Add operational telemetry and tighten query and feedback privacy by elpete · Pull Request #56 · coldbox-modules/sentry

elpete · 2026-10-24T16:17:10Z

Summary

Add opt-in operational telemetry for runtime health, request saturation, handler/render timings, dependencies, queues, database pools and delivery diagnostics. Automatic collectors use bounded state, fixed labels, isolated adapter failures, non-overlapping cycles and shutdown cleanup; manual instrumentation preserves application callback results and exceptions.

Preserve PostgreSQL quoted identifiers in query descriptions while redacting values and comments, including cached/query-of-query spans and explicit listener dialects. Private feedback dialogs remain immediately available for text without importing screenshot/replay capture code; query/hash URLs also skip replay imports.

Changes

Configure automatic sampling through automaticCollectors, including one provider-neutral queues list. Providers own queue selection, schema, datasource and query implementation.
Observe explicitly configured WireBox dependency methods with bounded outcomes, duration, retry and circuit labels. Existing instances and objects constructed outside WireBox require manual instrumentation.
Keep ad hoc request phase names available without prior configuration; Server-Timing publication remains separately opt-in.
Retain the JVM timestamp, lowercase trace-context, once-only completion and scope-restoration fixes.
Include the PostgreSQL query privacy follow-up and all changes from Skip capture imports on private feedback screens #57. Preserve the existing commits and the follow-up's module version metadata (2.2.2).

Optional provider setup

Use qb 14.2.0 or later for QueryTelemetryAdapter@qb, and cbq 7.1.0 or later for QueueHealthAdapter@cbq. Neither provider is a Sentry dependency or default.

Enable enableMetrics and configure a valid DSN before automatic collection. Set enableRequestSaturation and/or enableAutomaticRequestTimings for the desired request observations. Query instrumentation uses an explicit provider mapping, complete native hooks, or the manual API; Lucee's listener must be installed explicitly. Keep sentry.endRequest() in application request cleanup for early exits.

Configuration and API details · Query and browser behavior

Review and validation

Combined head: d3062ae23b69f22175f510d9d298dd825931444a.

Source review covered operational collection/lifecycle behavior, provider boundaries, SQL scrubbing, private feedback capture and the intervening PostgreSQL fix. No blocking findings.
Fresh focused TestBox run on prepared BoxLang 1.18.0+66 / Java 21: 86 passed, one optional provider test skipped, zero failures/errors. The tested backend files are identical to the combined head. Delivery checks used the repository's local loopback envelope receiver.
Fresh clean-install browser Vitest run: 33/33 passed. ESM and IIFE builds passed. Rebuilt ESM files match committed code after normalizing chunk filenames; only chunk hashes differed. The worktree was restored clean.
Whitespace checks passed.
Existing hosted Sentry checks were verified green on the earlier a922121 head. Those results predate the PostgreSQL and feedback follow-ups. No new hosted workflow or full engine/browser matrix was requested or dispatched for this consolidation.

Earlier cross-engine and PostgreSQL/cbq verification remains documented in operational-verification.md. This review did not repeat live database/provider tests, fresh installations, process-crash recovery or production profiling. SQL Server execution, Redis/SQS snapshots and real Sentry delivery/indexing remain unverified. Consumer adapters own timeouts, and worker-pool activity must not be counted repeatedly when multiple snapshots share a pool.

Closes #55

github-actions · 2026-10-24T16:18:14Z