🐛 Remove console.debug calls that leak metadata to production by clubanderson · Pull Request #4239 · kubestellar/console

clubanderson · 2026-04-02T13:26:01Z

Fix web/vite.config.ts: replace undefined with (() => {}) for console no-ops so surviving call sites become safe no-ops instead of TypeErrors
Fix web/src/components/feedback/FeedbackModal.tsx: remove [Screenshot] prefix from the 3 console.error messages that leaked implementation details
Run npm run build — passes
Run npm run lint — no errors in changed files (pre-existing warnings in other files)

Vite strips `globalThis.console.debug` but not bare `console.debug`, so 21 debug calls in FeedbackModal.tsx (screenshot file names, sizes, data-URI prefixes, upload timeouts) survived production builds and leaked to end-user DevTools. Fix: - Remove all console.debug calls from FeedbackModal.tsx (temporary debugging for the screenshot feature — not needed long-term) - Add bare `console.*` forms to Vite define config so any future console.debug/log/info/trace calls are also stripped in production, matching the existing globalThis.console.* rules Signed-off-by: Andrew Anderson <andy@clubanderson.com>

netlify · 2026-04-02T13:26:09Z

✅ Deploy Preview for kubestellarconsole ready!

Name	Link
🔨 Latest commit	`6f89f6c`
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/69ce6e6d765f33000868dbd6
😎 Deploy Preview	https://deploy-preview-4239.console-deploy-preview.kubestellar.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

github-actions · 2026-04-02T13:26:12Z

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

Claude Code (Opus 4.5 / 4.6) — recommended

GitHub Copilot

Cursor

Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

This is an automated message.

clubanderson · 2026-04-02T13:29:30Z

/lgtm
/approve

kubestellar-prow · 2026-04-02T13:29:33Z

@clubanderson: you cannot LGTM your own PR.

Details

In response to this:

/lgtm
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

kubestellar-prow · 2026-04-02T13:29:37Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clubanderson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [clubanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

Pull request overview

This PR aims to prevent screenshot-upload debug metadata from leaking to end users in production by removing debug logging from the feedback modal and updating the Vite production build config intended to strip console calls.

Changes:

Removed console.debug logging throughout the screenshot attachment/upload flow in FeedbackModal.tsx.
Updated web/vite.config.ts production define rules to also target bare console.* (in addition to globalThis.console.*).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
web/vite.config.ts	Expands production `define` replacements to include `console.*` in an attempt to strip logs from production bundles.
web/src/components/feedback/FeedbackModal.tsx	Removes screenshot-flow `console.debug` statements to avoid exposing screenshot metadata in DevTools.

Comments suppressed due to low confidence (1)

web/src/components/feedback/FeedbackModal.tsx:75

This error log still includes the local screenshot filename (file.name), which can leak user metadata to DevTools in production on the error path. If the goal is to avoid exposing screenshot metadata in production, consider removing the filename from the message (or only including it behind a dev-only guard).

      reader.onerror = (err) => {
        console.error(`[Screenshot] FileReader failed for ${file.name}:`, err)
      }

Copilot · 2026-04-02T13:30:28Z

web/vite.config.ts

+    // Strip console/debugger in production (replaces terser drop_console).
+    // Both globalThis.console.* and console.* forms are needed — Vite's
+    // define does literal text replacement, so "console.debug" won't match
+    // a rule for "globalThis.console.debug" and vice-versa.
    ...(mode === 'production' ? {
      'globalThis.console.log': 'undefined',
      'globalThis.console.info': 'undefined',
      'globalThis.console.debug': 'undefined',
      'globalThis.console.trace': 'undefined',
+      'console.log': 'undefined',
+      'console.info': 'undefined',
+      'console.debug': 'undefined',
+      'console.trace': 'undefined',


In production mode this define mapping replaces console.* with undefined, which turns any remaining calls into undefined(...) and will throw at runtime. There are still console.debug(...) call sites in the app (e.g., web/src/hooks/useVersionCheck.tsx, web/src/hooks/mcp/workloads.ts), so this change can break production if those paths execute. Consider using a supported drop/pure-func mechanism that actually removes these calls during build, or replace the methods with a no-op function rather than undefined (and update the comment about stripping debugger, since nothing here handles it).

Suggested change

// Strip console/debugger in production (replaces terser drop_console).

// Both globalThis.console.* and console.* forms are needed — Vite's

// define does literal text replacement, so "console.debug" won't match

// a rule for "globalThis.console.debug" and vice-versa.

...(mode === 'production' ? {

'globalThis.console.log': 'undefined',

'globalThis.console.info': 'undefined',

'globalThis.console.debug': 'undefined',

'globalThis.console.trace': 'undefined',

'console.log': 'undefined',

'console.info': 'undefined',

'console.debug': 'undefined',

'console.trace': 'undefined',

// No-op console methods in production (replaces terser drop_console).

// Both globalThis.console.* and console.* forms are needed — Vite's

// define does literal text replacement, so "console.debug" won't match

// a rule for "globalThis.console.debug" and vice-versa.

...(mode === 'production' ? {

'globalThis.console.log': '(() => {})',

'globalThis.console.info': '(() => {})',

'globalThis.console.debug': '(() => {})',

'globalThis.console.trace': '(() => {})',

'console.log': '(() => {})',

'console.info': '(() => {})',

'console.debug': '(() => {})',

'console.trace': '(() => {})',

Copilot · 2026-04-02T13:30:29Z

web/src/components/feedback/FeedbackModal.tsx

      })
    } catch (err) {
      console.error('[Screenshot] Failed to submit feedback:', err)
-      if (err instanceof Error) {
-        console.debug(`[Screenshot] Error details: name=${err.name}, message=${err.message}`)
-        if ('response' in err) console.debug('[Screenshot] Response:', (err as Record<string, unknown>).response)
-      }
      const message = err instanceof Error ? err.message : 'Failed to submit feedback'


The PR description/test plan mentions verifying that production bundles no longer contain the [Screenshot] debug strings, but this file still contains [Screenshot] string literals (e.g., in console.error messages). If that verification is meant to be a hard requirement, these strings/logs also need to be removed/rewritten or stripped in production.

clubanderson · 2026-04-02T13:30:39Z

🔄 Auto-Applying Copilot Code Review

Copilot code review found 1 code suggestion(s) and 1 general comment(s).

@copilot Please apply all of the following code review suggestions:

web/vite.config.ts (line 62): // No-op console methods in production (replaces terser drop_console). // Bo...

Also address these general comments:

web/src/components/feedback/FeedbackModal.tsx (line 201): The PR description/test plan mentions verifying that production bundles no longer contain the [Screenshot] debug strin

Push all fixes in a single commit. Run cd web && npm run build && npm run lint before committing.

Auto-generated by copilot-review-apply workflow.

github-actions · 2026-04-02T13:33:38Z

Thank you for your contribution! Your PR has been merged.

Check out what's new:

KubeStellar Console — Live multi-cluster dashboard
Marketplace — Community extensions
Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

Copilot · 2026-04-02T13:40:33Z

🔄 Auto-Applying Copilot Code Review

Copilot code review found 1 code suggestion(s) and 1 general comment(s)....

Applied both fixes in commit 05e3659:

web/vite.config.ts: Changed console method replacements from 'undefined' to '(() => {})' — surviving call sites now become (() => {})() (a safe no-op) instead of undefined() (a TypeError that would crash at runtime).
web/src/components/feedback/FeedbackModal.tsx: Removed the [Screenshot] prefix from all three console.error messages that still leaked implementation-specific labelling.

Both npm run build and npm run lint pass with no errors in the changed files.

PR #4239 added bare `console.log`/`console.debug` to Vite's define config to strip debug calls. But Vite's define does LITERAL text replacement — it replaced `console.log(...)` with `undefined(...)` in vendor/dependency code (Tailwind Merge, etc.), causing `TypeError: (void 0) is not a function` and crashing the entire app on console.kubestellar.io. Fix: Only use `globalThis.console.*` form which is specific enough to match our code but not vendor dependencies. Signed-off-by: Andrew Anderson <andy@clubanderson.com>

…ine (#4248) PR #4239 added bare `console.log`/`console.debug` to Vite's define config to strip debug calls. But Vite's define does LITERAL text replacement — it replaced `console.log(...)` with `undefined(...)` in vendor/dependency code (Tailwind Merge, etc.), causing `TypeError: (void 0) is not a function` and crashing the entire app on console.kubestellar.io. Fix: Only use `globalThis.console.*` form which is specific enough to match our code but not vendor dependencies. Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Adds a postbuild script that scans vendor bundles for `void 0(` — the minified form of `undefined()` — which indicates Vite's define config replaced `console.*` calls in dependency code. This would have caught the production crash from PR #4239 / #4248 before deployment. Also removes unused DEV_BAR_HEIGHT_PX import blocking tsc. Signed-off-by: Andrew Anderson <andy@clubanderson.com>

#4252) Adds a postbuild script that scans vendor bundles for `void 0(` — the minified form of `undefined()` — which indicates Vite's define config replaced `console.*` calls in dependency code. This would have caught the production crash from PR #4239 / #4248 before deployment. Also removes unused DEV_BAR_HEIGHT_PX import blocking tsc. Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Copilot AI review requested due to automatic review settings April 2, 2026 13:26

kubestellar-prow bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Apr 2, 2026

kubestellar-prow bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Apr 2, 2026

Copilot started reviewing on behalf of clubanderson April 2, 2026 13:26 View session

kubestellar-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 2, 2026

Copilot AI reviewed Apr 2, 2026

View reviewed changes

clubanderson assigned Copilot Apr 2, 2026

Copilot started work on behalf of clubanderson April 2, 2026 13:30 View session

clubanderson merged commit 89b2fd4 into main Apr 2, 2026
27 of 29 checks passed

kubestellar-prow bot deleted the fix/strip-console-debug branch April 2, 2026 13:32

clubanderson mentioned this pull request Apr 2, 2026

🐛 URGENT: Fix production crash from bare console.* stripping #4248

Merged

clubanderson mentioned this pull request Apr 2, 2026

✨ Add post-build vendor safety check to prevent Vite define corruption #4252

Merged

12 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🐛 Remove console.debug calls that leak metadata to production#4239

🐛 Remove console.debug calls that leak metadata to production#4239
clubanderson merged 1 commit intomainfrom
fix/strip-console-debug

clubanderson commented Apr 2, 2026 •

edited by Copilot AI

Loading

Uh oh!

netlify bot commented Apr 2, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

clubanderson commented Apr 2, 2026

Uh oh!

kubestellar-prow bot commented Apr 2, 2026

Uh oh!

kubestellar-prow bot commented Apr 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

clubanderson commented Apr 2, 2026

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

Copilot AI commented Apr 2, 2026

🔄 Auto-Applying Copilot Code Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

clubanderson commented Apr 2, 2026 • edited by Copilot AI Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubestellarconsole ready!

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

clubanderson commented Apr 2, 2026

Uh oh!

kubestellar-prow bot commented Apr 2, 2026

Uh oh!

kubestellar-prow bot commented Apr 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

clubanderson commented Apr 2, 2026

🔄 Auto-Applying Copilot Code Review

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

Copilot AI commented Apr 2, 2026

🔄 Auto-Applying Copilot Code Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

clubanderson commented Apr 2, 2026 •

edited by Copilot AI

Loading

netlify bot commented Apr 2, 2026 •

edited

Loading