[Programcode]

Follow-up review of the PRs merged 2026-08-31. Two gaps survived that batch.

Jam recorder cannot upload

PR #15 added https://*.jam.dev to script-src and frame-src, and @jam.dev/sdk
is a production dependency wired into AuthProvider, so bootstrap.ts loads the
recorder for real users. But connect-src was never updated — the recorder loads
and then has no route to send a capture.

Added the origin to connect-src in both vercel.json and nginx.conf. The
existing config test already asserts the two policies are byte-identical, so
they cannot drift.

sendDefaultPii was dead config

At the pinned @sentry/core 10.65.0, sendDefaultPii is deprecated and, per its
own type docs, "if both sendDefaultPii and dataCollection are set,
sendDefaultPii will be ignored." Since dataCollection is set, the line was a
PII control that did nothing — worse than absent, because it reads as protection.
Removed; dataCollection is now the single source of truth.

Note: queryParams is correct at 10.65.0. urlQueryParams does not exist
until 10.68.0, so no rename here.

Verification

Both fixes have an assertion that fails without them (confirmed by reverting each
fix with the tests in place — both went red, then green again once restored).

• lint: clean
• typecheck: clean
• vitest: 97 files, 966 tests passed, coverage thresholds met
• deno edge tests: 116 passed
• build: succeeds

Summary by CodeRabbit

• New Features

  • Enabled secure connections and embedded content from Jam.dev services for recording functionality.

• Bug Fixes

  • Updated privacy configuration by removing a deprecated Sentry option while preserving existing data-collection controls.

• Tests

  • Updated observability and deployment checks to verify the revised privacy settings and Content Security Policy permissions.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Sep 1, 2026 2:51pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 843f36cf-d9e8-4a1a-869d-2fa6cee88659

📥 Commits

Reviewing files that changed from the base of the PR and between edff2e7 and 71b7ad1.

📒 Files selected for processing (5)

• nginx.conf
• src/lib/observability.ts
• src/test/observability.test.ts
• src/test/vercel-deployment-config.test.ts
• vercel.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds Jam.dev origins to CSP directives and removes the deprecated Sentry sendDefaultPii option. Tests verify both configuration updates.

Changes

Configuration updates

Layer / File(s)	Summary
Jam.dev CSP allowlists nginx.conf, vercel.json, src/test/vercel-deployment-config.test.ts	The CSP configurations allow Jam.dev connections and frames. The deployment test checks the Jam.dev recorder connection allowance.
Sentry privacy configuration src/lib/observability.ts, src/test/observability.test.ts	Sentry initialization removes sendDefaultPii: false. The test verifies that sendDefaultPii is absent when dataCollection is configured.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 71b7a

The PR adds the required Jam upload origin to the connection policy and removes an ineffective Sentry setting; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes both main changes: allowing Jam uploads through CSP and removing the deprecated sendDefaultPii setting.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (2 skipped: 2 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}