feat(local): Add observability workspace - #1576
Draft
MathurAditya724 wants to merge 18 commits into
Draft
Conversation
Add a session-only workspace sidebar, category indexes, and loopback-only receiver controls for raw envelopes and buffer clearing.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Keep receiver setup in the same navigation and header hierarchy as live observability views.
Center receiver setup and hide inactive Explorer navigation until a receiver connects.
Replace the advanced disclosure with concise endpoint guidance and a scanning connection indicator.
Show scoped detail selection, raw envelopes, and trace-first investigation views.
Keep event identity in the header and reserve the waterfall for trace structure.
Use the shared compact list and unpadded detail shell for trace investigations.
Wrap Shiki-highlighted envelopes and keep the copy action visible for inspection.
Use React Router paths and Nuqs query state for Explorer navigation, retained-event selection, filters, and searches.
Centralize Local route query state, preserve a single history entry for command selections, and allow HTTPS Sentry preview origins to read only the event stream.
Hide redundant type pills from Errors and Envelopes while retaining them in mixed activity views.
Ensure Vite can resolve the dialog stack's ESM runtime helper in isolated deployments.
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
Comment on lines
+145
to
+156
| function isHostedUiOrigin(origin: string | undefined): origin is string { | ||
| if (!origin) { | ||
| return false; | ||
| } | ||
|
|
||
| if (!URL.canParse(origin)) { | ||
| return false; | ||
| } | ||
|
|
||
| const url = new URL(origin); | ||
| return url.protocol === "https:" && url.hostname.endsWith(".sentry.dev"); | ||
| } |
There was a problem hiding this comment.
*Any .sentry.dev origin can read the local envelope stream
isHostedUiOrigin() treats every HTTPS *.sentry.dev host as the hosted Local UI, so those origins get CORS and Private Network Access to /stream and can read captured local envelopes. Restrict the allowlist to local.sentry.dev and an explicit Local preview hostname pattern.
Evidence
- Previously only the exact origin
https://local.sentry.devwas trusted; this hunk replaces that withurl.hostname.endsWith(".sentry.dev")for any HTTPS origin. isHostedUiStreamRequest()uses that helper for/stream, and the CORS path reflects the request Origin plusAccess-Control-Allow-Private-Network: truefor matching hosts.- As a result, pages on unrelated Sentry hosts (for example
https://cli.sentry.dev) or arbitrary*.sentry.devpreview apps can open an EventSource to the loopback receiver and read live/buffered envelopes containing local telemetry and potentially sensitive event data. - Writes and UI control routes remain blocked for hosted origins, but stream confidentiality is still lost across the entire
*.sentry.devnamespace.
Identified by Warden · security-review · BC2-NJA
Force Vercel to relink the frozen pnpm graph before the Local Vite build.
Use the Explorer sidebar as the sole navigation surface for event categories.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sentry Local now presents a cohesive, collapsible observability workspace while preserving Live Activity as the default feed/detail experience. The disconnected state is a focused, centered receiver setup without inactive Explorer navigation, policy-heavy disclosures, or a generic pulse; it uses concise endpoint guidance and a scanning receiver indicator. Explicit connection attempts show a disabled, spinner-backed Connecting button and close after 10 seconds with a retryable error. Once connected, the brand moves into the navigation rail and search appears when live events make it useful. Session-only telemetry is indexed into errors, traces, logs, feedback, envelopes, profiles, SDKs, and AI views; raw envelopes remain inspectable separately from decoded events.
The receiver now describes its session capabilities, clears its retained buffer with the viewer, and serves retained raw envelopes. Those stateful routes are enabled only for loopback-bound receivers. The hosted UI remains read-only: the production Local origin and this PR's Vercel preview may read the SSE stream, but cannot ingest, clear, or access retained receiver state.