Skip to content

feat(astro): Serve the managed tunnel from the Sentry middleware - #25419

Open
logaretm wants to merge 12 commits into
awad/tunnel-nitrofrom
awad/tunnel-astro
Open

logaretm wants to merge 12 commits into
awad/tunnel-nitrofrom
awad/tunnel-astro

Conversation

@logaretm

@logaretm logaretm commented Oct 15, 2026 •

Copy link
Copy Markdown
Member

This PR adds the tunnel wiring to the astro SDK. We already had a global middleware active, so it works by adding logic to check if the incoming request is a tunnel request and if it is, then it will be handled.

This also respects the decision made earlier to follow the base path configured by the user, which comes from Astro's base config.

The astro-7 and astro-6-cf-workers tunnel variants cover node and Cloudflare.

For reviewers: if you need an overview of what this is, refer to #25199.

closes #25463

@logaretm
logaretm added this pull request to stack #25201 October 15, 2026 16:04
@github-actions

github-actions Bot commented Oct 15, 2026 •

Copy link
Copy Markdown
Contributor

size-limit report 📦

Compared: d6a317b (PR test merge using develop at b68afeb)

Against: ca4fc32 (develop) · base run #62950

⚠️ Baseline mismatch: 93 develop commit(s) in the PR build are missing from the baseline. Their size changes also affect this comparison. Compare commits. Re-run once develop's baseline build for b68afeb finishes.

Path Size % Change Change
@sentry/browser 30.56 kB +2.18% +651 B 🔺
@sentry/browser - with treeshaking flags 28.54 kB +1.76% +491 B 🔺
@sentry/browser - with treeshaking flags tracing without tracing 28.42 kB +1.69% +470 B 🔺
@sentry/browser (incl. Tracing) 52.8 kB +1.35% +702 B 🔺
@sentry/browser (incl. Tracing + Span Streaming) 52.8 kB +1.35% +699 B 🔺
@sentry/browser (incl. Tracing, Profiling) 55.77 kB +1.31% +720 B 🔺
@sentry/browser (incl. Tracing, Replay) 92.47 kB +0.68% +621 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 81.21 kB +0.61% +492 B 🔺
@sentry/browser (incl. Tracing, Replay with Canvas) 97.21 kB +0.66% +633 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback) 110.2 kB +0.63% +687 B 🔺
@sentry/browser (incl. Feedback) 48.12 kB +1.49% +703 B 🔺
@sentry/browser (incl. sendFeedback) 35.63 kB +1.9% +664 B 🔺
@sentry/browser (incl. FeedbackAsync) 40.76 kB +1.71% +684 B 🔺
@sentry/browser (incl. Metrics) 31.57 kB +2.05% +634 B 🔺
@sentry/browser (incl. Logs) 31.84 kB +2.02% +629 B 🔺
@sentry/browser (incl. Metrics & Logs) 32.52 kB +2.12% +673 B 🔺
@sentry/react 32.37 kB +1.99% +630 B 🔺
@sentry/react (incl. Tracing) 55.05 kB +1.17% +635 B 🔺
@sentry/vue 38.71 kB +1.7% +646 B 🔺
@sentry/vue (incl. Tracing) 55.75 kB +1.3% +715 B 🔺
@sentry/svelte 30.59 kB +2.2% +656 B 🔺
@sentry/remix (Remix 3 client bundle) 57.84 kB +1.27% +722 B 🔺
CDN Bundle 32.14 kB +1.5% +474 B 🔺
CDN Bundle (incl. Tracing) 53.09 kB +0.92% +480 B 🔺
CDN Bundle (incl. Logs, Metrics) 34.34 kB +1.4% +471 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) 55.04 kB +0.89% +484 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics) 75.29 kB +0.67% +499 B 🔺
CDN Bundle (incl. Tracing, Replay) 90.75 kB +0.53% +476 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 92.69 kB +0.52% +479 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) 96.89 kB +0.49% +470 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 98.86 kB +0.5% +486 B 🔺
CDN Bundle - uncompressed 94.44 kB +1.24% +1.15 kB 🔺
CDN Bundle (incl. Tracing) - uncompressed 157.29 kB +0.74% +1.15 kB 🔺
CDN Bundle (incl. Logs, Metrics) - uncompressed 100.99 kB +1.16% +1.15 kB 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 163.26 kB +0.72% +1.15 kB 🔺
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 231.03 kB +0.51% +1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay) - uncompressed 277.46 kB +0.42% +1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 283.42 kB +0.41% +1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 291.16 kB +0.4% +1.15 kB 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 297.11 kB +0.39% +1.15 kB 🔺
@sentry/nextjs (client) 57.91 kB +1.05% +601 B 🔺
@sentry/sveltekit (client) 53.29 kB +1.55% +812 B 🔺
@sentry/core/server 43.52 kB +4.13% +1.73 kB 🔺
@sentry/core/browser 13.81 kB - -
@sentry/node 153.28 kB +0.44% +659 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 81.58 kB - -
@sentry/node - without tracing 94.9 kB +0.69% +648 B 🔺
@sentry/node - without channel injection 133.92 kB +0.47% +616 B 🔺
@sentry/aws-serverless 103.15 kB +0.7% +711 B 🔺
@sentry/cloudflare (withSentry) - minified 213.13 kB +0.96% +2.02 kB 🔺
@sentry/cloudflare (withSentry) 528.73 kB +0.94% +4.9 kB 🔺
@sentry/nextjs/cloudflare (withSentry) - minified 232.75 kB +0.88% +2.01 kB 🔺

View base workflow run

@logaretm
logaretm force-pushed the awad/tunnel-astro branch 2 times, most recently from 3dfbedc to e9cafef Compare October 15, 2026 16:38
@logaretm

Copy link
Copy Markdown
Member Author

bugbot run

@cursor cursor Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Comment thread packages/astro/src/server/middleware.ts
@logaretm

Copy link
Copy Markdown
Member Author

bugbot run

@cursor cursor Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

@logaretm
logaretm force-pushed the awad/tunnel-astro branch 2 times, most recently from 3c79c4e to cd1c651 Compare October 16, 2026 14:00
@logaretm
logaretm requested review from chargome and s1gr1d October 19, 2026 19:37

@cursor cursor Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Comment thread dev-packages/e2e-tests/test-applications/astro-7/tests/tunnel.test.ts Outdated
Comment thread dev-packages/e2e-tests/test-applications/astro-7/tests/tunnel.test.ts Outdated
@logaretm
logaretm requested review from a team as code owners October 19, 2026 20:08
@logaretm
logaretm requested review from JPeer264 and isaacs and removed request for a team October 19, 2026 20:08

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit ba30e6a. Configure here.

@github-actions

Copy link
Copy Markdown
Contributor

One or more gzipped bundles increased by more than 500 bytes. If this increase is intentional, add the Accept Bundlesize Increase label to this PR to rerun and accept the check.

@github-actions

Copy link
Copy Markdown
Contributor

👋 @isaacs, @mydea, @Lms24, @JPeer264, @chargome, @s1gr1d — Please review this PR when you get a chance!

@github-actions

github-actions Bot commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

Optional E2E tests

All optional checks were successful. 2 successful. See the run.

Successful checks
Check Status
✅ CI: Optional E2E Tests / E2E astro-7 Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E astro-7-static Test (optional) Successful in 1m Details

The Sentry middleware runs first and answers tunnel requests. The integration
hands Astro's `base` and `trailingSlash: 'always'` to both SDKs, so `tunnel: true`
follows Astro's routing without repeating them.
This reverts commit 6647a68. The middleware module ran the inline default init a second time, and running the init before a cold non-page request is a gap develop has for every server request, not one the tunnel adds.
The server's tunnel base path only reached `@sentry/astro`'s own server init. On Workers the client comes from
`@sentry/cloudflare`, so the browser posted under `base` and got a 404. The server side of the tunnel options
module now goes through core's managed tunnel defaults, and the Worker entry imports it first.
…the tunnel variant, and drop tests that repeat core's
…request from a prerendered page finds a client

@isaacs isaacs left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two minor concerns to address, approving to unblock. Mostly LGTM.

addMiddleware({
order: 'pre',
entrypoint: '@sentry/astro/middleware',
entrypoint: serverInitSnippet ? SENTRY_MIDDLEWARE_MODULE : '@sentry/astro/middleware',

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before this PR, Sentry.init on the server ran only when an SSR page rendered. Now it also runs on the first request that reaches the Sentry middleware. The tunnel needs this, but it also changes behavior for everything else the middleware handles. Server-island requests, API endpoints and other non-page routes hit after a prerendered page are now instrumented from the first request. The comment block above if (!getClient()) describes the old behavior, including a TODO with repro steps ("Run the astro-5 tracing.serverIslands.test only"). After this PR that comment is mostly wrong: the bail now only covers apps with no server init at all. That is mostly a fix, and a good one, but it is a visible behavior change hidden inside a tunnel PR.

The PR also swaps the public middleware entry for a virtual one (virtual:@sentry/astro/middleware) whenever the integration injects the init. Users who disable the middleware with autoInstrumentation.requestHandler: false and add @sentry/astro/middleware themselves with sequence() don't get either the cold-start init or the tunnel, unless an SSR page rendered first.

Suggestion: update or remove the stale comment and TODO in packages/astro/src/server/middleware.ts. Note the init change in the PR body and changelog. For manual middleware users, either export the virtual entry's behavior from a public path (for example @sentry/astro/middleware importing the init when the integration provides one), or warn at build time when tunnel is set and the middleware is off. The integration can't see the runtime tunnel option, so the docs may be the only practical fix.

*/
export function applyAstroTunnelOptions(options: Pick<Options, 'tunnel'>): void {
const astroTunnelOptions = (GLOBAL_OBJ as { [TUNNEL_OPTIONS_GLOBAL]?: BrowserTunnelOptions })[TUNNEL_OPTIONS_GLOBAL];
options.tunnel = applyTunnelDefaults(options.tunnel, astroTunnelOptions);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The browser now rewrites a user's explicit relative tunnel string. This is the same issue as in #25415. Commit 36fcbad ("Serve a relative tunnel path under the base path too") passes relative strings through applyTunnelDefaults. With base: '/docs', tunnel: '/tunnel' in the browser now posts to /docs/tunnel (plus a trailing slash under trailingSlash: 'always'). Before this PR, it posted to /tunnel. A user whose tunnel lives outside Astro (a reverse proxy, CDN rule or separate service) silently breaks. /docs/tunnel still works, because core strips a duplicated base path.

There is a stronger case here than in SvelteKit for adding the trailing slash. Astro enforces trailingSlash before middleware, so a managed path without it can't work. But that argument covers only paths Astro serves.

Suggestion: apply the defaults only for tunnel: true and object forms, and leave explicit strings as written. Or keep the behavior and list it in the changelog as a change for apps with base and a relative tunnel. Whichever way you choose, make the same decision across the stack (SvelteKit, Astro, and any other PR that copied e7224db / 36fcbad).

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Astro managed tunnel

3 participants