fix(sentry): filter offline remote connectors; accept audit id 0

[kentcdodds]

Intent

Stop two unrelated production Sentry failures from a deploy-window backfill batch: offline remote-connector guidance noise (issue 7659311570) and admin_audit_log_query output parse failures on SQLite id = 0 (KODY-CLOUDFLARE-42). Sibling KODY-CLOUDFLARE-41 is already fixed by #1301 and is not part of this diff.

Summary

• Treat remote-connector unavailable guidance messages as caller-clearable: skip Sentry via MCP isCallerFailure and a beforeSend backstop; keep mcp-event logs.
• Relax admin_audit_log_query event id from .positive() to .nonnegative() so explicit SQLite zero rowids parse successfully.
• Tests cover phrase matching, observability/Sentry drop vs keep, and zero-rowid query/capability paths.

Testing

• npx vitest run on status.node.test.ts, observability.node.test.ts, sentry-options.node.test.ts, admin-capabilities.node.test.ts, audit-log.node.test.ts (15 passed)
• Full npm run validate pending in this PR

Sibling dispositions (Sentry)

Issue	Outcome
7659311570 (connector not connected)	filtered — this PR
7659575592 / KODY-CLOUDFLARE-41 (DO code reset mid publish)	already fixed in #1301 (8d5f6fff) — resolve in that commit
7659609626 / KODY-CLOUDFLARE-42 (ZodError audit id)	fixed — this PR

System recap — composes existing primitives (low risk)

Mode: recap · Base: main @ 8d5f6fff · Head: 86d156e1

Classification: composes — Sentry/MCP observability wiring plus a permissive one-line admin output-schema fix; no new primitives.

Primitives touched

Primitive	Group	Impact
remote-connectors	assistant	composes — unavailable-message classifier
connector-ingress	surfaces	composes — same status helpers
mcp-server	surfaces	composes — isCallerFailure skip path
rbac	auth	composes — admin audit output accepts id >= 0

System map

Offline remote-connector capability failures and admin audit query output parse both flow through MCP observability; this PR drops the former from Sentry and lets zero rowids pass output schema.

Legend: green = composes (wiring only) · amber = extended by this PR · red = new primitive · gray = context (unchanged, included only when an edge crosses it).

flowchart LR
	remoteConnectors["remote-connectors<br/>Remote connectors"]:::touched
	mcpServer["mcp-server<br/>MCP endpoint"]:::touched
	rbac["rbac<br/>Role-based access control"]:::touched
	sentryOpts["sentry-options<br/>beforeSend filters"]:::touched
	remoteConnectors -->|"unavailable phrase match"| mcpServer
	mcpServer -->|"skip Sentry caller failure"| sentryOpts
	rbac -->|"admin_audit_log_query id nonnegative"| mcpServer
	classDef touched fill:#1a7f37,color:#fff
	classDef extended fill:#9a6700,color:#fff
	classDef added fill:#cf222e,color:#fff
	classDef untouched fill:#57606a,color:#fff

Loading

  

Summary by CodeRabbit

• Bug Fixes
  • Preserved audit log entries with a SQLite row ID of 0, including their metadata.
  • Improved handling of unavailable remote connectors by excluding expected disconnection errors from error monitoring.
  • Continued reporting unexpected remote capability failures, such as timeouts, for investigation.
• Tests
  • Added coverage for audit log querying, remote connector status detection, observability, and error filtering.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 137d8e6c-82dd-436d-84a8-509ec4b11f87

📥 Commits

Reviewing files that changed from the base of the PR and between 8d5f6ff and 86d156e.

📒 Files selected for processing (9)

• packages/worker/src/audit-log.node.test.ts
• packages/worker/src/mcp/capabilities/admin/admin-audit-log-query.ts
• packages/worker/src/mcp/capabilities/admin/admin-capabilities.node.test.ts
• packages/worker/src/mcp/observability.node.test.ts
• packages/worker/src/mcp/observability.ts
• packages/worker/src/remote-connector/status.node.test.ts
• packages/worker/src/remote-connector/status.ts
• packages/worker/src/sentry-options.node.test.ts
• packages/worker/src/sentry-options.ts

---

📝 Walkthrough

Walkthrough

The change allows audit queries to return SQLite rows with ID 0. It also classifies remote connector availability errors separately from remote capability failures for MCP logs and Sentry events.

Changes

Audit row preservation

Layer / File(s)	Summary
Audit query ID contract packages/worker/src/mcp/capabilities/admin/admin-audit-log-query.ts, packages/worker/src/audit-log.node.test.ts, packages/worker/src/mcp/capabilities/admin/admin-capabilities.node.test.ts	The audit entry schema accepts nonnegative IDs. Query tests verify that ID 0 and event metadata remain unchanged. Remote connector observability
Remote status matching packages/worker/src/remote-connector/status.ts, packages/worker/src/remote-connector/status.node.test.ts	The new matcher recognizes offline, empty-capability, and unauthenticated connector messages. Tests reject unrelated and indeterminate messages.
MCP failure classification packages/worker/src/mcp/observability.ts, packages/worker/src/mcp/observability.node.test.ts	MCP caller-failure classification recognizes unavailable remote connectors. Tests cover structured event logging and Sentry reporting for remote failures.
Sentry event filtering packages/worker/src/sentry-options.ts, packages/worker/src/sentry-options.node.test.ts	Sentry filtering drops recognized connector availability events and retains remote capability timeout events. Configuration comments describe the filtering behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant RemoteConnector
  participant MCPObservability
  participant RemoteStatusMatcher
  participant Sentry
  RemoteConnector-->>MCPObservability: connector availability error
  MCPObservability->>RemoteStatusMatcher: match error message
  RemoteStatusMatcher-->>MCPObservability: unavailable status
  MCPObservability->>MCPObservability: retain structured mcp-event log
  MCPObservability-->>Sentry: exclude unavailable connector event
  RemoteConnector-->>MCPObservability: remote capability timeout
  MCPObservability-->>Sentry: report timeout exception

Loading

Possibly related PRs

• kentcdodds/kody#977: Related remote connector error handling and Sentry classification.
• kentcdodds/kody#1145: Related audit query changes with overlapping implementation and test files.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes both primary changes: filtering offline remote connectors from Sentry and accepting audit ID 0.
Description check	✅ Passed	The description includes intent, summary, testing results, and system impact, with clear scope and pending full validation noted.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/sentry-triage-batch-kody-cloudflare-7659311570-7ac2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔎 Preview deployed: https://kody-pr-1302.kody-a99.workers.dev

Worker: kody-pr-1302
D1: kody-pr-1302-db
KV: kody-pr-1302-oauth-kv

Mocks:

• cloudflare: https://kody-pr-1302-mock-cloudflare.kody-a99.workers.dev/__mocks (kody-pr-1302-mock-cloudflare)