Skip to content

feat(core): add stringify helper and make AI-tracing serializers safe - #22163

Merged
logaretm merged 4 commits into
developfrom
feat/consolidate-safe-json-stringify
Jul 14, 2026
Merged

feat(core): add stringify helper and make AI-tracing serializers safe#22163
logaretm merged 4 commits into
developfrom
feat/consolidate-safe-json-stringify

Conversation

@logaretm

@logaretmlogaretm commented Jul 9, 2026

Copy link
Copy Markdown
Member

Adds an exported stringify to @sentry/core and routes the SDK's "serialize a value for a span attribute" helpers through it.

We had a few possible gaps in getJsonString and getTruncatedJsonString where they throw on circular refs / BigInt, and every call site feeds their result straight into span.setAttribute with no try/catch. So a non-serializable value in an LLM message could throw out of the instrumentation and disrupt the wrapped call.

Regarding the naming, I decided to name it stringify because it neither JUST casts to strings nor it just string JSONfies. naming it as either will be confusing. I dropped the safe prefix because I don't think we ever want an unsafe option.

One change that needed to propagate is type accuracy. The old functions did return undefined but never typed it, it mostly was safe to do so because it often ended up in attributes but type accuracy here is safer.

@logaretmlogaretm changed the title feat(core): add safeJsonStringify and make AI-tracing serializers safefeat(core): add safeJsonStringify and normalize usageJul 9, 2026
@logaretm
logaretmforce-pushed the feat/consolidate-safe-json-stringify branch from b4c66d5 to 2d78382CompareJuly 9, 2026 20:09
@logaretmlogaretm changed the title feat(core): add safeJsonStringify and normalize usagefeat(core): add stringify helper and make AI-tracing serializers safeJul 9, 2026
@github-actions

github-actionsBot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

size-limit report 📦

PathSize% ChangeChange
@sentry/browser27.61 kB--
@sentry/browser - with treeshaking flags26.05 kB--
@sentry/browser (incl. Tracing)46.36 kB--
@sentry/browser (incl. Tracing + Span Streaming)48.16 kB--
@sentry/browser (incl. Tracing, Profiling)51.15 kB--
@sentry/browser (incl. Tracing, Replay)85.63 kB--
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags75.27 kB--
@sentry/browser (incl. Tracing, Replay with Canvas)90.34 kB--
@sentry/browser (incl. Tracing, Replay, Feedback)103 kB--
@sentry/browser (incl. Feedback)44.79 kB--
@sentry/browser (incl. sendFeedback)32.41 kB--
@sentry/browser (incl. FeedbackAsync)37.53 kB--
@sentry/browser (incl. Metrics)28.69 kB--
@sentry/browser (incl. Logs)28.93 kB--
@sentry/browser (incl. Metrics & Logs)29.62 kB--
@sentry/react29.4 kB--
@sentry/react (incl. Tracing)48.63 kB--
@sentry/vue33.04 kB--
@sentry/vue (incl. Tracing)48.34 kB--
@sentry/svelte27.63 kB--
CDN Bundle30.01 kB--
CDN Bundle (incl. Tracing)48.34 kB--
CDN Bundle (incl. Logs, Metrics)31.59 kB--
CDN Bundle (incl. Tracing, Logs, Metrics)49.65 kB--
CDN Bundle (incl. Replay, Logs, Metrics)70.82 kB--
CDN Bundle (incl. Tracing, Replay)85.84 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)87.16 kB--
CDN Bundle (incl. Tracing, Replay, Feedback)91.65 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)92.92 kB--
CDN Bundle - uncompressed89.37 kB--
CDN Bundle (incl. Tracing) - uncompressed146.12 kB--
CDN Bundle (incl. Logs, Metrics) - uncompressed94.07 kB--
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed150.09 kB--
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed218.8 kB--
CDN Bundle (incl. Tracing, Replay) - uncompressed265.32 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed269.28 kB--
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed279.02 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed282.97 kB--
@sentry/nextjs (client)51.18 kB--
@sentry/sveltekit (client)46.81 kB--
@sentry/core/server78.45 kB+0.05%+35 B 🔺
@sentry/core/browser64.81 kB+0.07%+39 B 🔺
@sentry/node-core62.73 kB--
@sentry/node125.08 kB-0.01%-11 B 🔽
@sentry/node (incl. diagnostics channel injection)139.34 kB-0.01%-1 B 🔽
@sentry/node/import (ESM hook with diagnostics-channel injection)69.96 kB--
@sentry/node/light50.73 kB+0.01%+1 B 🔺
@sentry/node - without tracing74.1 kB--
@sentry/aws-serverless83.32 kB--
@sentry/cloudflare (withSentry) - minified181.58 kB--
@sentry/cloudflare (withSentry)449.49 kB--

View base workflow run

Adds an exported stringify to core (string passthrough, else JSON.stringify, never throws)
and routes the SDK's span-attribute serializers through it. getJsonString and
getTruncatedJsonString previously threw on circular refs / BigInt straight into
span.setAttribute with no try/catch, which could crash instrumentation; the safe path
returns '[unserializable]' instead. Consolidates safeStringify (server-utils) and langchain's
asString too.
@logaretm
logaretmforce-pushed the feat/consolidate-safe-json-stringify branch from 2d78382 to b6cc26fCompareJuly 13, 2026 15:22
@logaretm
logaretm marked this pull request as ready for review July 13, 2026 16:00
@logaretm
logaretm requested a review from a team as a code ownerJuly 13, 2026 16:00
@logaretm
logaretm requested review from Lms24, chargome and s1gr1d and removed request for a teamJuly 13, 2026 16:00
Comment threadpackages/core/src/utils/string.ts
Comment threadpackages/core/src/utils/string.ts
Comment threadpackages/core/src/utils/string.ts
JSON.stringify returns undefined (not a throw) for top-level undefined,
functions, and symbols, so stringify could return undefined despite its
string annotation. Widen the return type to string | undefined and let it
propagate: undefined means "nothing to serialize", which naturally omits
the attribute, while the fallback stays reserved for real throws (circular
refs, BigInt).
Propagates through the langchain attribute builders and swaps the vercel-ai
subscriber's bespoke Attributes type for the shared SpanAttributes, which
already permits undefined. No runtime behavior change.
Comment threadpackages/core/test/lib/tracing/ai-message-truncation.test.ts
The array case routes through truncateGenAiMessages (a different code path
from a bare object) and only asserted it didn't throw, leaving the actual
fallback value unchecked. Assert it returns '[unserializable]' too.

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 4ab1ca0. Configure here.

Comment threadpackages/core/test/lib/utils/string.test.ts

@andreiborzaandreiborza left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for making this better.

@logaretm
logaretm merged commit 3204ba5 into developJul 14, 2026
310 checks passed
@logaretm
logaretm deleted the feat/consolidate-safe-json-stringify branch July 14, 2026 15:20
logaretm added a commit that referenced this pull request Jul 17, 2026
…22370)
Adds a item to `AGENTS.md` (`CLAUDE.md` symlinks to it) telling agents
to search for an existing util before writing a new one, pointing at
where shared helpers actually live (`packages/core/src/utils/`,
`packages/browser-utils/`).
Motivation: LLM-assisted changes have a habit of introducing
near-duplicate helpers instead of reusing what's already there. This is
a passive nudge rather than an enforced check.
I did a quick check spawned a couple of agents on bogus tasks that
needed a couple of utils, and watched its reasoning and it picked up on
this, so while it doesn't enforce it, it may help us curb the util soup
we get.
This is a follow up to my previous util cleanup PRs #22155#22163#22154
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@logaretm@andreiborza