@blaxel/core 0.3.7-preview.228 → 0.3.7-preview.230

package/dist/cjs-browser/common/sentry.test.js

@@ -0,0 +1,224 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const mockSettings = vitest_1.vi.hoisted(() => ({
+    tracking: true,
+    sentryDsn: "https://public-key@sentry.example/123",
+    env: "prod",
+    version: "9.9.9",
+    commit: "abcdef0",
+    workspace: "private-workspace",
+}));
+vitest_1.vi.mock("./settings.js", () => ({ settings: mockSettings }));
+const appFrameUrl = "file:///Users/customer/private-project/app.ts";
+function makeSdkError(message = "secret response body for resource customer-123") {
+    // This helper lives under the exact @blaxel/core source root, so its real
+    // runtime frame exercises package-root attribution without test hooks.
+    return new TypeError(message);
+}
+function makeApplicationError() {
+    const sdkFrame = makeSdkError().stack
+        ?.split("\n")
+        .find((line) => line.includes("sentry.test"));
+    if (!sdkFrame)
+        throw new Error("Expected a real SDK test frame");
+    const error = new Error("application secret");
+    error.stack = [
+        "Error: application secret",
+        `    at application (${appFrameUrl}:10:20)`,
+        sdkFrame,
+    ].join("\n");
+    return error;
+}
+function makeTraversalStackError() {
+    const sdkFrame = makeSdkError().stack
+        ?.split("\n")
+        .find((line) => line.includes("sentry.test"));
+    if (!sdkFrame)
+        throw new Error("Expected a real SDK test frame");
+    const forgedFrame = sdkFrame.replace(/([\\/])src\1common\1sentry\.test\.ts/, "$1src$1..$1private$1customer-secret.ts");
+    if (forgedFrame === sdkFrame)
+        throw new Error("Expected to forge the SDK frame path");
+    const error = new Error("application secret");
+    error.stack = ["Error: application secret", forgedFrame].join("\n");
+    return error;
+}
+function eventFromFetch(fetchMock) {
+    const request = fetchMock.mock.calls[0]?.[1];
+    if (typeof request?.body !== "string")
+        throw new Error("Expected a string Sentry envelope");
+    return JSON.parse(request.body.split("\n")[2]);
+}
+function emitUncaughtExceptionMonitor(error) {
+    const processWithStringEvents = process;
+    return processWithStringEvents.emit("uncaughtExceptionMonitor", error, "uncaughtException");
+}
+(0, vitest_1.describe)("SDK Sentry boundary", () => {
+    let originalMonitorListeners;
+    (0, vitest_1.beforeEach)(() => {
+        vitest_1.vi.resetModules();
+        mockSettings.tracking = true;
+        mockSettings.sentryDsn = "https://public-key@sentry.example/123";
+        mockSettings.env = "prod";
+        originalMonitorListeners = process.listeners("uncaughtExceptionMonitor");
+    });
+    (0, vitest_1.afterEach)(() => {
+        vitest_1.vi.unstubAllGlobals();
+        for (const listener of process.listeners("uncaughtExceptionMonitor")) {
+            if (!originalMonitorListeners.includes(listener)) {
+                process.removeListener("uncaughtExceptionMonitor", listener);
+            }
+        }
+        vitest_1.vi.restoreAllMocks();
+    });
+    (0, vitest_1.it)("does not replace console.error or report caught errors", async () => {
+        const fetchMock = vitest_1.vi.fn().mockResolvedValue({ ok: true });
+        const hostConsoleError = vitest_1.vi.fn();
+        vitest_1.vi.stubGlobal("fetch", fetchMock);
+        vitest_1.vi.spyOn(console, "error").mockImplementation(hostConsoleError);
+        const { initSentry } = await Promise.resolve().then(() => __importStar(require("./sentry.js")));
+        initSentry();
+        const installedConsoleError = console.error;
+        console.error(makeSdkError());
+        (0, vitest_1.expect)(console.error).toBe(installedConsoleError);
+        (0, vitest_1.expect)(hostConsoleError).toHaveBeenCalledOnce();
+        (0, vitest_1.expect)(fetchMock).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("composes with host handlers and reports one sanitized SDK-owned event", async () => {
+        const fetchMock = vitest_1.vi.fn().mockResolvedValue({ ok: true });
+        const hostMonitor = vitest_1.vi.fn();
+        const hostRejection = vitest_1.vi.fn();
+        vitest_1.vi.stubGlobal("fetch", fetchMock);
+        process.on("uncaughtExceptionMonitor", hostMonitor);
+        process.on("unhandledRejection", hostRejection);
+        const rejectionListeners = process.listeners("unhandledRejection");
+        try {
+            const { flushSentry, initSentry } = await Promise.resolve().then(() => __importStar(require("./sentry.js")));
+            initSentry();
+            const error = makeSdkError();
+            emitUncaughtExceptionMonitor(error);
+            emitUncaughtExceptionMonitor(error);
+            await flushSentry();
+            (0, vitest_1.expect)(hostMonitor).toHaveBeenCalledTimes(2);
+            (0, vitest_1.expect)(process.listeners("unhandledRejection")).toEqual(rejectionListeners);
+            (0, vitest_1.expect)(fetchMock).toHaveBeenCalledOnce();
+            const event = eventFromFetch(fetchMock);
+            (0, vitest_1.expect)(event.exception.values[0]).toMatchObject({
+                type: "TypeError",
+                value: "Unhandled SDK exception",
+            });
+            (0, vitest_1.expect)(event.tags).toEqual({
+                "blaxel.version": "9.9.9",
+                "blaxel.commit": "abcdef0",
+                "blaxel.error_source": "unhandled-sdk-exception",
+            });
+            (0, vitest_1.expect)(event.tags).not.toHaveProperty("blaxel.workspace");
+            const frames = event.exception.values[0].stacktrace.frames;
+            (0, vitest_1.expect)(frames.length).toBeGreaterThan(0);
+            for (const frame of frames) {
+                (0, vitest_1.expect)(frame.filename).toBe("@blaxel/core/src/common/sentry.test.ts");
+            }
+            const serialized = JSON.stringify(event);
+            (0, vitest_1.expect)(serialized).not.toContain("secret response body");
+            (0, vitest_1.expect)(serialized).not.toContain("customer-123");
+            (0, vitest_1.expect)(serialized).not.toContain("private-workspace");
+            (0, vitest_1.expect)(serialized).not.toContain("/Users/customer");
+        }
+        finally {
+            process.removeListener("uncaughtExceptionMonitor", hostMonitor);
+            process.removeListener("unhandledRejection", hostRejection);
+        }
+    });
+    (0, vitest_1.it)("does not attribute an application-owned exception with a later SDK frame", async () => {
+        const fetchMock = vitest_1.vi.fn().mockResolvedValue({ ok: true });
+        vitest_1.vi.stubGlobal("fetch", fetchMock);
+        const { initSentry } = await Promise.resolve().then(() => __importStar(require("./sentry.js")));
+        initSentry();
+        emitUncaughtExceptionMonitor(makeApplicationError());
+        (0, vitest_1.expect)(fetchMock).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("rejects a forged owned path containing parent traversal", async () => {
+        const fetchMock = vitest_1.vi.fn().mockResolvedValue({ ok: true });
+        vitest_1.vi.stubGlobal("fetch", fetchMock);
+        const { initSentry } = await Promise.resolve().then(() => __importStar(require("./sentry.js")));
+        initSentry();
+        emitUncaughtExceptionMonitor(makeTraversalStackError());
+        (0, vitest_1.expect)(fetchMock).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("contains delivery setup failures without creating an unhandled rejection", async () => {
+        const fetchMock = vitest_1.vi.fn().mockResolvedValue({ ok: true });
+        vitest_1.vi.stubGlobal("fetch", fetchMock);
+        vitest_1.vi.stubGlobal("AbortController", class FailingAbortController {
+            constructor() {
+                throw new Error("host AbortController failure");
+            }
+        });
+        const { flushSentry, initSentry } = await Promise.resolve().then(() => __importStar(require("./sentry.js")));
+        initSentry();
+        emitUncaughtExceptionMonitor(makeSdkError());
+        await flushSentry();
+        (0, vitest_1.expect)(fetchMock).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("composes with browser handlers and ignores primitive rejections", async () => {
+        const fetchMock = vitest_1.vi.fn().mockResolvedValue({ ok: true });
+        const listeners = new Map();
+        const addEventListener = vitest_1.vi.fn((type, listener) => {
+            listeners.set(type, listener);
+        });
+        vitest_1.vi.stubGlobal("fetch", fetchMock);
+        vitest_1.vi.stubGlobal("process", undefined);
+        vitest_1.vi.stubGlobal("addEventListener", addEventListener);
+        const { flushSentry, initSentry } = await Promise.resolve().then(() => __importStar(require("./sentry.js")));
+        initSentry();
+        (0, vitest_1.expect)(addEventListener).toHaveBeenCalledWith("error", vitest_1.expect.any(Function));
+        (0, vitest_1.expect)(addEventListener).toHaveBeenCalledWith("unhandledrejection", vitest_1.expect.any(Function));
+        listeners.get("unhandledrejection")?.({ reason: "raw rejection secret" });
+        listeners.get("error")?.({ error: makeSdkError() });
+        await flushSentry();
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledOnce();
+        (0, vitest_1.expect)(JSON.stringify(eventFromFetch(fetchMock))).not.toContain("raw rejection secret");
+    });
+    (0, vitest_1.it)("does not initialize when tracking is disabled", async () => {
+        const fetchMock = vitest_1.vi.fn().mockResolvedValue({ ok: true });
+        vitest_1.vi.stubGlobal("fetch", fetchMock);
+        mockSettings.tracking = false;
+        const { initSentry, isSentryInitialized } = await Promise.resolve().then(() => __importStar(require("./sentry.js")));
+        initSentry();
+        emitUncaughtExceptionMonitor(makeSdkError());
+        (0, vitest_1.expect)(isSentryInitialized()).toBe(false);
+        (0, vitest_1.expect)(fetchMock).not.toHaveBeenCalled();
+    });
+});

package/dist/cjs-browser/common/settings.js

@@ -30,8 +30,8 @@ function missingCredentialsMessage() {
     return "No Blaxel credentials found. Set the BL_API_KEY and BL_WORKSPACE environment variables, or run `bl login`.";
 }
 // Build info - these placeholders are replaced at build time by build:replace-imports
-const BUILD_VERSION = "0.3.7-preview.228";
-const BUILD_COMMIT = "f36e6060f2d58224e93de8487dcc1dcc9a485c28";
+const BUILD_VERSION = "0.3.7-preview.230";
+const BUILD_COMMIT = "110dd5983dfa658153d44e36dc9b02ffe6a90d77";
 const BUILD_SENTRY_DSN = "https://fd5e60e1c9820e1eef5ccebb84a07127@o4508714045276160.ingest.us.sentry.io/4510465864564736";
 const BLAXEL_API_VERSION = "2026-04-28";
 // Bun < 1.3.11 never sends connection-level WINDOW_UPDATE: the pooled h2

package/dist/cjs-browser/types/common/lazyInit.d.ts

@@ -7,8 +7,8 @@
  *     populates `BL_ENV` if the user has a dev workspace configured).
  *   - Re-apply the control-plane and sandbox clients' `baseUrl` so they
  *     target the now-env-aware endpoint.
- *   - Initialize the lightweight Sentry client (registers
- *     `uncaughtExceptionMonitor` and patches `console.error` in Node).
+ *   - Initialize the lightweight Sentry client (registers a composable
+ *     `uncaughtExceptionMonitor` handler in Node).
  *   - Pre-warm the edge H2 connection pool for `settings.region`.
  *
  * These used to run at module load, but that meant `import "@blaxel/core"`

package/dist/cjs-browser/types/common/sentry.d.ts

@@ -1,15 +1,11 @@
 /**
- * Initialize the lightweight Sentry client for SDK error tracking.
+ * Initialize opt-in SDK error tracking. Registration composes with host global
+ * handlers and never replaces console, process, or browser callbacks.
  */
 export declare function initSentry(): void;
 /**
- * Flush pending Sentry events.
- * This should be called before the process exits to ensure all events are sent.
- *
- * @param timeout - Maximum time in milliseconds to wait for flush (default: 2000)
+ * Await only deliveries already in flight, bounded by the supplied timeout.
+ * Events are sent exactly once; flush never re-enqueues them.
  */
 export declare function flushSentry(timeout?: number): Promise<void>;
-/**
- * Check if Sentry is initialized and available.
- */
 export declare function isSentryInitialized(): boolean;

package/dist/cjs-browser/types/common/sentry.test.d.ts

@@ -0,0 +1 @@
+export {};