Skip to content

feat(node,aws-serverless): Answer managed tunnel requests on Lambda - #26000

Open
logaretm wants to merge 5 commits into
awad/runtime-tunnel-cloudflarefrom
awad/runtime-tunnel-lambda
Open

logaretm wants to merge 5 commits into
awad/runtime-tunnel-cloudflarefrom
awad/runtime-tunnel-lambda

Conversation

@logaretm

@logaretm logaretm commented Nov 2, 2026 •

Copy link
Copy Markdown
Member

Adds an AWS handler shim that handles tunnel events before they hit the user handler.

Note for reviewers: if you are lacking context on this PR, check #25997

@logaretm
logaretm added this pull request to stack #26002 November 2, 2026 19:44
@github-actions

github-actions Bot commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

size-limit report 📦

Compared: 5ef02e1 (PR test merge using develop at 667b2a1)

Against: a1162e3 (develop) · base run #65032

⚠️ Baseline mismatch: 18 develop commit(s) in the PR build are missing from the baseline. Their size changes also affect this comparison. Compare commits. Re-run once develop's baseline build for 667b2a1 finishes.

Path Size % Change Change
@sentry/browser 30.4 kB - -
@sentry/browser - with treeshaking flags 28.54 kB - -
@sentry/browser - with treeshaking flags tracing without tracing 28.43 kB - -
@sentry/browser (incl. Tracing) 52.73 kB - -
@sentry/browser (incl. Tracing + Span Streaming) 52.73 kB - -
@sentry/browser (incl. Tracing, Profiling) 55.7 kB - -
@sentry/browser (incl. Tracing, Replay) 93.03 kB - -
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 81.63 kB - -
@sentry/browser (incl. Tracing, Replay with Canvas) 97.78 kB - -
@sentry/browser (incl. Tracing, Replay, Feedback) 110.77 kB - -
@sentry/browser (incl. Feedback) 47.98 kB - -
@sentry/browser (incl. sendFeedback) 35.5 kB - -
@sentry/browser (incl. FeedbackAsync) 40.61 kB - -
@sentry/browser (incl. Metrics) 31.44 kB - -
@sentry/browser (incl. Logs) 31.73 kB - -
@sentry/browser (incl. Metrics & Logs) 32.45 kB - -
@sentry/react 32.29 kB - -
@sentry/react (incl. Tracing) 55.1 kB - -
@sentry/vue 38.67 kB - -
@sentry/vue (incl. Tracing) 55.75 kB - -
@sentry/svelte 30.43 kB - -
@sentry/remix (Remix 3 client bundle) 57.82 kB - -
CDN Bundle 32.19 kB - -
CDN Bundle (incl. Tracing) 53.26 kB - -
CDN Bundle (incl. Logs, Metrics) 34.47 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) 55.2 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) 75.88 kB - -
CDN Bundle (incl. Tracing, Replay) 91.47 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 93.4 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) 97.58 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 99.58 kB - -
CDN Bundle - uncompressed 94.67 kB - -
CDN Bundle (incl. Tracing) - uncompressed 157.67 kB - -
CDN Bundle (incl. Logs, Metrics) - uncompressed 101.14 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 163.41 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 232.71 kB - -
CDN Bundle (incl. Tracing, Replay) - uncompressed 279.36 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 285.08 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 293.06 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 298.77 kB - -
@sentry/nextjs (client) 58.05 kB - -
@sentry/sveltekit (client) 53.24 kB - -
@sentry/core/server 44.48 kB +0.53% +233 B 🔺
@sentry/core/browser 13.93 kB - -
@sentry/node 156.24 kB +0.2% +301 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 82.28 kB +0.01% +1 B 🔺
@sentry/node - without tracing 97.16 kB +0.28% +263 B 🔺
@sentry/node - without channel injection 136.55 kB +0.21% +274 B 🔺
@sentry/aws-serverless 105.46 kB +0.35% +365 B 🔺
@sentry/cloudflare (withSentry) - minified 202.05 kB +0.69% +1.38 kB 🔺
@sentry/cloudflare (withSentry) 501.99 kB +0.59% +2.94 kB 🔺
@sentry/nextjs/cloudflare (withSentry) - minified 222.6 kB +0.63% +1.38 kB 🔺

View base workflow run

@github-actions

github-actions Bot commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Optional E2E tests

All optional checks were successful. 4 successful. See the run.

Successful checks
Check Status
✅ CI: Optional E2E Tests / E2E nextjs-16 (vinext) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-flue Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E node-express-mcp-v2 Test (optional) Successful in 44s Details
✅ CI: Optional E2E Tests / E2E node-pi-durable (latest) Test (optional) Successful in 53s Details

@logaretm
logaretm force-pushed the awad/runtime-tunnel-lambda branch 2 times, most recently from a357b59 to e260c45 Compare November 3, 2026 04:07
@logaretm
logaretm force-pushed the awad/runtime-tunnel-lambda branch from e260c45 to 35c5803 Compare November 3, 2026 04:10
@logaretm
logaretm force-pushed the awad/runtime-tunnel-lambda branch from 35c5803 to a2969c3 Compare November 3, 2026 04:21
@logaretm
logaretm force-pushed the awad/runtime-tunnel-lambda branch 2 times, most recently from cbbbe3b to 335dfa3 Compare November 3, 2026 04:42
@logaretm
logaretm force-pushed the awad/runtime-tunnel-lambda branch from 335dfa3 to 126db26 Compare November 3, 2026 04:45
@logaretm
logaretm force-pushed the awad/runtime-tunnel-lambda branch from 126db26 to 7198f33 Compare November 3, 2026 04:50
@logaretm
logaretm marked this pull request as ready for review November 3, 2026 05:15
@logaretm
logaretm requested review from a team as code owners November 3, 2026 05:15
@logaretm
logaretm requested review from Lms24, andreiborza, isaacs, nicohrubec and s1gr1d and removed request for a team November 3, 2026 05:15
@logaretm
logaretm requested a review from msonnb November 3, 2026 05:15

@cursor cursor Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Comment thread packages/node/src/lambda/tunnel.ts Resolved
const tunnelResult = _INTERNAL_handleLambdaTunnelEvent(event);
if (tunnelResult) {
return tunnelResult as Promise<TResult>;
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tunnel path skips event-loop freeze

Medium Severity

The new tunnel early-return in wrapHandler never sets callbackWaitsForEmptyEventLoop. That leaves the Lambda default of true, so keep-alive work from forwarding the envelope can delay or block freeze after the tunnel response is already ready.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit a14a93c. Configure here.

.catch(error => {
DEBUG_BUILD && debug.error('Sentry tunnel: failed to answer a streaming tunnel request', error);
});
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Feat lacks Lambda tunnel tests

Medium Severity

This feat answers managed tunnel requests on Lambda, but the only new tests cover the _HANDLER redirect takeover. There is no integration or E2E test that sends an HTTP tunnel event through the shim or wrapHandler and checks the response. Adding one would lock in the user-visible behavior.

Additional Locations (1)
Fix in Cursor Fix in Web

Triggered by project rule: PR Review Guidelines for Cursor Bot

Reviewed by Cursor Bugbot for commit a14a93c. Configure here.

};
const streamingSymbols = streamingHandler as unknown as Record<symbol, unknown>;
streamingSymbols[HANDLER_STREAMING_SYMBOL] = handlerSymbols[HANDLER_STREAMING_SYMBOL];
streamingSymbols[HANDLER_HIGHWATERMARK_SYMBOL] = handlerSymbols[HANDLER_HIGHWATERMARK_SYMBOL];

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Double-casts lack typing comments

Low Severity

New as unknown as double-casts copy streaming symbols onto the tunnel wrapper without a comment on why a safer type is not possible.

Fix in Cursor Fix in Web

Triggered by project rule: PR Review Guidelines for Cursor Bot

Reviewed by Cursor Bugbot for commit a14a93c. Configure here.

@logaretm
logaretm force-pushed the awad/runtime-tunnel-lambda branch from a14a93c to 3595b95 Compare November 3, 2026 05:37
Lambda runs no HTTP server, so `serveTunnelIntegration` redirects `_HANDLER` to a shim that answers tunnel
events before the user's handler, when `init` runs from a preload. `wrapHandler` in `@sentry/aws-serverless`
answers them too. The handler resolution moves to `@sentry/node`, and its loader stays out of the main entry.
@logaretm
logaretm force-pushed the awad/runtime-tunnel-lambda branch from 3595b95 to 3ba0759 Compare November 4, 2026 17:25

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

There are 5 total unresolved issues (including 3 from previous reviews).

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 3ba0759. Configure here.

body: await response.text(),
isBase64Encoded: false,
};
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ALB tunnel responses omit status

High Severity

Tunnel answers for ALB events omit statusDescription, which Application Load Balancer requires on every Lambda response. Those invocations fail at the load balancer with a 502 even when the tunnel itself succeeded, so managed tunnel traffic through ALB never reaches Sentry.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 3ba0759. Configure here.

return function (this: unknown, event: unknown, context: unknown) {
return handleTunnelEvent(event) ?? handler.call(this, event, context);
};
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing tests for tunnel handling

Medium Severity

This feat has no integration or E2E coverage of answering managed tunnel requests on Lambda. The new tests only check _HANDLER takeover between shims, so event parsing, ALB/API Gateway response shapes, and streaming behavior are unproven.

Additional Locations (2)
Fix in Cursor Fix in Web

Triggered by project rule: PR Review Guidelines for Cursor Bot

Reviewed by Cursor Bugbot for commit 3ba0759. Configure here.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant