fix(s3): add sanitized transport diagnostics

[poboll]

Summary

• add bounded S3 transport diagnostics with explicit allowlists for error name, code, syscall, and category
• prevent provider, endpoint, object-key, response-body, stack, and arbitrary cause text from entering the diagnostic message
• avoid signing an explicit Content-Length for Uint8Array uploads and add focused transport coverage

Problem

An S3-compatible upload can fail before an HTTP response exists, but the uploader did not expose a stable, privacy-safe way to distinguish DNS, connection, socket, timeout, TLS, abort, and request-length failures. Logging the original nested error would expose uncontrolled provider or network details.

The full CI test setup also loads an Undici dispatcher that rejects the uploader's explicit Content-Length before a request reaches the local fixture. Letting fetch() derive the length removes that dispatcher-specific coupling while preserving the actual body length on the wire.

Implementation

• inspect direct errors, nested cause values, and AggregateError.errors with a bounded traversal of 4 levels and 16 nodes
• emit only allowlisted values, with UnknownError, UNKNOWN, unknown, and unknown category fallbacks
• bind an optional deployment nonce only when it matches exactly 32 lowercase hexadecimal characters; otherwise emit unbound
• wrap both fetch() transport failures and response-body read failures without changing existing HTTP error responses
• remove Content-Length from the direct uploadToS3() signed-header set; multipart and other signed request paths remain unchanged

Verification

• focused S3 Vitest coverage: 25/25 tests passed, including nested/cyclic causes, allowlist fallbacks, nonce handling, real local Undici transport, and HTTP error behavior
• ESLint, Core TypeScript checking, and git diff --check passed
• GitHub Actions run 31297381567: all 9 checks passed, including lint/typecheck, Core build, Docker build, CLI/Core E2E, three test shards, GitGuardian, and the Open Source Software Supply Chain Security Scanner

This is transport diagnostic and compatibility hardening only. It does not establish the root cause of a production S3 failure, change production configuration, or deploy anything.

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}