fix(sourcemap): let inject run without authentication - #1526
Merged
Merged
Conversation
`sentry sourcemap inject` only rewrites local JS and sourcemap files and never calls the Sentry API, but it has required credentials since getsentry#611 made authentication the default for every command. The opt-out list in that change did not include the sourcemap commands, so `inject` (added a week earlier in getsentry#547) started failing with `AuthError("not_authenticated")` from 0.23.0 onward. `sourcemap resolve`, the other local-only command in the group, already sets `auth: false`. Set `auth: false` on the inject command and add a regression test that runs it with a fresh config dir and no env token. `test/preload.ts` sets a fake `SENTRY_AUTH_TOKEN` for all tests, which is why this went unnoticed.
|
@Gyeonghun-Park is attempting to deploy a commit to the Sentry Team on Vercel. A member of the Team first needs to authorize it. |
BYK
enabled auto-merge (squash)
September 2, 2026 17:45
5 tasks
betegon
added a commit
that referenced
this pull request
Sep 22, 2026
…, sourcemap auth, stale CONTRIBUTING ref (#1540) ## Documentation Audit Report — 2026-09-07 Weekly audit of the Sentry CLI documentation against the implementation. Covers all changes since the last audit (PR #1514, merged 2026-08-31). --- ### Changes in This PR **1. init.md: Remove gated features and add `mcp-observability`** PR #1535 (`fix(init): gate unsupported --features`) removed `metrics`, `sourcemaps`, and `attachments` from `SUPPORTED_FEATURE_NAMES` because their setup isn't fully automated yet. The init fragment still listed `metrics` and `sourcemaps` as available features. Also, `mcp-observability` was added as a supported feature but was missing from the docs. - **Source:** `src/commands/init.ts` lines 68–77 (`SUPPORTED_FEATURE_NAMES`) - **Doc file:** `apps/cli-docs/src/fragments/commands/init.md` **2. explore.md: Add `replays` dataset documentation** The `sentry explore` command supports five datasets (`errors`, `spans`, `metrics`, `logs`, `replays`), but the explore fragment had zero documentation for the `replays` dataset — no examples, no mention in any dataset listing. Added a Replays example section and a complete Datasets reference table. - **Source:** `src/commands/explore.ts` lines 100–106 (`VALID_DATASETS`) - **Doc file:** `apps/cli-docs/src/fragments/commands/explore.md` **3. sourcemap.md: Note that `sourcemap inject` runs without authentication** PR #1526 (`fix(sourcemap): let inject run without authentication`) set `auth: false` on the inject command, making it explicit that it's a purely local file operation. The docs didn't mention this, which is important for CI pipelines where inject should run before auth. - **Source:** `src/commands/sourcemap/inject.ts` line 74 (`auth: false`) - **Doc file:** `apps/cli-docs/src/fragments/commands/sourcemap.md` **4. CONTRIBUTING.md: Fix stale `sentry config set` reference** The Context Resolution section referenced `sentry config set`, which was renamed to `sentry cli defaults` long ago. - **Source:** `src/commands/cli/defaults.ts` (the actual command) - **Doc file:** `packages/cli/CONTRIBUTING.md` line 47 --- ### Full Gap Report #### A. Undocumented or Missing Commands/Subcommands No gaps. All commands have auto-generated doc pages via `generate-command-docs.ts`, and every route in `src/app.ts` produces a page under `commands/`. The `groupRoutesByReference()` function creates an automatic 1:1 mapping. #### B. Undocumented Flags No new gaps. All non-hidden flags are auto-generated into the Options tables by the command doc generator. The only hidden flags (`src/commands/cli/setup.ts`, `src/commands/bash-hook.ts`) are intentionally hidden. #### C. Missing Usage Examples | Gap | Status | |-----|--------| | `sentry explore --dataset replays` — no examples in fragment | **Fixed in this PR** | #### D. Stale Descriptions | Gap | Status | |-----|--------| | init.md listed `metrics`, `sourcemaps` as features — removed in PR #1535 | **Fixed in this PR** | | init.md missing `mcp-observability` feature — added in same PR | **Fixed in this PR** | | CONTRIBUTING.md references `sentry config set` instead of `sentry cli defaults` | **Fixed in this PR** | #### E. Missing Route Mappings in Skill Generator N/A — `ROUTE_TO_REFERENCE` was removed in a prior refactor. `groupRoutesByReference()` now automatically maps each visible route to its own reference file. #### F. Installation / Distribution Gaps No new gaps since last audit. The install script flags (`--no-modify-path`, `--no-completions`, `--no-agent-skills`) and env vars (`SENTRY_INSTALL_DIR`, `SENTRY_VERSION`, `SENTRY_INIT`) are documented in `getting-started.mdx`. The platform support table is auto-generated. #### G. Undocumented Environment Variables No new gaps. The env registry (`src/lib/env-registry.ts`) has 27 entries, all documented via auto-generation. Previously identified niche variables (`SENTRY_ENVIRONMENT`, `SENTRY_DIST`, `SENTRY_CLI_NO_EXIT_TRAP`, `SENTRY_SCAN_DISABLE_WORKERS`, `SENTRY_RN_*`) remain intentionally excluded as they are internal, test-only, or legacy bash-hook scoped. #### H. Auth / Self-Hosted Gaps No new gaps. The `sourcemap inject` auth-free change (PR #1526) is now documented. #### I. Plugin/Skills Gaps No new gaps since PR #1514. Skills install targets (`~/.claude`, `~/.agents`), dotagents integration, and the automatic install on `sentry cli setup` / `sentry cli upgrade` are accurately documented. The `plugins/README.md` correctly references the current `.claude-plugin` structure. #### J. README / DEVELOPMENT.md Drift | Claim | Status | |-------|--------| | README: Node.js 20+, dev 22.15+ | Matches `package.json` (`engines.node: ">=20.0"`, `devEngines.runtime.version: ">=22.15"`) | | README: pnpm 10.11+ | Matches `pnpm-workspace.yaml` constraints | | README: License FSL-1.1-Apache-2.0 | Matches `LICENSE.md` | | README: Build/test commands | Match `package.json` scripts | | CONTRIBUTING.md: `sentry config set` | **Fixed in this PR** | --- ### Top 5 Most Impactful Fixes (Prioritized) 1. **init.md feature list stale** — Users/agents running `sentry init --features metrics` or `sentry init --features sourcemaps` would get a confusing `Unknown init feature` error. High-impact because init is the onboarding entry point. 2. **explore replays undocumented** — The entire `replays` dataset was silently available but had zero documentation. Users and agents had no way to discover this capability. 3. **sourcemap inject auth note** — CI pipelines commonly run `inject` before `upload`. Knowing inject doesn't need auth lets pipelines defer authentication, simplifying pipeline ordering. 4. **CONTRIBUTING.md stale command reference** — Contributors following the guide would try a non-existent `sentry config set` command. 5. **mcp-observability feature undocumented** — New init feature for MCP/agent observability was missing from docs, preventing discovery of this capability. <div><a href="https://cursor.com/agents/bc-fee4f405-65bc-4c62-ba8c-8f93d952a974?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/automations/8b0c0f35-da5e-409d-984c-5e39518ffb8a"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/view-automation-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/view-automation-light.png"><img alt="View Automation" width="141" height="28" src="https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Miguel Betegón <miguelbetegongarcia@gmail.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
![https://cursor.com/assets/images/open-in-web-dark.png"><source](https://cursor.com/assets/images/open-in-web-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-web-light.png"><img](https://cursor.com/assets/images/open-in-web-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a](https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a){kind=link}
![https://cursor.com/assets/images/view-automation-dark.png"><source](https://cursor.com/assets/images/view-automation-dark.png"><source){kind=link}
![https://cursor.com/assets/images/view-automation-light.png"><img](https://cursor.com/assets/images/view-automation-light.png"><img){kind=link}
![https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div](https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div){kind=link}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1525
Problem
sentry sourcemap injectthrowsAuthError("not_authenticated")when no credentials exist, although it only rewrites local JS and.mapfiles and never calls the Sentry API. #611 made authentication the default for everybuildCommandand opted out the commands that work without a token, butsourcemap inject(added in #547 a week earlier) was not on that list, so it has required credentials since 0.23.0.sourcemap resolve, the other local-only command in the group, already setsauth: false.Fix
Set
auth: falseoninjectCommand, with the same commentresolve.tsuses.sourcemap uploadstill requires authentication; no docs or generated files change.Tests
New
test/commands/sourcemap/inject.test.tsruns the command with a fresh config dir and withSENTRY_AUTH_TOKEN,SENTRY_TOKEN, andSENTRY_FORCE_ENV_TOKENcleared, then asserts the JS receives a//# debugId=comment and the map adebugIdfield. It fails onmainwithAuthError: Not authenticated. Run 'sentry auth login' first.and passes with this change. The existing suite did not catch the regression becausetest/preload.tssets a placeholder token for every test.Verified locally (macOS arm64, Node.js 26.8.1, pnpm 10.11.0):
biome checkon the touched files,pnpm typecheck(no generated-file changes), andvitest run test/commands/sourcemap(36 passed). Inpnpm test, 7 tests intest/lib/time-range.test.tsandtest/lib/delta-upgrade.mocked.test.tsfail in this environment on an unmodifiedmainas well (timezone-dependent, local TZ is UTC+9), so they are unrelated. E2E and binary builds were not run.Breaking change
No.
Thank you for reviewing. Happy to move the test next to the existing inject tests in
upload.test.tsor adjust the approach if you prefer.