Skip to content

fix(cli): Skip DSN scan from $HOME and temp roots for every root reason - #1930

Merged
BYK merged 1 commit into
mainfrom
fix/dsn-skip-scan-home-tmp-roots
Nov 4, 2026
Merged

BYK merged 1 commit into
mainfrom
fix/dsn-skip-scan-home-tmp-roots

Conversation

@sentry-junior

@sentry-junior sentry-junior Bot commented Nov 4, 2026

Copy link
Copy Markdown
Contributor

Fixes the scan-scope half of CLI-1ES (scandir errors, ~20k events).

The findProjectRoot spans on the failing events show the CLI isn't failing inside projects. It's walking roots that aren't projects at all:

  • $HOME with reason: language: a stray ~/package.json makes $HOME the project root, including for runs that start in a marker-less subdir like ~/.agent/workspaces/<id>. The fix(cli): Send native detector datasets and conditions for metric alerts #1591 guard only checks reason === "fallback", so these runs still walk ~/Library/CloudStorage, ~/OrbStack, OneDrive FUSE mounts, and ~/Documents/*.trace. That's where the ETIMEDOUT / EIO / errno -11 / ECANCELED events come from. It can also pick up an unrelated DSN from anywhere under $HOME.
  • /tmp with reason: fallback: this walks other processes' FUSE mounts (AppImage /tmp/.mount_*, FreeRDP clipboard dirs), which fail with ENOTCONN.

shouldSkipDownwardScan() now skips the file scan whenever the root is $HOME, an ancestor of $HOME, or a shared temp root, no matter which marker picked it. SENTRY_DSN still works. A project with a marker inside /tmp still gets scanned.

Before: detectAllDsns() with ~/package.json and a leftover ~/notes/old-demo.ts, run from ~ or ~/.agent/ws1:

{
  "projectRoot": "~",
  "reason": "language",
  "detected": ["https://abc@o1.ingest.sentry.io/1  (notes/old-demo.ts)"]
}

After: same setup, sentry issue list --verbose:

[debug] [resolve-target] No config defaults set, trying DSN auto-detection
[debug] [dsn] Skipping DSN file scan: project root ~ (language) is the home directory, an ancestor of it, or a shared temp directory
[debug] [resolve-target] No DSNs found in source code or env files, trying directory name inference
{ "projectRoot": "~", "reason": "language", "detected": [] }

Tradeoff: a marker-less directory under a $HOME that has a marker no longer gets scanned. Before this change it scanned all of $HOME. SENTRY_DSN, .sentryclirc, or a project marker in that directory covers it.

via bete.

--

View Session [Sentry]

The home-fallback guard only skipped the downward scan when project-root
detection fell back to $HOME. A stray ~/package.json, ~/Makefile or dotfiles
~/.git makes $HOME the root with reason language/build_system/vcs, so the CLI
still walked all of $HOME (cloud-storage and FUSE mounts, ~/Library) and
could pick up an unrelated DSN. Running from /tmp scanned other processes'
FUSE mounts (AppImage, FreeRDP).

Fixes CLI-1ES

Co-Authored-By: Miguel Betegon <miguel.betegon@sentry.io>
@vercel

vercel Bot commented Nov 4, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
sentry-local Skipped Skipped Nov 4, 2026 9:40am UTC

Request Review

@BYK
BYK merged commit 0e19ede into main Nov 4, 2026
27 checks passed
@BYK
BYK deleted the fix/dsn-skip-scan-home-tmp-roots branch November 4, 2026 14:52
BYK pushed a commit that referenced this pull request Nov 4, 2026
)

Fixes the error-reporting half of
[CLI-1ES](https://sentry.sentry.io/issues/7438547903/). The scan-scope
half is #1930.

`handleFileError` decides which filesystem errors get reported, and it
uses an allowlist that has grown one errno per PR: EINVAL (#1286), ELOOP
(#1320), ETIMEDOUT (#1217), Unknown system error (#1601), and ENOTCONN.
Every new kind of broken mount becomes another Sentry event. CLI-1ES
still collects EIO (OneDrive FUSE vault), ECANCELED (macOS `.trace`
bundles), and EINTR (cloud-storage dirs). The walker already skips the
unreadable dir either way, so these events tell us nothing actionable.

This flips the check. Any POSIX errno (`/^E[A-Z0-9]+$/` or `UNKNOWN`)
counts as an environmental failure, except `EMFILE` / `ENFILE` /
`ENOMEM` / `EBADF`. Those four point at our own descriptor or memory
handling, so they still get reported. Node `ERR_*` codes and errors with
no code are still reported too. Skipped paths now show up at debug
level, which also fixes the silent catch.

**Before**: `handleFileError()` with real libuv-shaped `scandir` errors:
```
→ Sentry event: Error: EIO: i/o error, scandir  [operation=scan.walk.readdir]
→ Sentry event: Error: ENOTCONN: socket is not connected, scandir  [operation=scan.walk.readdir]
→ Sentry event: Error: ECANCELED: operation canceled, scandir  [operation=scan.walk.readdir]
```
(ENOTCONN is already ignored on `main`. EIO and ECANCELED aren't.)

**After**: no Sentry events. With `--verbose`:
```
[debug] [fs] scan.walk.readdir: skipped unreadable path (EIO: i/o error, scandir '~/OneDrive/Personal Vault')
[debug] [fs] scan.walk.readdir: skipped unreadable path (ENOTCONN: socket is not connected, scandir '/tmp/.mount_app')
[debug] [fs] scan.walk.readdir: skipped unreadable path (ECANCELED: operation canceled, scandir '~/Documents/report.trace')
```

ENOENT isn't logged, because `isRegularFile` probes hit it constantly.

<!-- junior-request-attribution:start -->
via **bete**.
<!-- junior-request-attribution:end -->

<!-- junior-session-footer:start -->
<!-- junior-conversation-id:slack%3AC0C615WFS9G%3A1793783876.619939 -->

--

[View
Session](https://junior-prod.sentry.dev/conversations/slack%3AC0C615WFS9G%3A1793783876.619939)
[[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0C615WFS9G%3A1793783876.619939/?project=4510944073809921)

<!-- junior-session-footer:end -->

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: Miguel Betegon <miguel.betegon@sentry.io>

This branch was previously deployed

1 inactive deployment
Preview — 85c49709 Deployed Nov 4, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

risk: medium PR risk score: medium

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant