Repository navigation
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![semgrep-code-getsentry[bot]](https://avatars.githubusercontent.com/in/1153895?s=60&v=4){kind=small}
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
betegon
force-pushed
the
bt/code-mode-http
branch
from
October 27, 2026 13:28
2fbe908 to
c74cfe6
Compare
betegon
force-pushed
the
bt/cloudflare-test-runtime
branch
from
October 27, 2026 13:28
7fb178a to
49d10be
Compare
betegon
added a commit
that referenced
this pull request
Oct 27, 2026
The Cloudflare test plugin still used an older Miniflare/workerd than Wrangler, so updating the direct dependency alone left different runtimes in local and integration tests. Switch to `@cloudflare/vitest-plugin` 1.4.6 and align Miniflare/workerd with Wrangler. Miniflare 5 removed `fetchMock`; an Undici outbound service preserves the existing fixtures and `disableNetConnect()` policy. This is the prerequisite for #1670 (HTTP Code Mode), followed by #1675 (agent evals). Only seven test/dependency files move here; the broker, permissions and production integration remain in #1670. Validated independently on Node 24: **443 Cloudflare tests across 34 files**, root typechecks, lint and frozen install. The earlier full workspace run had unrelated CLI fixture/platform failures; CLI fixes are excluded. No deployment performed.
betegon
force-pushed
the
bt/code-mode-http
branch
from
October 27, 2026 13:44
c74cfe6 to
9be4926
Compare
Bound broker access and HTTP work to one execution so unawaited calls and late authorization cannot start writes after the result. Cover cleanup and the real deadline with Worker integration tests.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Code Mode is the MCP equivalent of
sentry api: agents can use published API operations without a dedicated MCP tool.The client's agent writes JavaScript; our Cloudflare sandbox executes authenticated HTTP calls and returns the result.
For example: “Copy this dashboard for two projects, preserving its widgets and filters.” The existing tool catalog cannot do this; Code Mode can.
search_sentry_apidiscovers the schema andexecute_sentry_coderuns the program. This version is HTTP-only; the SDK remains future work.Prerequisite #1676 is merged. Stack: this PR → #1675 (agent evals). Runtime and permission safety tests remain here.
Permissions
The Sentry token authenticates API calls; its OAuth scopes and the user's Sentry permissions set the maximum access.
The permission screen controls which of those actions this MCP connection may perform, without changing the token or its scopes.
/mcpcovers organizations authorized by the Sentry token;/mcp/{org}is restricted to that organization. Project-scoped connections do not expose Code Mode.Validation and before production
Executions now close pending RPC, abort in-flight HTTP and block requests whose authorization finishes after execution ends. Programs must await API calls before returning; accepted writes cannot be rolled back. See the lifecycle validation.
Passed locally: 474 hosted Cloudflare tests + 27 isolated runtime/access tests, 1,836 core tests (six skipped), 89 stdio tests, build/typechecks, lint and documentation links. Coverage includes a real 30-second timeout that closes the upstream connection while preserving an accepted write.
Pending before production: real hosted OAuth-to-API authorization and Cloudflare CPU/termination/concurrency enforcement. Local workerd tests do not establish these platform guarantees. No production deployment performed. GitHub CI now passes the complete workspace suite, including CLI, plus smoke tests, repository quality and security checks on
645c16d2. Warden code review, MCP audit and security review also pass, with no new findings. No CLI fixes were included.