fix(dashboard): report only our own errors, not browser extensions'

[chhhee10]

The problem

GlobalErrorListeners (mounted in app/layout.tsx, so it runs on every dashboard page) registers page-global handlers:

window.addEventListener("unhandledrejection", handleUnhandledRejection);

Browser extensions inject content scripts into the same page and share the same window. Their failures therefore reached our listeners and went to PostHog stamped $lib: failproofai-web — as though the dashboard had thrown them.

Observed live, which is what prompted this:

event:         unhandled_rejection
error_message: Failed to connect to MetaMask
error_name:    i                              ← MetaMask's minified class
$current_url:  http://localhost:8020/policies?cli=claude
$lib:          failproofai-web                ← attributed to us

MetaMask is just the one that got noticed; ad blockers, password managers and every other injected extension do the same. There was no filter of any kind — no origin check, no stack inspection.

This matters beyond tidiness: the noise is unbounded and unrelated to our code, it makes the dashboard's error rate a function of whichever extensions users happen to run, and left alone it would drown the real signal these listeners exist to catch.

The fix

Both handlers now attribute an error before reporting it (new lib/error-origin.ts), and report only what traces back to our own origin.

Design decisions worth reviewing:

• Positive attribution, not a denylist. Only errors traceable to our origin are reported, so an extension nobody has heard of is filtered by default. A denylist would need updating forever.
• Matched on the shared <vendor>-extension:// suffix rather than an explicit vendor list, so chrome-, moz-, safari-web-, ms-browser- and any future browser's scheme are covered without a code change.
• A stack passing through an extension is the extension's, even when one of our frames appears further down.
• Unattributable errors are dropped — cross-origin "Script error." and rejections of non-Error values carry nothing to debug.

React render errors are unaffected. The error boundaries (app/global-error.tsx, app/components/error-fallback.tsx) report client_error directly, and React only invokes those for errors thrown inside our own tree. These global listeners are a catch-all net, which is why they can be filtered strictly without losing genuine signal.

Tests

21 new tests across two files. __tests__/lib/error-origin.test.ts pins the classifier (including the exact production MetaMask stack, all four browser schemes, an unknown future vendor, mixed stacks, and each unattributable case). __tests__/components/global-error-listeners.test.tsx drives real window events through the mounted component, so the wiring is proven rather than just the pure function.

The negative assertions aren't vacuous: the positive tests fire captureClientEvent through the same mock, so "not called" means genuinely filtered.

Gate: 2113 tests / 124 files pass, 0 lint errors, clean tsc.

Notes

• Independent of fix: npm install warning, onboarding audit telemetry, and dashboard error noise #560 (npm lifecycle scripts) and fix(audit): report the onboarding auto-audit to PostHog #562 (onboarding audit telemetry); branched from main.
• Behaviour change: real dashboard errors whose rejection carries a non-Error value (Promise.reject("boom")) are no longer reported, as they can't be attributed. Rare, and the error boundary path still covers React errors.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ec320d90-18a9-4203-940b-c4778bd9ec7c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chhhee10]

Folded into #560 — same commit, unchanged. One PR is easier for a small team to review; the three fixes are kept as separate commits there so they can still be reviewed one at a time.