Repository navigation
fix(cli): Skip DSN scan from $HOME and temp roots for every root reason - #1930
Merged
Merged
Conversation
The home-fallback guard only skipped the downward scan when project-root detection fell back to $HOME. A stray ~/package.json, ~/Makefile or dotfiles ~/.git makes $HOME the root with reason language/build_system/vcs, so the CLI still walked all of $HOME (cloud-storage and FUSE mounts, ~/Library) and could pick up an unrelated DSN. Running from /tmp scanned other processes' FUSE mounts (AppImage, FreeRDP). Fixes CLI-1ES Co-Authored-By: Miguel Betegon <miguel.betegon@sentry.io>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
BYK
approved these changes
Nov 4, 2026
BYK
pushed a commit
that referenced
this pull request
Nov 4, 2026
) Fixes the error-reporting half of [CLI-1ES](https://sentry.sentry.io/issues/7438547903/). The scan-scope half is #1930. `handleFileError` decides which filesystem errors get reported, and it uses an allowlist that has grown one errno per PR: EINVAL (#1286), ELOOP (#1320), ETIMEDOUT (#1217), Unknown system error (#1601), and ENOTCONN. Every new kind of broken mount becomes another Sentry event. CLI-1ES still collects EIO (OneDrive FUSE vault), ECANCELED (macOS `.trace` bundles), and EINTR (cloud-storage dirs). The walker already skips the unreadable dir either way, so these events tell us nothing actionable. This flips the check. Any POSIX errno (`/^E[A-Z0-9]+$/` or `UNKNOWN`) counts as an environmental failure, except `EMFILE` / `ENFILE` / `ENOMEM` / `EBADF`. Those four point at our own descriptor or memory handling, so they still get reported. Node `ERR_*` codes and errors with no code are still reported too. Skipped paths now show up at debug level, which also fixes the silent catch. **Before**: `handleFileError()` with real libuv-shaped `scandir` errors: ``` → Sentry event: Error: EIO: i/o error, scandir [operation=scan.walk.readdir] → Sentry event: Error: ENOTCONN: socket is not connected, scandir [operation=scan.walk.readdir] → Sentry event: Error: ECANCELED: operation canceled, scandir [operation=scan.walk.readdir] ``` (ENOTCONN is already ignored on `main`. EIO and ECANCELED aren't.) **After**: no Sentry events. With `--verbose`: ``` [debug] [fs] scan.walk.readdir: skipped unreadable path (EIO: i/o error, scandir '~/OneDrive/Personal Vault') [debug] [fs] scan.walk.readdir: skipped unreadable path (ENOTCONN: socket is not connected, scandir '/tmp/.mount_app') [debug] [fs] scan.walk.readdir: skipped unreadable path (ECANCELED: operation canceled, scandir '~/Documents/report.trace') ``` ENOENT isn't logged, because `isRegularFile` probes hit it constantly. <!-- junior-request-attribution:start --> via **bete**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AC0C615WFS9G%3A1793783876.619939 --> -- [View Session](https://junior-prod.sentry.dev/conversations/slack%3AC0C615WFS9G%3A1793783876.619939) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0C615WFS9G%3A1793783876.619939/?project=4510944073809921) <!-- junior-session-footer:end --> Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Miguel Betegon <miguel.betegon@sentry.io>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the scan-scope half of CLI-1ES (
scandirerrors, ~20k events).The
findProjectRootspans on the failing events show the CLI isn't failing inside projects. It's walking roots that aren't projects at all:$HOMEwithreason: language: a stray~/package.jsonmakes$HOMEthe project root, including for runs that start in a marker-less subdir like~/.agent/workspaces/<id>. The fix(cli): Send native detector datasets and conditions for metric alerts #1591 guard only checksreason === "fallback", so these runs still walk~/Library/CloudStorage,~/OrbStack, OneDrive FUSE mounts, and~/Documents/*.trace. That's where the ETIMEDOUT / EIO / errno -11 / ECANCELED events come from. It can also pick up an unrelated DSN from anywhere under$HOME./tmpwithreason: fallback: this walks other processes' FUSE mounts (AppImage/tmp/.mount_*, FreeRDP clipboard dirs), which fail with ENOTCONN.shouldSkipDownwardScan()now skips the file scan whenever the root is$HOME, an ancestor of$HOME, or a shared temp root, no matter which marker picked it.SENTRY_DSNstill works. A project with a marker inside/tmpstill gets scanned.Before:
detectAllDsns()with~/package.jsonand a leftover~/notes/old-demo.ts, run from~or~/.agent/ws1:{ "projectRoot": "~", "reason": "language", "detected": ["https://abc@o1.ingest.sentry.io/1 (notes/old-demo.ts)"] }After: same setup,
sentry issue list --verbose:{ "projectRoot": "~", "reason": "language", "detected": [] }Tradeoff: a marker-less directory under a
$HOMEthat has a marker no longer gets scanned. Before this change it scanned all of$HOME.SENTRY_DSN,.sentryclirc, or a project marker in that directory covers it.via bete.
--
View Session [Sentry]