refactor(onerror): inline error page template as string constant (#5868)

## Summary

Inlines the 1336-line error page HTML template into
`plugins/onerror/src/lib/onerror_page.ts` as a string constant. Removes
the runtime `readFileSync` + `import.meta.dirname` lookup for the
default template, sets the `templatePath` config default to an empty
string, and updates `app.ts` to lazy-load the built-in template only
when no custom template path is configured.

The fallback app-info serialization path now redacts sensitive config
values when `app.dumpConfigToObject()` is unavailable. This is an
observable security improvement for rendered error output; user-supplied
`templatePath` behavior remains unchanged.

## Why

This is **batch 1, part of a 19-PR split of #5863** (the egg-bundler
PR). #5863 is kept open as a tracking reference. This PR is independent
of the other batch-1 PRs.

Turbopack (and any static bundler) cannot follow `import.meta.dirname +
readFileSync` to a template file, so the file would be missing in a
bundled deployment. Inlining the HTML as a string constant makes the
plugin statically bundleable.

## Test plan

- [x] `pnpm exec vitest run plugins/onerror/test/onerror.test.ts` -
39/39 passed
- [x] `pnpm --filter=@eggjs/onerror typecheck`
- [x] `pnpm run build`
- [x] `pnpm exec oxlint --type-aware --type-check
plugins/onerror/src/app.ts plugins/onerror/src/lib/error_view.ts
plugins/onerror/src/lib/onerror_page.ts
plugins/onerror/test/onerror.test.ts plugins/onerror/tsdown.config.ts` -
0 errors, 1 existing warning on `app.close()`

## Stack context

Other batch-1 PRs (independent, can land in any order):
- `feat(utils): add setBundleModuleLoader runtime hook`
- `refactor(development): inline loader trace template as string
constant`
- `refactor(watcher): use direct class imports for event sources`

Generated with Claude Code

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Built-in error page template now exposed for consumers; includes
stack-frame visualization, filtering, frame selection, inline code
preview, and syntax highlighting.

* **Bug Fixes & Improvements**
* Built-in template used by default when no custom template path is set.
* Safer frame selection and more robust client-side error-page behavior.
* Config serialization now redacts sensitive values and handles circular
references.

* **Tests**
  * Added tests verifying config redaction in serialized error output.

* **Chores**
* Added a public package subpath export to allow importing the
error-page asset.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: killagu

packages/cluster/test/app_worker.test.ts

@@ -52,7 +52,8 @@ describe.skipIf(process.version.startsWith('v24') || process.platform === 'win32
         app
           // .debug()
           .expect('code', 1)
-          .expect('stdout', /\[app_worker] beforeExit success/)
+          .expect('stderr', /Error: mock error/)
+          .expect('stderr', /app_worker#1:\d+ start fail/)
           .end()
       );
     });

packages/egg/test/cluster1/app_worker.test.ts

@@ -30,6 +30,9 @@ describe('test/cluster1/app_worker.test.ts', () => {
   });
 
   it('should response 400 bad request when HTTP request packet broken', async () => {
+    // Node.js will emit a clientError when the raw URI in the HTTP request
+    // packet contains spaces. Send raw packets because modern clients reject
+    // unescaped paths before they reach the server.
     const responses = await Promise.all([rawRequest(app.port, '/foo bar'), rawRequest(app.port, '/foo baz')]);
 
     for (const response of responses) {
@@ -139,9 +142,11 @@ function connect(port: number) {
 
 function rawRequest(port: number, path: string) {
   return new Promise<string>((resolve, reject) => {
-    const socket = net.createConnection(port, '127.0.0.1');
     let response = '';
     let settled = false;
+    const socket = net.createConnection(port, '127.0.0.1', () => {
+      socket.write(`GET ${path} HTTP/1.1\r\nHost: 127.0.0.1:${port}\r\nConnection: close\r\n\r\n`);
+    });
 
     function resolveOnce() {
       if (!settled) {
@@ -150,24 +155,27 @@ function rawRequest(port: number, path: string) {
       }
     }
 
+    function rejectOnce(err: Error) {
+      if (!settled) {
+        settled = true;
+        reject(err);
+      }
+    }
+
     socket.setEncoding('utf8');
-    socket.on('connect', () => {
-      socket.write(`GET ${path} HTTP/1.1\r\nHost: 127.0.0.1:${port}\r\nConnection: close\r\n\r\n`);
-    });
+    socket.setTimeout(5000);
     socket.on('data', (chunk) => {
       response += chunk;
     });
+    socket.on('timeout', () => {
+      socket.destroy(new Error('Timed out waiting for raw HTTP response'));
+    });
     socket.on('end', resolveOnce);
-    socket.on('close', (hasError) => {
-      if (!hasError) {
+    socket.on('error', rejectOnce);
+    socket.on('close', (hadError) => {
+      if (!hadError) {
         resolveOnce();
       }
     });
-    socket.on('error', (err) => {
-      if (!settled) {
-        settled = true;
-        reject(err);
-      }
-    });
   });
 }

plugins/onerror/package.json

@@ -28,6 +28,7 @@
     "./app": "./src/app.ts",
     "./config/config.default": "./src/config/config.default.ts",
     "./lib/error_view": "./src/lib/error_view.ts",
+    "./lib/onerror_page": "./src/lib/onerror_page.ts",
     "./lib/utils": "./src/lib/utils.ts",
     "./types": "./src/types.ts",
     "./package.json": "./package.json"
@@ -40,6 +41,7 @@
       "./app": "./dist/app.js",
       "./config/config.default": "./dist/config/config.default.js",
       "./lib/error_view": "./dist/lib/error_view.js",
+      "./lib/onerror_page": "./dist/lib/onerror_page.js",
       "./lib/utils": "./dist/lib/utils.js",
       "./types": "./dist/types.js",
       "./package.json": "./package.json"

plugins/onerror/src/app.ts

@@ -23,7 +23,9 @@ export default class Boot implements ILifecycleBoot {
   async didLoad(): Promise<void> {
     // logging error
     const config = this.app.config.onerror;
-    const viewTemplate = fs.readFileSync(config.templatePath, 'utf8');
+    const viewTemplate = config.templatePath
+      ? fs.readFileSync(config.templatePath, 'utf8')
+      : (await import('./lib/onerror_page.ts')).ONERROR_PAGE_TEMPLATE;
     const app = this.app;
     app.on('error', (err, ctx) => {
       if (!ctx) {

plugins/onerror/src/config/config.default.ts

@@ -1,5 +1,3 @@
-import path from 'node:path';
-
 import type { Context } from 'egg';
 import type { OnerrorError, OnerrorOptions } from 'koa-onerror';
 
@@ -20,7 +18,9 @@ export interface OnerrorConfig extends OnerrorOptions {
    */
   appErrorFilter?: (err: OnerrorError, ctx: Context) => boolean;
   /**
-   * default template path
+   * Custom template path. If empty, uses the built-in error page template.
+   *
+   * Default: `''`
    */
   templatePath: string;
 }
@@ -29,6 +29,6 @@ export default {
   onerror: {
     errorPageUrl: '',
     appErrorFilter: undefined,
-    templatePath: path.join(import.meta.dirname, '../lib/onerror_page.mustache.html'),
+    templatePath: '',
   } as OnerrorConfig,
 };

plugins/onerror/src/lib/error_view.ts

@@ -13,6 +13,18 @@ import stackTrace, { type StackFrame } from 'stack-trace';
 import { detectErrorMessage } from './utils.ts';
 
 const startingSlashRegex = /\\|\//;
+const defaultConfigIgnoreList: (string | RegExp)[] = [
+  'pass',
+  'pwd',
+  'passd',
+  'passwd',
+  'password',
+  'keys',
+  'masterKey',
+  'accessKey',
+  /secret/i,
+];
+const redactedValue = '<Redacted>';
 
 export interface FrameSource {
   pre: string[];
@@ -302,13 +314,69 @@ export class ErrorView {
     baseDir: string;
     config: string;
   } {
-    let config = this.app.config;
-    if ('dumpConfigToObject' in this.app && typeof this.app.dumpConfigToObject === 'function') {
-      config = this.app.dumpConfigToObject().config.config;
-    }
+    const config = this.serializeConfig();
     return {
       baseDir: this.app.config.baseDir as string,
       config: util.inspect(config) satisfies string as string,
     };
   }
+
+  serializeConfig(): unknown {
+    if ('dumpConfigToObject' in this.app && typeof this.app.dumpConfigToObject === 'function') {
+      return this.app.dumpConfigToObject().config.config;
+    }
+
+    return this.redactConfig(this.app.config, this.getConfigIgnoreList());
+  }
+
+  getConfigIgnoreList(): (string | RegExp)[] {
+    try {
+      return Array.from(this.app.config.dump.ignore);
+    } catch {
+      return defaultConfigIgnoreList;
+    }
+  }
+
+  redactConfig(
+    value: unknown,
+    ignoreList: (string | RegExp)[],
+    ancestors: WeakSet<object> = new WeakSet<object>(),
+  ): unknown {
+    if (!value || typeof value !== 'object') {
+      return value;
+    }
+
+    if (value instanceof Date || value instanceof RegExp || value instanceof URL) {
+      return value.toString();
+    }
+
+    if (Buffer.isBuffer(value)) {
+      return value;
+    }
+
+    if (ancestors.has(value)) {
+      return '[Circular]';
+    }
+    ancestors.add(value);
+
+    try {
+      if (Array.isArray(value)) {
+        return value.map((item) => this.redactConfig(item, ignoreList, ancestors));
+      }
+
+      const result: Record<string, unknown> = {};
+      for (const key of Object.keys(value)) {
+        result[key] = this.shouldRedactConfigKey(key, ignoreList)
+          ? redactedValue
+          : this.redactConfig((value as Record<string, unknown>)[key], ignoreList, ancestors);
+      }
+      return result;
+    } finally {
+      ancestors.delete(value);
+    }
+  }
+
+  shouldRedactConfigKey(key: string, ignoreList: (string | RegExp)[]): boolean {
+    return ignoreList.some((item) => (typeof item === 'string' ? item === key : item.test(key)));
+  }
 }