Repository navigation
feat(tools): expose selected package versions for exact events - #1293
Conversation
Retain event package metadata and support bounded exact-name selection through the existing resource and issue readers. Include selected versions with supplied Markdown and local formatting without extra API requests. Fixes getsentry#1292 Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
Merge upstream/main and retain package selection in the new structured issue responses as well as Markdown fallback. Share selection logic and cover both response formats through the tool and MCP boundaries. Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
Preserve package-selection test imports alongside upstream tool failure telemetry tests and the latest issue-details replay limits. Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
Preserve selected event package versions alongside suspect commit output and adapt package-selection fixtures to numeric issue event endpoints. Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
Preserve package selection alongside updated resource telemetry and nullable event context documentation. Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
Preserve selected package versions with experimental structured issue details and locally formatted event bodies. Regenerate definitions and update response snapshots for the upstream formatting contract. Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
|
@mr-danya is attempting to deploy a commit to the Sentry Team on Vercel. A member of the Team first needs to authorize it. |
…me (#1607) Two places where what the library SDK accepts doesn't match what commands actually get: - **Scalar values for variadic flags.** Stricli always passes variadic flags to a handler as arrays, but the SDK forwards the caller's flags as-is. An untyped caller passing `{ field: "title" }` to `explore` crashed with `e.find is not a function` ([CLI-28C](https://sentry.sentry.io/issues/7602736942/), [CLI-2B4](https://sentry.sentry.io/issues/7630797537/)). getsentry/cli#1648 fixed the generated types. `applyFlagDefaults` now also wraps scalar values in an array at runtime, so plain JS callers work. - **Streaming overloads.** The `AsyncIterable` overload for `log list --follow` and `dashboard view --refresh` didn't accept trailing positionals, so `sdk.log.list({ follow: "5" }, "org/project")` failed to type-check even though the runtime accepts it. This replaces three getsentry/cli PRs that patched `explore` directly. #1293's `parse: (v: string[]) => v` was wrong because Stricli calls `parse` once per value. #1218 and #1294 coerced the arrays inside `explore`. The variadic fix here is at the SDK boundary, which is the only path that can pass a scalar. Ported from getsentry/cli#1218, getsentry/cli#1293, getsentry/cli#1294, and the SDK part of getsentry/cli#1655. All are being closed with the repo archive. <!-- junior-request-attribution:start --> via **BYK**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:local%3Aweb%3Ad9c5b0de1ecf3c7114be7025 --> -- [View Junior Session in Sentry](https://sentry.sentry.io/explore/conversations/local%3Aweb%3Ad9c5b0de1ecf3c7114be7025/?project=4510944073809921) <!-- junior-session-footer:end --> Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: BYK <burak.kaya@sentry.io>
Use a Map and Array.from for package selection, simplify package status handling, and render status labels with a switch. Share the existing CLI Markdown escape helper through toolkit-core and retain list-line normalization. Preserve upstream formatter imports, attribution tests, and input-limit tests while resolving the merge conflicts. Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
Resolve the server test import conflict by keeping both createDefaultEvent and eventFixture. Co-Authored-By: Claude <noreply@anthropic.com>
Replace the hand-rolled escape chain for selected package versions with code spans. Package names and versions are identifiers, and a code span needs no Markdown, HTML, or pipe escaping. This drops the `&` rewriting and `\|` escaping, which only added noise in list items. Move the two identical `formatInlineCode` copies in mcp-core into `internal/inline-code.ts` and reuse it here. It now collapses line breaks, matching how CommonMark renders code spans, so values stay on one line. Revert the move of `escapeMarkdownInline` into toolkit-core. The CLI helper is back where it was and MCP no longer depends on it. Co-Authored-By: BYK <126780+BYK@users.noreply.github.com>
…#1795) Adds `@sentry/toolkit-core/markdown`, one place for the CLI and MCP to put upstream data into Markdown without hand-rolled escaping, and moves MCP's issue and event output onto it (#1797, merged into this branch). This is the first step of the plan that came out of the escaping review on #1293. The helper is picked by what the value is, not by which characters it contains: | helper | for | how | |---|---|---| | `inlineCode` | identifiers, slugs, queries, short values | fence longer than any backtick run; padding keeps a leading/trailing backtick or space; line breaks become spaces | | `codeBlock` | messages, stack traces, JSON | fence (≥3) longer than any backtick run, so no line of the value can close the block | | `text` | values that should read as prose | backslash escapes only, no runtime deps; line breaks become spaces | The threat in MCP is structural: upstream text breaking out of its list item or block and adding headings or sections, for example a fake `## Response Notes`. Each helper keeps the value inside the line or block it is placed in. `inlineCode` needs no escaping, so it is the default for MCP output; models read the value unchanged. **Same library as the CLI:** toolkit-core has no Markdown runtime dependencies. `text` escapes CommonMark/GFM inline syntax, line-start syntax (headings, lists, quotes, rules), and the `:`/`.`/`@` that would start a literal autolink, so URLs, `www.` domains, and emails stay plain text. It never writes character references, because `marked` keeps them as-is in text tokens and the CLI would print `w`. `marked` moves to the workspace catalog, so the CLI and toolkit-core's tests use the same version. **Property tests** parse each helper's output with both `marked` (the CLI's parser) and micromark (CommonMark reference, with GFM), placed mid-line and at the end of a list item, and check that any input round-trips as the same literal value with no other structure. They pass at 20,000 runs locally; CI runs 500. **Consumers:** MCP's two `formatInlineCode` copies use `inlineCode`; mcp-core's `formatting.ts` uses `codeBlock` for messages, exception values, frames, and queries, `text` for titles and culprits, and `inlineCode` for tag values. The CLI's `escapeMarkdownInline`, `escapeMarkdownCell`, and `safeCodeSpan` are not swapped in this PR: the CLI wants URLs in escaped text to stay clickable autolinks (`renderOneInline` strips escapes inside them), while `text` blocks autolinks on purpose, and the cell helpers need pipe handling that `text` and `inlineCode` don't do. That move needs a table-cell helper and an autolink decision, so it comes next. **Dependencies:** `marked` (catalog), `mdast-util-from-markdown`, `mdast-util-gfm`, and `micromark-extension-gfm` are toolkit-core dev deps for the test oracles. The lockfile also moves `unist-util-visit` from 5.0.0 to 5.1.0 as part of that resolution. Docs: toolkit-core README section and a bullet in `docs/contributing/tool-responses.md` under "Formatting Upstream Data". <!-- junior-session-footer:start --> <!-- junior-conversation-id:local%3Aweb%3A67232d03908f6d80361e0c2c --> -- [View Session in Sentry](https://sentry.sentry.io/explore/conversations/local%3Aweb%3A67232d03908f6d80361e0c2c/?project=4510944073809921) <!-- junior-session-footer:end --> --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: BYK <126780+BYK@users.noreply.github.com>
Preserve package selection alongside resource aliases and regenerate tool definitions. Align package-selection snapshots with upstream tag formatting. Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
Head branch was pushed to by a user without write access
![semgrep-code-getsentry[bot]](https://avatars.githubusercontent.com/in/1153895?s=60&v=4){kind=small}
| export const ParamPackageNames = z | ||
| .array(z.string().min(1).max(256)) |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
Risk: Affected versions of zod are vulnerable to Allocation of Resources Without Limits or Throttling. Zod parses every element of an array, set or map schema and records one validation issue per invalid element, with no cap or early stop. Upper size bounds (.max(), .length(), .size(), or z.maxLength()/z.length()/z.maxSize()/z.size() checks) only ran after all elements had been parsed, so they did not limit the work. An attacker who submits a very large collection (e.g. a million invalid items for z.array(z.string().uuid())) forces the allocation of millions of issue objects, which can exhaust memory and crash the process. Upgrade to zod 4.6.6 or later, which rejects oversized input before parsing its elements when the schema has an upper bound, and add an upper bound (e.g. .max(n)) to every collection schema that parses untrusted input: unbounded schemas stay exposed even after the upgrade.
Fix: Upgrade this library to at least version 4.6.6 at toolkit/pnpm-lock.yaml:9619.
Reference(s): GHSA-mrhx-c7xc-m3w5, CVE-2023-54404
🍰 Fixed in commit d622ab8 🍰
| packages: z.array( | ||
| z.discriminatedUnion("status", [ | ||
| z.object({ | ||
| name: z.string(), | ||
| status: z.literal("recorded"), | ||
| version: z.string(), | ||
| truncated: z.boolean(), | ||
| }), | ||
| z.object({ | ||
| name: z.string(), | ||
| status: z.enum(["not_listed", "version_not_recorded"]), | ||
| version: z.null(), | ||
| truncated: z.literal(false), | ||
| }), | ||
| ]), | ||
| ), |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
Risk: Affected versions of zod are vulnerable to Allocation of Resources Without Limits or Throttling. Zod parses every element of an array, set or map schema and records one validation issue per invalid element, with no cap or early stop. Upper size bounds (.max(), .length(), .size(), or z.maxLength()/z.length()/z.maxSize()/z.size() checks) only ran after all elements had been parsed, so they did not limit the work. An attacker who submits a very large collection (e.g. a million invalid items for z.array(z.string().uuid())) forces the allocation of millions of issue objects, which can exhaust memory and crash the process. Upgrade to zod 4.6.6 or later, which rejects oversized input before parsing its elements when the schema has an upper bound, and add an upper bound (e.g. .max(n)) to every collection schema that parses untrusted input: unbounded schemas stay exposed even after the upgrade.
Fix: Upgrade this library to at least version 4.6.6 at toolkit/pnpm-lock.yaml:9619.
Reference(s): GHSA-mrhx-c7xc-m3w5, CVE-2023-54404
🍰 Fixed in commit d622ab8 🍰
…handoff Co-Authored-By: BYK <126780+BYK@users.noreply.github.com>
![sentry-junior[bot]](https://avatars.githubusercontent.com/in/2960336?s=60&v=4){kind=small}
There was a problem hiding this comment.
Thanks, this is well scoped. The packages schema matches the producer contract: Sentry serializes packages from the event's modules, and Relay normalizes that to Object<String>. Selection is bounded at the MCP boundary. Using a Map avoids prototype lookups, and calls without packageNames keep their existing output. The exact-event guards in both tools are consistent with the docs, and the tests cover the states well.
One thing to fix before this lands:
internal/inline-code.tsadds a second Markdown code-span helper (formatInlineCode) that duplicatesinlineCodefrom@sentry/toolkit-core/markdown.formatting.tsalready imports and uses that helper. The shared one also pads values that start or end with a space, which the new copy doesn't. UseinlineCodeinformatEventPackages, then deleteinline-code.tsand its test. Also update theformatInlineCodereference indocs/contributing/tool-responses.md. Two imports of the new helper are unused and look like merge leftovers: one intool-helpers/ai-conversation-actions.tsand one insupport/search-events/formatters.ts. Remove both.
FYI, I merged main into the branch to pick up the zod lockfile fix that the semgrep findings were about. Pull before you push again.
Remove the duplicate formatter and unused imports, update response documentation, and cover surrounding spaces in selected package names and versions. Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
|
Addressed in d2cd3f8. Package names and versions now use TypeScript, lint, generated definitions, all 2,013 MCP core tests, and synthetic CLI stdio checks for both readers in Markdown and JSON passed. The full local suite still has the two existing macOS environment failures in CLI tests (missing Xcode |
There was a problem hiding this comment.
Looks good to me now. d2cd3f8 switches package rendering to the shared inlineCode, removes the duplicate helper and both unused imports, and the new test pins the surrounding-space padding. mcp-core tsc and tests and repo-wide lint pass locally on this head.
Summary
Adds optional
packageNamesselection to exact-event reads throughget_sentry_resourceandget_issue_details, so dependency compatibility diagnosis can use versions recorded with the event. Returns up to 10 selected packages instructuredContentfor supported event types in experimental mode, and in Markdown responses otherwise, with distinct states for unavailable metadata and unlisted packages and bounded version lengths. Calls without a selection retain their existing output, with no additional API requests.Fixes #1292.
Before / After