feat(local): Add daemon-managed telemetry sessions and viewer

[MathurAditya724]

Add isolated Sentry Local telemetry sessions owned by a loopback daemon. local run --session <name> and local serve --session <name> retain captured data after their foreground lease ends; session, event, envelope, and daemon commands let developers and agents inspect it later. Each session has separate ingest/read capabilities and retains data for three hours after close and subsequent ingestion.

Move the browser viewer into apps/local so the complete feature lives in Toolkit. Receivers default to 500 envelopes; --max-envelopes on create/run/serve and local session retention configure limits from 1 to 50,000. Connected loopback-served viewers can change retention, reset, or close their scoped session; hosted viewers remain read-only. Growth preserves envelope IDs, decoded items, and active streams. Decreases below the retained count are rejected without changing data. The viewer follows CLI updates, preserves malformed raw envelopes for inspection, and keeps retained search available after disconnection. Connecting the Vercel Local project to Toolkit is deferred.

The daemon authenticates discovery, enforces singleton ownership without deleting replacement metadata, waits through listener retries, and preserves SDK compression and stream compatibility. Plain commands guide users to --session when a daemon owns their port. Both ingest routes reject remote browser writes, and capability URLs are scrubbed from diagnostics and outgoing CLI telemetry. Process E2E coverage includes real Sentry Node SDK capture, concurrent startup, scoped telemetry, retention changes, foreground leases, restart, and shutdown; Local CI runs npm/native cases on Linux, macOS, and Windows.

Supersedes getsentry/cli#1578.

The full local workspace gate still fails the existing macOS musl-installer and DerivedData-scanner tests. They remain outside this Local migration. Fresh validation and hosted platform results are recorded in the PR's review evidence comment.

[MathurAditya724]

Validation of the migrated feature:

• Workspace typecheck and lint passed.
• Local unit/regression suite: 98 passed.
• Viewer suite: 80 passed.
• Full npm CLI E2E: 167 passed; 3 existing credential-dependent tests skipped.
• Actual macOS SEA binary Local E2E: 4 passed.
• Real browser + isolated daemon: ingestion, scoped reset and session close verified.
• Independent review found no remaining actionable Local findings after fixes.

The complete workspace test command was run in UTC with isolated temporary storage and four workers. Its CLI result was 10,644 passed, 14 existing skips, and two failures:

1. test/lib/install-script.test.ts — the musl case supplies a fake ldd but does not simulate Linux, so on macOS the installer takes the Darwin path.
2. test/commands/debug-files/upload.test.ts — the DerivedData case scans the actual macOS Xcode directory and exceeds its 15-second timeout.

These existing test-isolation failures are documented rather than changed, as requested. The installer and debug-files tests have no changes in this PR. Linux, macOS and Windows npm/native Local coverage is configured in the new Local E2E workflow.

The existing Local hosting project also needs to point to Toolkit with apps/local as its root to deploy the migrated viewer.

[MathurAditya724]

Hosted Local E2E passed on Linux, macOS, and Windows at commit 82cacca. Each platform ran viewer integration tests plus the Local process suite against both the npm bundle and a freshly built native CLI. Typecheck, lint, and docs checks also passed after rebasing onto current main. The original getsentry/cli#1578 draft is now closed as superseded.

[MathurAditya724]

Validation for 24bf8863b31d4e87bf76662740ef0acadb8d7251:

• Workspace typecheck and lint pass.
• Local unit regressions: 99 pass. Credential/telemetry boundary tests: 53 pass. Viewer tests: 80 pass.
• Full npm CLI process E2E: 168 pass, 3 existing credential-dependent skips.
• Rebuilt macOS native CLI Local E2E: all 5 pass, including real Sentry Node SDK capture, live output and retained event queries.
• Independent review found no remaining actionable Local defects. Real browser ingest/reset/close verification was completed.

The full workspace test gate retains exactly two existing macOS-dependent failures, with 10,653 CLI tests passing and 14 skipped: the musl installer case does not simulate Linux, and the DerivedData case scans the host Xcode directory and times out. The user requested that this PR remain scoped to Local, so those unrelated test files are unchanged. Other tested workspace packages pass.

The actual Node SDK regression exposed transports dropping query parameters; the ingest capability now lives in the pathname. Scoped capability URLs are also redacted at final CLI telemetry delivery. Fresh Linux/macOS/Windows npm and native E2E checks are running on this head. BYK is requested for review; the PR is now ready for review.

[MathurAditya724]

Hosted readiness update for 24bf8863:

The PR risk (Jev) check failed with provider_error: GatewayInternalServerError, HTTP 400. Its result artifact marks the attempt retryable: false; no risk classification or code finding was produced. The classifier truncated its input to the configured 30,000-token budget. This is a classifier/provider gate failure, not a failed Local test, and remains unresolved.

Warden and the broad CLI test job are still running. BYK has not yet reviewed. The PR should not be merged with these gates unresolved. Unrelated workflow/provider changes remain outside this Local migration.

[MathurAditya724]

Final platform validation at 24bf8863b31d4e87bf76662740ef0acadb8d7251: Local E2E passed on Linux, macOS and Windows. Every platform passed viewer integration tests, all five Local E2E cases against the npm bundle, and the same cases against a freshly built native CLI. This includes actual Sentry Node SDK capture and retained event queries.

The independent review has no remaining actionable findings and this PR has no unresolved review threads. Merge readiness is still blocked: PR risk (Jev) failed with a non-retryable provider HTTP 400, Warden and the broad CLI check remain in progress, and BYK review is requested but not yet submitted. The two documented local macOS baseline failures remain unchanged as requested.

[MathurAditya724]

Validation of the review fixes at e29a992a116c4b09efe11903c5ea3c4be074cb54:

• All eight Warden threads were addressed and resolved with fix evidence. Fresh independent review found no remaining actionable Local findings after the additional compatibility, receiver-isolation, trace-search and discovery-race fixes.
• Local unit regressions: 103 pass. Viewer suite: 86 pass.
• Full rebuilt npm CLI process E2E: 171 pass, 3 existing credential-dependent skips.
• Rebuilt macOS native Local E2E: all 8 pass. New real-process coverage exercises busy-port retries with concurrent callers, failed-startup cleanup with no late listener, legacy-command guidance, and safe real-SDK session status.
• Browser QA verified list/detail search consistency, trace filtering, Clear removing the query and showing subsequent events, and switching receivers without retaining the old feed.
• Workspace typecheck and lint pass against current main. The full local workspace suite retains exactly the two documented unrelated macOS failures, with 10,657 CLI tests passing and 14 skipped. Other tested workspace packages pass. The musl installer and DerivedData tests remain outside this PR as requested.

Current main was integrated without force-pushing; the PR diff remains scoped to Local and its documentation/tests. Fresh Linux/macOS/Windows npm/native checks are running on this head. PR-risk provider failures remain an external gate to track, not a reason to weaken checks. Vercel setup is explicitly deferred. A monitor checks this PR every 30 minutes and reports meaningful changes or confirmed merge readiness; it does not merge the PR.

[MathurAditya724]

Published the Local-only Windows CI correction in 167fa712a718216eef8986f6cbca293eacbec93b.

Windows exposed an integration-test race: Nuqs updates React state before writing the URL, and its shared pending query queue can survive a test unmount. The test now waits for the same q=customers assertion and resets the shared queue through the public testing adapter between tests. The real browser adapter and all filtering/history assertions remain in use. No production code or workflow was changed for this correction.

• Reproduced the original assertion failure with a delayed URL write, then verified the corrected assertion with the same delay. Removed all diagnostic instrumentation.
• Viewer suite: 86 passing; all 42 browser integration tests also pass in shuffled order. Independent review found no actionable issues.
• Workspace typecheck and lint pass. The UTC workspace run has the two documented macOS failures plus one unrelated issue-link test failure; the complete issue-link file passes on isolated rerun (63 tests). Running in the local Pacific timezone also exposed existing ZIP/date assumptions, which pass in UTC. These files are unchanged, preserving the requested Local scope.
• The production-fix head e29a992a passed hosted Linux/macOS npm and native Local E2E, and local validation passed 171 npm CLI E2E tests (3 credential-dependent skips) and 8 macOS native Local E2E tests. Fresh Linux/macOS/Windows checks are running on 167fa712.

All eight existing Warden threads remain resolved. PR-risk on e29a992a reported a provider GatewayInternalServerError / HTTP 400 without a risk classification; the new head must obtain fresh check results. BYK review is still requested. This PR is not yet declared merge-ready. The 30-minute monitor will report meaningful changes and confirmed readiness. Vercel setup remains deferred.

[MathurAditya724]

Final Local review fixes are published in 3bc9e8b66d9df5466b7e3d89c015a6b04057b16f.

All three new Warden findings were reproduced with regressions, fixed, replied to and resolved. Search now remains available after disconnect/session close, including raw-only retained envelopes. Empty trace searches use the shared search empty state. Event/envelope view accepts quoted and split multi-word session names while rejecting missing item IDs. Independent review found no remaining actionable issue in these changes. All 11 review threads are resolved.

Validation after the final review fixes:

• Viewer: 89 passing tests; all 45 browser integration tests also pass in shuffled order.
• Rebuilt full npm CLI E2E: 172 passing tests, 3 credential-dependent skips.
• Rebuilt macOS native Local E2E: all 9 pass, including the new quoted/split multi-word session regression.
• Real-browser QA: a missing trace search displays No matching traces; after closing the synthetic session, search could be reopened and cleared, returning both retained traces.
• Workspace typecheck and lint pass. The UTC workspace gate is back to exactly the two previously documented unrelated macOS failures, with 10,657 CLI tests passing and 14 skipped. Other tested workspace packages pass. No unrelated tests were edited.

The prior head 167fa712 passed all three hosted Local platform jobs (viewer, npm and native E2E) and PR-risk. Fresh Linux/macOS/Windows checks are running on 3bc9e8b6; PR-risk has returned a provider_error again, without a risk classification. No workflow or gate was bypassed. Warden and BYK review must be refreshed before merge readiness can be confirmed. The active monitor checks every 30 minutes and reports meaningful changes or confirmed readiness. Vercel setup remains deferred; this PR has not been merged.

[MathurAditya724]

Published the final Local lifecycle review fixes in 4889f39447718a67a81ff4ea2b6b92f68e35485f.

All four new Warden findings were reproduced, fixed, replied to and resolved. Restart now bounds a hung stop POST, rejects a failed stop, waits through the live-but-unresponsive shutdown window, and reports a timeout instead of returning the old daemon as a successful restart. Ownership creation, stale recovery and release share an exclusive guard; interrupted guards remain in place with explicit cleanup guidance. Ambiguous session names return HTTP409 with ID guidance that the CLI preserves. Initial SSE attach warnings show the scoped endpoint with its capability redacted.

Independent review approved the final changes and independently exercised three concurrent process claims against stale ownership: exactly one owner succeeded, and release left no ownership files. The guard is deliberately not recovered by automatic unlink after an interrupted critical section; callers must confirm the owning process has stopped before removing the reported guard.

Validation of the published code:

• 111 Local unit tests pass. Viewer suite remains at 89 passing in the workspace run.
• Full rebuilt npm CLI E2E: 177 pass, 3 existing credential-dependent skips.
• Rebuilt macOS native Local E2E: 14 pass, including delayed/rejected/never-completed/hung stop cases and duplicate-name CLI guidance.
• Fresh hosted Local run 38458758500 passes on Linux, macOS and Windows, including viewer, npm and native E2E on this exact head.
• Workspace typecheck/lint pass. The final sequential UTC workspace run has 10,706 CLI tests passing and 14 skipped, with only the two previously documented macOS musl/DerivedData failures. Other tested packages pass. Those unrelated files remain unchanged.

Current main f29cfde4 was integrated without force-pushing; its picker changes are excluded from this PR's diff. The primary checkout's unrelated work is preserved. All 15 review threads are resolved. The required test aggregate and broad CLI check pass; fresh Warden review is pending. PR-risk on this head reports a non-retryable provider GatewayInternalServerError / HTTP400 without classification; no workflow/gate was bypassed or weakened. No merge or auto-merge was performed. The 30-minute monitor remains active. Vercel setup is deferred.

[MathurAditya724]

Final full-PR audit and cleanup published in 8b2fb1779df7b0ca0001c0481b13fad50745b779.

The independent review found receiver-action races and trace-size failures. All were reproduced before fixes and are now covered by regressions:

• A connection generation guards pending close/reset results and stream callbacks, including switching away and back to the same URL. An old close cannot disconnect a newer connection; old errors cannot label it incorrectly.
• Trace timing is computed once per completed trace with iterative extrema. This removes repeated scans and the argument overflow on a valid transaction with 70,000 child spans.
• Waterfall traversal uses an explicit stack, preserving preorder/depth/last-child flags while handling a 4,000-deep valid span chain without recursive overflow.

Removed unreachable ThemeToggle and Card components, unused appendBounded and SESSION_BUFFER_SIZE, and the obsolete item-based telemetry append path. Index/replay tests now exercise the actual envelope API. Shared browser-safe loopback policy and default retention values replace duplicated implementations; the run BUFFER_SIZE export remains because setup verification uses it. A final independent review approved the fixes and cleanup with no remaining actionable findings.

Validation:

• 110 viewer tests pass; production viewer typecheck/build passes.
• 178 scoped Local and credential regressions pass.
• Workspace typecheck/lint pass. Full CLI units: 10,720 pass, 14 skip; the two explicitly deferred macOS musl/DerivedData failures remain unchanged. Final viewer cleanup was rechecked with its complete suite/build and root lint.
• Rebuilt full npm CLI E2E: 187 pass, 3 existing optional skips, including all 24 Local cases.
• Rebuilt native macOS Local E2E: all 24 pass.

Fresh exact-head status: Linux/macOS/Windows Local viewer/npm/native E2E are all green on 8b2fb17. Warden is still running; current review threads are all resolved. Required aggregate test is awaiting the CLI job. PR-risk run 38644059547 failed on this exact head. Its artifact confirms provider_error / GatewayInternalServerError HTTP400 with retryable:false; it produced no risk classification. This external failure remains outside Local scope and checks have not been weakened. The user authorizes squash merge only after final review and exact-head gates are satisfied; this revision has not been merged. Vercel remains deferred.