@goliapkg/sentori-cli 0.6.0 → 1.1.0

package/src/probes.ts

@@ -0,0 +1,75 @@
+// `sentori-cli probes sync` — the tripwire registry scan
+// (design.md §2). Statically scans source for `sentori.probe('REF')`
+// / `probe("REF")` call sites and registers the refs against a
+// release, so the server can tell a silent probe (fix holding) from
+// deleted code.
+
+import { readdirSync, readFileSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+
+const PROBE_RE = /\bprobe\(\s*['"`]([^'"`]{1,200})['"`]/g
+const SCAN_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'])
+const SKIP_DIRS = new Set(['node_modules', '.git', 'lib', 'dist', 'build', '.expo'])
+const MAX_FILES = 20_000
+
+export function scanProbes(root: string): string[] {
+  const refs = new Set<string>()
+  let seen = 0
+  const walk = (dir: string): void => {
+    if (seen > MAX_FILES) return
+    let entries: string[]
+    try {
+      entries = readdirSync(dir)
+    } catch {
+      return
+    }
+    for (const name of entries) {
+      if (SKIP_DIRS.has(name)) continue
+      const p = join(dir, name)
+      let st
+      try {
+        st = statSync(p)
+      } catch {
+        continue
+      }
+      if (st.isDirectory()) {
+        walk(p)
+      } else if (st.isFile()) {
+        const dot = name.lastIndexOf('.')
+        if (dot === -1 || !SCAN_EXTS.has(name.slice(dot))) continue
+        seen += 1
+        try {
+          const text = readFileSync(p, 'utf8')
+          for (const m of text.matchAll(PROBE_RE)) {
+            const ref = m[1]
+            if (ref) refs.add(ref)
+          }
+        } catch {
+          // unreadable file — skip
+        }
+      }
+    }
+  }
+  walk(root)
+  return [...refs].sort()
+}
+
+export async function syncProbes(opts: {
+  apiUrl: string
+  token: string
+  release: string
+  refs: string[]
+}): Promise<{ registered: number }> {
+  const resp = await fetch(`${opts.apiUrl.replace(/\/+$/, '')}/api/probes:sync`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${opts.token}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ release: opts.release, refs: opts.refs }),
+  })
+  if (!resp.ok) {
+    throw new Error(`probes:sync ${resp.status} ${await resp.text().catch(() => '')}`)
+  }
+  return (await resp.json()) as { registered: number }
+}

package/src/react-native.ts

@@ -4,7 +4,8 @@ import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
-import { uploadSourcemaps } from './upload.js'
+import { uploadArtifact } from './upload.js'
+import { basename } from 'node:path'
 
 /** Resolve `react-native/scripts/compose-source-maps.js` from the
  *  current project's node_modules. Returns null if react-native isn't
@@ -68,14 +69,20 @@ export async function reactNativeUpload(opts: RnUploadOptions): Promise<{
   const composed = composeSourceMaps(opts.metroMap, opts.hermesMap)
   try {
     const paths = [composed, ...(opts.bundle ? [opts.bundle] : [])]
-    const r = await uploadSourcemaps({
-      apiUrl: opts.apiUrl,
-      dryRun: opts.dryRun,
-      paths,
-      release: opts.release,
-      token: opts.token,
-    })
-    return { files: r.files, uploaded: r.uploaded }
+    if (opts.dryRun) return { files: paths }
+    let uploaded = 0
+    for (const p of paths) {
+      await uploadArtifact({
+        apiUrl: opts.apiUrl,
+        token: opts.token,
+        release: opts.release,
+        kind: 'sourcemap',
+        path: p,
+        name: basename(p),
+      })
+      uploaded += 1
+    }
+    return { files: paths, uploaded }
   } finally {
     try {
       rmSync(composed, { force: true })

package/src/upload.ts

@@ -1,85 +1,95 @@
-import { readFile, readdir, stat } from 'node:fs/promises'
-import { basename, join } from 'node:path'
+// Unified symbolication-artifact upload: sourcemap / dsym / proguard
+// all land on `POST /v1/releases/{release}/artifacts` (multipart
+// `kind` + `file`), authenticated with an api-scope token. A late
+// upload triggers retro-symbolication server-side, which is what
+// makes the lenient exit-0 contract honest — nothing is lost
+// forever.
+//
+// Uploads are gzipped on the wire (server ≥ 2.1.0 inflates
+// transparently). Symbolication artifacts compress well — a plain
+// R8 mapping ~10:1, DWARF ~3:1 — and the server's transport cap is
+// smaller than its decompressed cap precisely so that the big ones
+// (a real RN app's main dSYM runs hundreds of MB) fit as gzip.
 
-// Files worth uploading: source maps, and the bundle they map (so the
-// dashboard can show the minified line too if a frame falls outside
-// the map). `.jsbundle` (iOS) and `.bundle` (Android) are RN's bundle
-// names; `.hbc` is the Hermes bytecode bundle.
-const UPLOADABLE = /\.(map|js|jsbundle|bundle|hbc)$/i
+import { readFileSync } from 'node:fs'
+import { basename } from 'node:path'
+import { gzipSync } from 'node:zlib'
 
-export type UploadOptions = {
-  release: string
-  token: string
-  /** Sentori API base, e.g. https://sentori.golia.jp or your host. */
+export type UploadOpts = {
   apiUrl: string
-  /** Files or directories. Directories are scanned one level deep. */
-  paths: string[]
-  dryRun?: boolean
+  token: string
+  release: string
+  kind: 'dsym' | 'proguard' | 'sourcemap'
+  path: string
+  /** Override the stored artifact name (defaults to the filename). */
+  name?: string
 }
 
-export type UploadResult = {
-  files: string[]
-  uploaded?: number
-  artifacts?: { kind: string; name: string }[]
-}
+/** Transport-side limit on the current server (256 MB). Used only to
+ *  produce a useful error message — the server is the authority. */
+const WIRE_LIMIT = 256 * 1024 * 1024
 
-/** Resolve `paths` (files or dirs) to a deduped list of files to upload.
- *  A directory contributes its top-level `.map` / `.js` / `.bundle` /
- *  `.hbc` files; a file given explicitly is taken as-is (even if its
- *  extension isn't in the list — the caller asked for it). */
-export async function collectFiles(paths: string[]): Promise<string[]> {
-  const out: string[] = []
-  for (const p of paths) {
-    const s = await stat(p).catch(() => null)
-    if (!s) throw new Error(`no such file or directory: ${p}`)
-    if (s.isDirectory()) {
-      for (const entry of await readdir(p)) {
-        const full = join(p, entry)
-        const es = await stat(full).catch(() => null)
-        if (es?.isFile() && UPLOADABLE.test(entry)) out.push(full)
-      }
-    } else {
-      out.push(p)
-    }
-  }
-  const deduped = [...new Set(out)]
-  if (deduped.length === 0) {
-    throw new Error('no .map / .js / .bundle files found in the given path(s)')
+/** Gzip a payload for the wire (pass-through if it already is gzip),
+ *  renaming `foo` → `foo.gz` to match. Shared by every artifact
+ *  upload path so dSYM/mapping and sourcemap cannot drift. */
+export function gzipForWire(
+  bytes: Buffer | Uint8Array,
+  name: string,
+): { wire: Uint8Array; wireName: string } {
+  const alreadyGz = bytes.length >= 2 && bytes[0] === 0x1f && bytes[1] === 0x8b
+  const wire = alreadyGz ? new Uint8Array(bytes) : new Uint8Array(gzipSync(bytes))
+  const wireName = alreadyGz || name.endsWith('.gz') ? name : `${name}.gz`
+  if (wire.length > WIRE_LIMIT) {
+    throw new Error(
+      `${name} is ${Math.round(wire.length / 1024 / 1024)} MB gzipped — ` +
+        `over the server's ${WIRE_LIMIT / 1024 / 1024} MB transport limit even compressed`,
+    )
   }
-  return deduped
+  return { wire, wireName }
+}
+
+/** Exact-range copy into a standalone ArrayBuffer. `wire.buffer` is
+ *  NOT safe here: Node pools small Buffers, so the backing buffer can
+ *  be 16 KB of pool (offset view) — a Blob built on it would ship
+ *  garbage bytes around the payload. */
+export function wireArrayBuffer(wire: Uint8Array): ArrayBuffer {
+  return wire.buffer.slice(wire.byteOffset, wire.byteOffset + wire.byteLength) as ArrayBuffer
 }
 
-export async function uploadSourcemaps(opts: UploadOptions): Promise<UploadResult> {
-  const files = await collectFiles(opts.paths)
-  if (opts.dryRun) return { files }
+export async function uploadArtifact(opts: UploadOpts): Promise<{ id: string }> {
+  const bytes = readFileSync(opts.path)
+  if (bytes.length === 0) throw new Error(`empty file: ${opts.path}`)
+
+  // Already-compressed input (foo.map.gz) is passed through; the
+  // server strips the .gz suffix from the stored name after inflating.
+  const { wire, wireName } = gzipForWire(bytes, opts.name ?? basename(opts.path))
 
   const form = new FormData()
-  for (const f of files) {
-    const buf = await readFile(f)
-    form.append('file', new Blob([buf]), basename(f))
-  }
+  form.append('kind', opts.kind)
+  form.append('file', new Blob([wireArrayBuffer(wire)]), wireName)
 
-  const base = opts.apiUrl.replace(/\/+$/, '')
-  const url = `${base}/admin/api/releases/${encodeURIComponent(opts.release)}/sourcemaps`
-  const resp = await fetch(url, {
-    body: form,
-    headers: { Authorization: `Bearer ${opts.token}` },
-    method: 'POST',
-  })
-  if (!resp.ok) {
-    let detail = ''
-    try {
-      detail = await resp.text()
-    } catch {
-      // ignore
-    }
+  const url = `${opts.apiUrl.replace(/\/+$/, '')}/v1/releases/${encodeURIComponent(opts.release)}/artifacts`
+  let resp: Response
+  try {
+    resp = await fetch(url, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${opts.token}` },
+      body: form,
+    })
+  } catch (e) {
+    // A proxy that hits its body-size cap tends to reset the
+    // connection instead of answering, which surfaces here as a bare
+    // network error. Say so — "fetch failed" cost one team a round of
+    // debugging before they found the 413 underneath.
     throw new Error(
-      `${resp.status} ${resp.statusText}${detail ? ` — ${detail.slice(0, 300)}` : ''}`,
+      `network error (${e instanceof Error ? e.message : String(e)}) — ` +
+        `if the file is large this can be a proxy body-size cap rejecting ` +
+        `the upload (${Math.round(wire.length / 1024 / 1024)} MB on the wire)`,
     )
   }
-  const body = (await resp.json().catch(() => ({}))) as {
-    artifacts?: { kind: string; name: string }[]
-    uploaded?: number
+  if (!resp.ok) {
+    const detail = await resp.text().catch(() => '')
+    throw new Error(`${resp.status} ${resp.statusText}${detail ? ` — ${detail.slice(0, 200)}` : ''}`)
   }
-  return { artifacts: body.artifacts, files, uploaded: body.uploaded ?? files.length }
+  return (await resp.json()) as { id: string }
 }

package/src/__tests__/issue.test.ts

@@ -1,95 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-
-import { formatIssueLine, issueList, issuePatch } from '../issue.js'
-
-const cfg = {
-  apiUrl: 'https://api.example.com/',
-  projectId: 'proj-1',
-  token: 'sk_test',
-}
-
-const sample = {
-  errorType: 'TypeError',
-  eventCount: 17,
-  id: 'issue-1',
-  lastSeen: '2026-05-13T00:00:00Z',
-  messageSample: 'undefined is not an object',
-  status: 'active' as const,
-}
-
-const origFetch = globalThis.fetch
-let calls: { body: string | undefined; headers: Headers; method: string; url: string }[]
-beforeEach(() => {
-  calls = []
-})
-afterEach(() => {
-  globalThis.fetch = origFetch
-})
-
-function mockFetch(respBody: string, init: ResponseInit = { status: 200 }): void {
-  globalThis.fetch = (async (url: Request | string | URL, opts?: RequestInit) => {
-    calls.push({
-      body: typeof opts?.body === 'string' ? opts.body : undefined,
-      headers: new Headers(opts?.headers),
-      method: opts?.method ?? 'GET',
-      url: String(url),
-    })
-    return new Response(respBody, {
-      headers: { 'content-type': 'application/json' },
-      ...init,
-    })
-  }) as typeof fetch
-}
-
-describe('issueList', () => {
-  test('GETs /admin/api/projects/<id>/issues with query params + Bearer', async () => {
-    mockFetch(JSON.stringify([sample]))
-    const rows = await issueList({ config: cfg, limit: 20, status: 'active' })
-    expect(calls).toHaveLength(1)
-    expect(calls[0]?.method).toBe('GET')
-    expect(calls[0]?.url).toBe(
-      'https://api.example.com/admin/api/projects/proj-1/issues?status=active&limit=20',
-    )
-    expect(calls[0]?.headers.get('authorization')).toBe('Bearer sk_test')
-    expect(rows).toHaveLength(1)
-    expect(rows[0]?.id).toBe('issue-1')
-  })
-
-  test('omits empty query params', async () => {
-    mockFetch(JSON.stringify([]))
-    await issueList({ config: cfg })
-    expect(calls[0]?.url).toBe('https://api.example.com/admin/api/projects/proj-1/issues')
-  })
-
-  test('throws with server detail on non-2xx', async () => {
-    mockFetch('forbidden', { status: 403, statusText: 'Forbidden' })
-    await expect(issueList({ config: cfg })).rejects.toThrow('403 Forbidden — forbidden')
-  })
-})
-
-describe('issuePatch', () => {
-  test('PATCHes /issues/<id> with the body', async () => {
-    mockFetch(JSON.stringify({ ...sample, status: 'resolved' }))
-    const updated = await issuePatch(cfg, 'issue-1', {
-      resolvedInRelease: 'app@1.2.4+457',
-      status: 'resolved',
-    })
-    expect(calls[0]?.method).toBe('PATCH')
-    expect(calls[0]?.url).toBe('https://api.example.com/admin/api/projects/proj-1/issues/issue-1')
-    expect(JSON.parse(calls[0]?.body ?? '{}')).toEqual({
-      resolvedInRelease: 'app@1.2.4+457',
-      status: 'resolved',
-    })
-    expect(updated.status).toBe('resolved')
-  })
-})
-
-describe('formatIssueLine', () => {
-  test('renders id + status + title + event count on one line', () => {
-    const line = formatIssueLine(sample)
-    expect(line).toContain('issue-1')
-    expect(line).toContain('active')
-    expect(line).toContain('TypeError: undefined is not an object')
-    expect(line).toContain('17×')
-  })
-})

package/src/__tests__/source-bundle-from-dir.test.ts

@@ -1,85 +0,0 @@
-import { spawnSync } from 'node:child_process'
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-
-import { buildSourceBundleFromDir } from '../source-bundle.js'
-
-let dir = ''
-beforeEach(async () => {
-  dir = await mkdtemp(join(tmpdir(), 'sentori-cli-fromdir-'))
-  await mkdir(join(dir, 'Sources', 'MyApp'), { recursive: true })
-  await writeFile(join(dir, 'Sources', 'MyApp', 'View.swift'), '// swift\n')
-  await writeFile(join(dir, 'Sources', 'MyApp', 'Util.m'), '// objc\n')
-  await mkdir(join(dir, 'android', 'app', 'src'), { recursive: true })
-  await writeFile(join(dir, 'android', 'app', 'src', 'MainActivity.kt'), '// kotlin\n')
-  // Skips: hidden + skip-list + non-matching ext.
-  await mkdir(join(dir, 'node_modules', 'foo'), { recursive: true })
-  await writeFile(join(dir, 'node_modules', 'foo', 'index.swift'), '// should skip\n')
-  await mkdir(join(dir, 'Pods'), { recursive: true })
-  await writeFile(join(dir, 'Pods', 'a.swift'), '// should skip\n')
-  await mkdir(join(dir, '.git'), { recursive: true })
-  await writeFile(join(dir, '.git', 'config'), '\n')
-  await writeFile(join(dir, 'README.md'), '# readme\n')
-})
-afterEach(async () => {
-  await rm(dir, { force: true, recursive: true })
-})
-
-function listEntries(tarPath: string): string[] {
-  const r = spawnSync('tar', ['-tzf', tarPath])
-  if (r.status !== 0) throw new Error(`tar -t failed: ${r.stderr?.toString()}`)
-  return r.stdout
-    .toString()
-    .split('\n')
-    .map((s) => s.trim())
-    .filter(Boolean)
-}
-
-describe('buildSourceBundleFromDir', () => {
-  test('ios bundle includes .swift + .m + .h, excludes android + node_modules + Pods', async () => {
-    const { cleanup, path } = await buildSourceBundleFromDir(dir, 'ios')
-    try {
-      const entries = listEntries(path)
-      expect(entries).toContain('Sources/MyApp/View.swift')
-      expect(entries).toContain('Sources/MyApp/Util.m')
-      // No .kt
-      expect(entries.find((e) => e.endsWith('.kt'))).toBeUndefined()
-      // No node_modules
-      expect(entries.find((e) => e.startsWith('node_modules/'))).toBeUndefined()
-      // No Pods
-      expect(entries.find((e) => e.startsWith('Pods/'))).toBeUndefined()
-      // No .git
-      expect(entries.find((e) => e.startsWith('.git/'))).toBeUndefined()
-      // No README
-      expect(entries.find((e) => e.endsWith('.md'))).toBeUndefined()
-    } finally {
-      await cleanup()
-    }
-  })
-
-  test('android bundle picks .kt + .java only', async () => {
-    const { cleanup, path } = await buildSourceBundleFromDir(dir, 'android')
-    try {
-      const entries = listEntries(path)
-      expect(entries).toContain('android/app/src/MainActivity.kt')
-      expect(entries.find((e) => e.endsWith('.swift'))).toBeUndefined()
-      expect(entries.find((e) => e.endsWith('.m'))).toBeUndefined()
-    } finally {
-      await cleanup()
-    }
-  })
-
-  test('empty directory of the right ext throws a clear error', async () => {
-    const empty = await mkdtemp(join(tmpdir(), 'sentori-cli-empty-'))
-    try {
-      await expect(buildSourceBundleFromDir(empty, 'ios')).rejects.toThrow(
-        /no ios source files/,
-      )
-    } finally {
-      await rm(empty, { force: true, recursive: true })
-    }
-  })
-})

package/src/__tests__/source-bundle.test.ts

@@ -1,105 +0,0 @@
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-
-import { uploadSourceBundle } from '../source-bundle.js'
-
-const ADMIN = {
-  apiUrl: 'https://api.example.com/',
-  projectId: 'proj-1',
-  release: 'myapp@1.0.0',
-  token: 'sk_test',
-}
-
-let dir = ''
-const origFetch = globalThis.fetch
-let calls: { body: Buffer | null; headers: Headers; url: string }[]
-
-beforeEach(async () => {
-  dir = await mkdtemp(join(tmpdir(), 'sentori-cli-srcbun-'))
-  calls = []
-})
-afterEach(async () => {
-  globalThis.fetch = origFetch
-  await rm(dir, { force: true, recursive: true })
-})
-
-function mockFetch(status = 201, body: object = { contentHash: 'h', kind: 'source_bundle_ios', sizeBytes: 12 }): void {
-  globalThis.fetch = (async (url: Request | string | URL, init?: RequestInit) => {
-    const b = init?.body
-    calls.push({
-      body: b instanceof Uint8Array ? Buffer.from(b) : null,
-      headers: new Headers(init?.headers),
-      url: String(url),
-    })
-    return new Response(JSON.stringify(body), { status })
-  }) as typeof fetch
-}
-
-describe('uploadSourceBundle', () => {
-  test('rejects unknown platform', async () => {
-    const path = join(dir, 'a.tar.gz')
-    await writeFile(path, Buffer.from([0x1f, 0x8b, 0x08, 0x00]))
-    mockFetch()
-    await expect(
-      uploadSourceBundle({ ...ADMIN, path, platform: 'windows' as unknown as 'ios' }),
-    ).rejects.toThrow(/platform/)
-  })
-
-  test('rejects non-gzip body before hitting network', async () => {
-    const path = join(dir, 'not-gzip.tar.gz')
-    await writeFile(path, Buffer.from('plain text not a gzip stream'))
-    mockFetch()
-    await expect(
-      uploadSourceBundle({ ...ADMIN, path, platform: 'ios' }),
-    ).rejects.toThrow(/gzip|1f 8b/i)
-    expect(calls.length).toBe(0)
-  })
-
-  test('rejects empty body', async () => {
-    const path = join(dir, 'empty.tar.gz')
-    await writeFile(path, Buffer.alloc(0))
-    mockFetch()
-    await expect(uploadSourceBundle({ ...ADMIN, path, platform: 'ios' })).rejects.toThrow(
-      /empty/,
-    )
-  })
-
-  test('posts to /admin/api/projects/<id>/source-bundles with platform + release query', async () => {
-    const path = join(dir, 'src.tar.gz')
-    // gzip magic + minimal payload — server-side validation passes.
-    await writeFile(path, Buffer.from([0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00]))
-    mockFetch(201, { contentHash: 'abc123', kind: 'source_bundle_ios', sizeBytes: 6 })
-
-    const r = await uploadSourceBundle({ ...ADMIN, path, platform: 'ios' })
-
-    expect(calls.length).toBe(1)
-    expect(calls[0]!.url).toContain('/admin/api/projects/proj-1/source-bundles?')
-    expect(calls[0]!.url).toContain('platform=ios')
-    expect(calls[0]!.url).toContain('release=myapp%401.0.0')
-    expect(calls[0]!.headers.get('authorization')).toBe('Bearer sk_test')
-    expect(calls[0]!.headers.get('content-type')).toBe('application/gzip')
-    expect(r.kind).toBe('source_bundle_ios')
-    expect(r.contentHash).toBe('abc123')
-  })
-
-  test('android platform routes the same shape', async () => {
-    const path = join(dir, 'src.tar.gz')
-    await writeFile(path, Buffer.from([0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00]))
-    mockFetch(201, { contentHash: 'def', kind: 'source_bundle_android', sizeBytes: 6 })
-    const r = await uploadSourceBundle({ ...ADMIN, path, platform: 'android' })
-    expect(calls[0]!.url).toContain('platform=android')
-    expect(r.kind).toBe('source_bundle_android')
-  })
-
-  test('surfaces server 4xx/5xx as Error with snippet', async () => {
-    const path = join(dir, 'src.tar.gz')
-    await writeFile(path, Buffer.from([0x1f, 0x8b]))
-    mockFetch(500, { error: { code: 'bad', message: 'boom on server' } })
-    await expect(uploadSourceBundle({ ...ADMIN, path, platform: 'ios' })).rejects.toThrow(
-      /500/,
-    )
-  })
-})