Epic Stack catch-up 2/7: Sentry hidden maps + event filters

[cursor]

Parent issue: #23

Parent: search for issue titled “Epic Stack catch-up: tracking”. Depends on package 1/7 being merged to dev (or confirm it is not required; this package does not need the RR CVE bump to compile).

Goal

Fix Sentry client source maps and drop expected healthcheck/bot noise. This site already installed Sentry (p/pat-22-sentry). Do not bump Sentry 9 → 10 here (that is package 6).

Why

1. Broken client maps — vite.config.ts still passes sourcemaps through unstable_sentryVitePluginOptions. That overwrites @sentry/react-router’s sourcemaps.disable: true, double-stamps debug IDs, and Sentry symbolicates the map-less ID. Upstream: epicweb-dev/epic-stack@f64d690 / fix: stop Sentry double debug IDs breaking client source maps epicweb-dev/epic-stack#1095
2. Noise — bots hitting routes without loaders/actions, and healthcheck Prisma spans, clutter Sentry. Upstream: epicweb-dev/epic-stack@f1da831 / fix: filter Epic Stack Sentry healthcheck and bot noise epicweb-dev/epic-stack#1093

This site’s healthcheck already uses prisma.$queryRaw\SELECT 1`` and already skipped the self-HEAD. Do not reintroduce the self-HEAD.

Do this

Branch off origin/dev. PR into dev.

A. Vite / Sentry build config (from epic-stack vite.config.ts)

In vite.config.ts:

• Set build.sourcemap to 'hidden' (maps for Sentry upload, no sourceMappingURL in public assets)
• Keep release on the top-level SentryReactRouterBuildOptions (name: process.env.COMMIT_SHA, setCommits.auto)
• Remove unstable_sentryVitePluginOptions entirely (do not pass sourcemaps through it)
• Keep this site’s localtunnel server.allowedHosts logic (LOCAL_TUNNEL_SUBDOMAIN / LOCAL_TUNNEL_DOMAIN)
• Do not add react-router-devtools or the vitest cache-server stub plugin (later packages)

Reference implementation: https://github.com/epicweb-dev/epic-stack/blob/main/vite.config.ts (copy only the sourcemap + sentryConfig parts)

B. Event filters (from epic-stack)

Add these files from upstream (adapt import paths to this repo’s routes+ layout):

• app/utils/sentry-event-filters.ts
• app/utils/sentry-event-filters.test.ts

Wire shouldDropErrorEvent / isExpectedReactRouterErrorMessage / isHealthcheckTransaction into:

• server/utils/monitoring.ts — ignoreErrors for missing action/loader/method; beforeSend + beforeSendTransaction using the helpers. Upstream also switched PrismaInstrumentation to a named import from @prisma/instrumentation; do that if it typechecks on Sentry 9. If it does not, keep the existing prismaInstrumentation default-import workaround and still add the filters.
• app/entry.server.tsx — use isExpectedReactRouterErrorMessage the same way upstream does in handleError (read current entry.server.tsx and epic-stack’s before editing)

Do not change app/routes/resources+/healthcheck.tsx except if types require a tiny fix. Keep SELECT 1. Do not add the fetch self-HEAD.

Files allowed

• vite.config.ts
• app/utils/sentry-event-filters.ts (new)
• app/utils/sentry-event-filters.test.ts (new)
• server/utils/monitoring.ts
• app/entry.server.tsx
• app/utils/monitoring.client.tsx only if needed to match filter behavior on the client (prefer not)

Do not

• Do not bump @sentry/react-router or @sentry/profiling-node to v10
• Do not remove localtunnel allowedHosts
• Do not add reactRouterDevTools() or change app/routes.ts
• Do not edit dashboard, fly.toml, or Dockerfile
• Do not start other catch-up packages

Acceptance

• sentryConfig has top-level release and no unstable_sentryVitePluginOptions
• build.sourcemap === 'hidden'
• Filter helpers exist and have unit tests that pass
• npm run typecheck and npm run test -- --run pass
• Localtunnel config still present
• PR targets dev

Staging smoke (human)

• Load staging, confirm app boots
• After a deploy with SENTRY_AUTH_TOKEN set, a test client error should map to TS/TSX, not a second debug ID
• Healthcheck traffic should not flood new Sentry issues

---

PR target: dev (never main). Implement only this issue.