Conversation
The handler fetched stacktrace, culprit, tags, frequency and affected-user count, then read source around each non-vendor frame. It never asked for breadcrumbs, even though src/utility/sentry.js enriches ui.click and ui.input crumbs with data-cy, id, name and button text specifically to make that trail useful. Prompt-only. get_issue_breadcrumbs is already covered by the mcp__sentry prefix in --allowedTools, needs the same event:read scope as the existing issue fetch, and resolves org + issue id from SENTRY_PERMALINK alone, so no new secret, tool grant or YAML structure. - A.2 fetches the trail and greps the data-cy to locate the component. Pins eventId to step 1's event where available, since two independent "latest" resolutions can diverge on a high-frequency error. - A.2 states explicitly that breadcrumbs localize but do not establish certainty: a trace bottoming out in vendor internals still FAILs "Root-cause certainty". sentry-rca-classification.md is untouched and remains the single source of truth for the auto-fix bar. - C.2 gains a "Last user actions" field so the trail reaches a human. Scoped to ui.click/ui.input/navigation crumbs with console and HTTP payloads excluded, since this repo is public; breadcrumb text is stripped of backticks and leading @ or # before quoting, as it is untrusted production data rendered as live markdown in an issue comment. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
QA Review — ✅ PASSNo linked issue found — change-only QA.
Suggested Cypress coverageThis PR only edits |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| payload. Breadcrumb text is untrusted production data rendered as live | ||
| markdown here, so strip backticks and any leading `@` or `#` from it | ||
| before quoting, or it will ping real accounts, cross-link unrelated | ||
| issues, or open a code fence that swallows the rest of this comment. If |
There was a problem hiding this comment.
🔴 Sanitization only strips leading @/#, not all occurrences
GitHub autolinks #1234 and @user anywhere in plain comment text, not just at the start of the string — e.g. a ui.click breadcrumb whose button text is dynamic content like "Notify @security-team about ticket #4321" would still ping/cross-link once quoted, since only a leading occurrence gets stripped. This defeats the stated goal ("or it will ping real accounts, cross-link unrelated issues"). Fix: instruct stripping/escaping every @ and # occurrence in the breadcrumb text, not just a leading one.
There was a problem hiding this comment.
Fixed in ecfda3e8f. Enumerating characters is the wrong shape of fix, so rather than also stripping non-leading occurrences, each crumb is now wrapped in single backticks — GitHub does not autolink inside a code span, which covers @ and # wherever they appear plus any other markdown in the string. Stripping backticks from the crumb first (already required) is what keeps it from escaping its own span.
Code Review — 🔴 1 blocker(s) — see inline comments |
Negative QANo reproducible edge-case failures found on the surfaces this PR changes. Also checked and working correctly
|
The auto-reviewer is right that stripping only a leading @ or # misses the case that matters: GitHub autolinks @user and #1234 anywhere in a line, and button text is dynamic content, so "Notify @some-team about #4321" would still ping and cross-link once quoted. Enumerating characters is the wrong shape of fix. Wrap each crumb in single backticks instead — GitHub does not autolink inside a code span, which covers @ and # wherever they appear plus any other markdown in the string. Stripping backticks from the crumb first is what keeps it from escaping its own span. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Code Review — ✅ No blockers |
2 participants
Prompt-only change to
.github/workflows/claude-sentry-handler.yml. No issue.Makes the Sentry RCA handler read breadcrumbs, which it never asked for before.
A.2(new) — fetches the trail withget_issue_breadcrumbsand greps thedata-cyto locate the component. Non-fatal on failure. Steps renumberedA.2–A.4→A.3–A.5.C.2— adds aLast user actionsfield to the RCA comment.