base md:text-xs">
             This site is open source under the O&apos;Saasy License. You can
diff --git a/src/routes/privacy.tsx b/src/routes/privacy.tsx
index 3fc3327..7455d95 100644
--- a/src/routes/privacy.tsx
+++ b/src/routes/privacy.tsx
@@ -34,8 +34,9 @@ function PrivacyPage() {
           <p className="text-foreground">
             error-wolf runs entirely in your browser. Stack normalization,
             compression, and model calls happen client-side. No accounts. No
-            server-side storage of your input or results. We collect no
-            analytics and no telemetry of any kind.
+            server-side storage of your input or results. We run no product
+            analytics and no ad trackers. We do collect anonymous crash reports,
+            described below.
           </p>
 
           <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
@@ -66,15 +67,43 @@ function PrivacyPage() {
             your key, consent, and all history in one step.
           </p>
 
+          <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
+            Crash reporting
+          </h3>
+          <p>
+            When the app breaks, it sends a crash report to Sentry so we can fix
+            the bug. There are no accounts, no profiles, and no identifiers that
+            follow you between visits.
+          </p>
+          <p className="mt-4">
+            A report contains the error type and message, a stack trace, the
+            page path, your browser and OS version, and the app release.
+          </p>
+          <p className="mt-4">
+            A report never contains your OpenRouter key, the traces or logs you
+            paste, your results, cookies, request headers, request bodies, or
+            console output. Messages are scrubbed for key-shaped strings and
+            truncated before they are sent.
+          </p>
+          <p className="mt-4">
+            Your browser posts the report to this site, not to Sentry, and our
+            server forwards it. Two things follow: no third-party script runs on
+            the page, and Sentry sees the report arrive from Cloudflare instead
+            of from your IP address.
+          </p>
+          <p className="mt-4">
+            There is no session recording. We count crash-free visits, which
+            uses a number that exists only for that page view and is never
+            stored.
+          </p>
+
           <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
             Consent
           </h3>
           <p>
             When you use the initialize flow on the home page, your consent is
             stored as a first-party cookie for that experience. That cookie is
-            the only thing it does. We run no analytics product, no error
-            tracking, and no third-party scripts, so nothing about your visit
-            leaves your browser.
+            the only thing it does.
           </p>
 
           <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">

From 918545704177840cf7064686c1d3411c2857454c Mon Sep 17 00:00:00 2001
From: Slate Rehm <slaterehm@pm.me>
Date: Fri, 31 Jul 2026 00:08:15 -0500
Subject: [PATCH 5/6] docs: separate our errors from the errors you paste in

This app exists to process error traces, so "we collect crash reports"
reads as "we collect the traces you paste" unless the two are pulled
apart explicitly. Lead with the distinction instead of burying it in a
list of what a report excludes.

Also corrects a claim that results travel to OpenRouter. Input goes out,
results come back, and they stay in localStorage.
---
 README.md                        | 12 ++++++---
 src/routes/-hunt/hunt-client.tsx |  5 ++--
 src/routes/privacy.tsx           | 44 ++++++++++++++++++++++++--------
 3 files changed, 45 insertions(+), 16 deletions(-)

diff --git a/README.md b/README.md
index 98f0f7e..88c0e68 100644
--- a/README.md
+++ b/README.md
@@ -10,10 +10,14 @@ All OpenRouter traffic is initiated from your browser. If verification, rankings
 
 ### Anonymous crash reporting
 
-The app sends crash reports to Sentry. Reports carry no account, no cookies, no
-request headers, no request bodies, and no console output. Your OpenRouter key
-and the text you paste never leave the browser: messages are scrubbed for
-key-shaped strings and truncated first.
+We track bugs in this website, meaning errors that Error Wolf itself throws.
+That is not the same as the errors you paste in. Your traces, your logs, and
+your results are never uploaded and never reach Sentry.
+
+Crash reports carry no account, no cookies, no request headers, no request
+bodies, and no console output. Your OpenRouter key and the text you paste never
+leave the browser: messages are scrubbed for key-shaped strings and truncated
+first.
 
 The browser posts reports to `/wdyd` on this site, and the Worker forwards them.
 No third-party script loads in the page, and Sentry sees the report arrive from
diff --git a/src/routes/-hunt/hunt-client.tsx b/src/routes/-hunt/hunt-client.tsx
index 15a48ac..8131643 100644
--- a/src/routes/-hunt/hunt-client.tsx
+++ b/src/routes/-hunt/hunt-client.tsx
@@ -604,8 +604,9 @@ function KeyStep({
             (and their providers). We do not collect your key, input, or output.
           </p>
           <p className="font-mono text-sm leading-snug text-pretty text-foreground max-sm:text-base md:text-xs">
-            We run no analytics. If the app crashes it sends an anonymous crash
-            report with no key, no input, and no IP address. See our{" "}
+            We run no analytics. We do track bugs in this site, meaning errors
+            error-wolf itself throws, never the errors you paste in. A crash
+            report carries no key, no input, and no IP address. See our{" "}
             <Link
               to="/privacy"
               className="underline underline-offset-2 hover:text-primary"
diff --git a/src/routes/privacy.tsx b/src/routes/privacy.tsx
index 7455d95..e57f3c5 100644
--- a/src/routes/privacy.tsx
+++ b/src/routes/privacy.tsx
@@ -35,8 +35,13 @@ function PrivacyPage() {
             error-wolf runs entirely in your browser. Stack normalization,
             compression, and model calls happen client-side. No accounts. No
             server-side storage of your input or results. We run no product
-            analytics and no ad trackers. We do collect anonymous crash reports,
-            described below.
+            analytics and no ad trackers.
+          </p>
+          <p className="mt-4 text-foreground">
+            We do track bugs in this website, so we can fix them. That means
+            errors thrown by error-wolf itself. It does not mean the errors you
+            paste in. Your traces and logs are your data, and they stay in your
+            browser.
           </p>
 
           <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
@@ -68,22 +73,41 @@ function PrivacyPage() {
           </p>
 
           <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
-            Crash reporting
+            Our errors, not yours
           </h3>
           <p>
-            When the app breaks, it sends a crash report to Sentry so we can fix
-            the bug. There are no accounts, no profiles, and no identifiers that
-            follow you between visits.
+            This app exists to process error traces, so this distinction matters
+            more here than on most sites.
           </p>
           <p className="mt-4">
-            A report contains the error type and message, a stack trace, the
-            page path, your browser and OS version, and the app release.
+            <span className="text-foreground">
+              The errors you paste in are your data.
+            </span>{" "}
+            They never reach our servers and never reach Sentry. They go from
+            your browser straight to OpenRouter, and the results come back the
+            same way, into this browser and nowhere else.
+          </p>
+          <p className="mt-4">
+            <span className="text-foreground">
+              The errors error-wolf itself throws are our bugs.
+            </span>{" "}
+            When the app breaks, it sends a crash report to Sentry so we can fix
+            it. That report is about our broken code, not about your input.
+          </p>
+
+          <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
+            What a crash report contains
+          </h3>
+          <p>
+            The error type and message, a stack trace through our code, the page
+            path, your browser and OS version, and the app release. No accounts,
+            no profiles, and no identifier that follows you between visits.
           </p>
           <p className="mt-4">
             A report never contains your OpenRouter key, the traces or logs you
             paste, your results, cookies, request headers, request bodies, or
-            console output. Messages are scrubbed for key-shaped strings and
-            truncated before they are sent.
+            console output. Before a report is sent, messages are scrubbed for
+            key-shaped strings and truncated.
           </p>
           <p className="mt-4">
             Your browser posts the report to this site, not to Sentry, and our

From 315b9c193bd847d020a3f995ed0f46b526afa660 Mon Sep 17 00:00:00 2001
From: Slate Rehm <slaterehm@pm.me>
Date: Fri, 31 Jul 2026 21:52:48 -0500
Subject: [PATCH 6/6] update privacy page for clarity.

---
 README.md              | 48 ++++++++++-----------
 src/routes/privacy.tsx | 95 ++++++++++++++----------------------------
 2 files changed, 53 insertions(+), 90 deletions(-)

diff --git a/README.md b/README.md
index 88c0e68..840ff29 100644
--- a/README.md
+++ b/README.md
@@ -2,61 +2,57 @@
 
 **Use the app:** [errorwolf.dev](https://errorwolf.dev)
 
-Error Wolf is a small, open-source web app that shrinks noisy console logs and stack traces before you paste them into bigger models to save $$$.
+Error Wolf is an open-source web app that compresses noisy console logs and
+stack traces before you send them to larger models.
 
-### OpenRouter from the browser only
+## Privacy
 
-All OpenRouter traffic is initiated from your browser. If verification, rankings, or completions cannot reach OpenRouter (network, DNS, or blocked IP), the app surfaces that as a client-side error. This project does not expose internal proxy routes for OpenRouter.
+The browser sends all OpenRouter requests directly to OpenRouter. Error Wolf
+does not proxy or store your OpenRouter key, input, or results. The server only
+checks whether a key exists for the hunt page.
 
-### Anonymous crash reporting
+The app sends anonymous crash reports when Error Wolf itself fails. Reports do
+not include user data, cookies, request data, or console output. The app removes
+key-shaped strings and limits error text before it sends a report.
 
-We track bugs in this website, meaning errors that Error Wolf itself throws.
-That is not the same as the errors you paste in. Your traces, your logs, and
-your results are never uploaded and never reach Sentry.
+The browser keeps up to 1,024 recent runs for 30 days. It stores this history
+in localStorage. The privacy page contains the full details.
 
-Crash reports carry no account, no cookies, no request headers, no request
-bodies, and no console output. Your OpenRouter key and the text you paste never
-leave the browser: messages are scrubbed for key-shaped strings and truncated
-first.
-
-The browser posts reports to `/wdyd` on this site, and the Worker forwards them.
-No third-party script loads in the page, and Sentry sees the report arrive from
-Cloudflare rather than from your IP address. Details are on the
-[privacy page](https://errorwolf.dev/privacy).
+Read the [privacy page](https://errorwolf.dev/privacy) for the full policy.
 
 ## Feedback and issues
 
 Suggestions, product feedback, and bug reports are welcome. Please **[open a GitHub issue](https://github.com/slate-rehm/error-wolf/issues/new)** so we can track them in one place.
 
-## Development / Local Run
+## Development
 
-Stack: **pnpm**, **TanStack Start** on **Cloudflare Workers**, **Vite 8**, **React 19**, **TypeScript**, **Tailwind CSS v4**, **shadcn/ui** (Base UI + Hugeicons). Conventions and tooling details live in [AGENTS.md](./AGENTS.md).
+The app uses **pnpm**, **TanStack Start**, **Cloudflare Workers**, **Vite 8**,
+**React 19**, **TypeScript**, **Tailwind CSS v4**, and **shadcn/ui**. See
+[AGENTS.md](./AGENTS.md) for project conventions and commands.
 
 ```bash
 pnpm install
 pnpm dev
 ```
 
-To run against the Workers runtime instead of the Vite dev server:
+To run against the Workers runtime:
 
 ```bash
 pnpm build
 pnpm exec wrangler dev
 ```
 
-## Deploy
+## Deployment
 
 Cloudflare builds and deploys the Worker from this repo through its Git
 integration. A push to `master` ships it. There is no deploy step in GitHub
 Actions and no Cloudflare API token in the repo.
 
-`VITE_SITE_URL` has to be set as a build variable in the Cloudflare project.
-Vite inlines it at build time, so a value set only in GitHub Actions never
-reaches the deployed bundle.
+Set `VITE_SITE_URL` as a build variable in the Cloudflare project. Vite inlines
+this value at build time.
 
-`SENTRY_AUTH_TOKEN` is optional. Set it as a secret build variable in the same
-place to upload source maps, which makes stack traces in Sentry readable. The
-build succeeds without it.
+`SENTRY_AUTH_TOKEN` is optional. Set it as a secret build variable to upload
+source maps. The build succeeds without it.
 
 ## License
 
diff --git a/src/routes/privacy.tsx b/src/routes/privacy.tsx
index e57f3c5..9361a56 100644
--- a/src/routes/privacy.tsx
+++ b/src/routes/privacy.tsx
@@ -4,7 +4,7 @@ import { SITE_HEADER_GITHUB_URL } from "@/components/site-header-constants"
 import { getSiteUrl } from "@/lib/site-url"
 
 const privacyDescription =
-  "error-wolf is local-first. All processing happens in your browser. Your OpenRouter key never touches our servers. Open source and fully auditable."
+  "Error Wolf processes your traces in the browser. Your input and results are not stored on our servers."
 
 export const Route = createFileRoute("/privacy")({
   head: () => ({
@@ -32,33 +32,32 @@ function PrivacyPage() {
 
         <div className="prose prose-sm mt-8 font-mono text-sm text-foreground/90">
           <p className="text-foreground">
-            error-wolf runs entirely in your browser. Stack normalization,
-            compression, and model calls happen client-side. No accounts. No
-            server-side storage of your input or results. We run no product
-            analytics and no ad trackers.
+            Error Wolf processes your traces in your browser. Stack
+            normalization, compression, and model calls run there. We do not use
+            accounts, product analytics, or ad trackers. We do not store your
+            input or results on our servers.
           </p>
           <p className="mt-4 text-foreground">
-            We do track bugs in this website, so we can fix them. That means
-            errors thrown by error-wolf itself. It does not mean the errors you
-            paste in. Your traces and logs are your data, and they stay in your
-            browser.
+            We collect anonymous crash reports for errors thrown by Error Wolf.
+            These reports do not include the traces or logs that you paste in.
           </p>
-
           <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
-            Your Data & OpenRouter key are private
+            Your input and OpenRouter key
           </h3>
           <p>
-            Stored in a same-site cookie. Sent directly from your browser to
-            OpenRouter (and the selected providers). We never proxy your key or
-            see it. If your OpenRouter key allows storage of data (i.e. not
-            ZDR), model providers may store your data. Configure your key with{" "}
+            The app stores your key in a browser cookie. The browser sends the
+            key directly to OpenRouter and the providers that you select. Error
+            Wolf does not proxy or store your key. The server only checks if a
+            key exists for the hunt page. If your key does not use zero data
+            retention (ZDR), a model provider may store your data. Configure
+            your key with{" "}
             <a
               href="https://openrouter.ai/docs/guides/features/zdr"
               target="_blank"
               rel="noreferrer"
               className="text-foreground/85 underline underline-offset-2 hover:text-primary"
             >
-              OpenRouter’s ZDR guide
+              OpenRouter&apos;s ZDR guide
             </a>
             .
           </p>
@@ -67,67 +66,35 @@ function PrivacyPage() {
             Local history
           </h3>
           <p>
-            Up to 1024 recent runs are kept in localStorage. They are pruned
-            automatically after 30 days. The trash icon in the header clears
-            your key, consent, and all history in one step.
+            The browser keeps up to 1,024 recent runs in localStorage. It
+            removes runs after 30 days. The trash icon clears your key, consent,
+            and history from this browser.
           </p>
 
           <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
             Our errors, not yours
           </h3>
-          <p>
-            This app exists to process error traces, so this distinction matters
-            more here than on most sites.
-          </p>
           <p className="mt-4">
             <span className="text-foreground">
-              The errors you paste in are your data.
+              The traces and logs you paste in are your data.
             </span>{" "}
-            They never reach our servers and never reach Sentry. They go from
-            your browser straight to OpenRouter, and the results come back the
-            same way, into this browser and nowhere else.
+            They do not go to Error Wolf servers or Sentry. The browser sends
+            them directly to OpenRouter. The results return to your browser.
           </p>
           <p className="mt-4">
-            <span className="text-foreground">
-              The errors error-wolf itself throws are our bugs.
-            </span>{" "}
-            When the app breaks, it sends a crash report to Sentry so we can fix
-            it. That report is about our broken code, not about your input.
+            <span className="text-foreground">Errors thrown by Error Wolf</span>{" "}
+            When the app breaks, it sends an anonymous crash report to Sentry.
+            The report contains no user, cookie, request, or console data. We
+            remove key-shaped strings and limit error text before the report
+            leaves the browser.
           </p>
-
-          <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
-            What a crash report contains
-          </h3>
-          <p>
-            The error type and message, a stack trace through our code, the page
-            path, your browser and OS version, and the app release. No accounts,
-            no profiles, and no identifier that follows you between visits.
-          </p>
-          <p className="mt-4">
-            A report never contains your OpenRouter key, the traces or logs you
-            paste, your results, cookies, request headers, request bodies, or
-            console output. Before a report is sent, messages are scrubbed for
-            key-shaped strings and truncated.
-          </p>
-          <p className="mt-4">
-            Your browser posts the report to this site, not to Sentry, and our
-            server forwards it. Two things follow: no third-party script runs on
-            the page, and Sentry sees the report arrive from Cloudflare instead
-            of from your IP address.
-          </p>
-          <p className="mt-4">
-            There is no session recording. We count crash-free visits, which
-            uses a number that exists only for that page view and is never
-            stored.
-          </p>
-
           <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
             Consent
           </h3>
           <p>
-            When you use the initialize flow on the home page, your consent is
-            stored as a first-party cookie for that experience. That cookie is
-            the only thing it does.
+            The initialize flow stores your consent in a first-party cookie. The
+            server uses this cookie to allow access to the hunt page. It does
+            not store any other user data.
           </p>
 
           <h3 className="mt-10 font-mono text-xs tracking-wider text-primary uppercase">
@@ -143,8 +110,8 @@ function PrivacyPage() {
             >
               GitHub
             </a>{" "}
-            with an O{"'"}SaaSy license. You can contribute, audit, or fork and
-            run it yourself.
+            under the O{"'"}SaaSy License. You can audit, modify, and run it
+            yourself.
           </p>
         </div>