Skip to content

[DO NOT MERGE] Capture v10 Sentry coverage for #42867 telemetry validation#43965

Draft
MajorLift wants to merge 41 commits into
mainfrom
capture/sentry-cov-v10
Draft

[DO NOT MERGE] Capture v10 Sentry coverage for #42867 telemetry validation#43965
MajorLift wants to merge 41 commits into
mainfrom
capture/sentry-cov-v10

Conversation

@MajorLift

Copy link
Copy Markdown
Contributor

Throwaway capture branch off #42867 (v10). Runs the #43820 coverage spec in log-only mode to emit [SENTRY-COVERAGE-SUMMARY] for the v10 build, paired with the v8 capture (#43964). Closed after the summary is read. Tracking: #43819 / #42867.

Copilot AI and others added 30 commits May 21, 2026 16:21
Agent-Logs-Url: https://github.com/MetaMask/metamask-extension/sessions/66deb05c-d6c0-4fae-953c-8842d8e47c25

Co-authored-by: MajorLift <34228073+MajorLift@users.noreply.github.com>
Agent-Logs-Url: https://github.com/MetaMask/metamask-extension/sessions/66deb05c-d6c0-4fae-953c-8842d8e47c25

Co-authored-by: MajorLift <34228073+MajorLift@users.noreply.github.com>
Agent-Logs-Url: https://github.com/MetaMask/metamask-extension/sessions/66deb05c-d6c0-4fae-953c-8842d8e47c25

Co-authored-by: MajorLift <34228073+MajorLift@users.noreply.github.com>
The `@sentry/browser` v8→v10 upgrade crashed the extension on boot under LavaMoat
scuttling, failing every e2e job at `.controller-loaded`.

v10's `browserTracingIntegration` registers an INP listener via
`globalThis.addEventListener` synchronously inside `Sentry.init`, v10 web-vitals
(`whenIdleOrHidden`) feature-detects `requestIdleCallback`, and v10 also reads
`Request`/`WebAssembly`. Scuttling hid or threw on these.

Webpack scuttles the shared realm with throwing getters, so add `WebAssembly`,
`Request`, and `requestIdleCallback` to the `scuttleGlobalThis` exceptions in
`LavamoatPlugin`. The browserify `sentry-install` bundle reaches Sentry through a
proxy whose allowlist (`scuttlingConfigBase`) omitted `addEventListener`; add it
and `removeEventListener`, bound to `window` like `setTimeout`.
The hook spread the raw Sentry `Span`; `@sentry/core` v10 exposes `undefined`
internal fields (e.g. `_endTime`) that fail the `snap_startTrace` response's
`Json` validation and reject the RPC — surfacing as an `UnexpectedAlertOpenError`
in the preinstalled-example snap e2e test. Return `{ traceId, spanId }` from
`spanContext()` instead.
Under the v10 SDK's startup timing the Home page mount reliably sets
`pendingShieldCohort` before the test error is captured, so the masked
Sentry UI-state snapshot is `string` rather than `null`.
…hrough

v10 tracing emits hundreds of performance envelopes per test (~800 in a
failing multichain run). Passing them through to real sentry.io starved
e2e startup and flaked the non-EVM account render, and consumed the
metamask-performance quota from CI. Return a canned 200 locally instead.
…pshots

The field is populated by the Home page mount, so it is captured as `null`
or a string depending on timing; under v10's startup it flips and breaks the
state snapshot. Drop it from the comparison like other timing-dependent
fields rather than pinning a racy value.
Bisection for the v10 non-EVM (Solana) account-render timeout: v8 renders
the account ~instantly, v10 not within 10s, with identical envelope volume
(~570) — so it is v10's heavier per-operation browser-tracing instrumentation
(long-animation-frame / INP / fetch observers) at e2e's 100% sample rate,
not the telemetry traffic. e2e does not consume these traces; skipping the
integration there removes the overhead (and the CI quota draw).
The bisection it tested is refuted: skipping browserTracingIntegration in
e2e did not fix the non-EVM account-render timeout, and it broke
metrics/traces (no traces) and regressed metrics/errors. Restore the
de-flaked state.
Second timing-dependent field in the same snapshot: the profile-sync SRP
session is only present once account-sync establishes it, so its capture
varies across runs. Drop it from the comparison like `pendingShieldCohort`.
The refuted e2e browser-tracing gating slipped back in because the prior
revert moved the branch ref without updating the worktree. Restore
setupSentry.js to its un-gated state; keep the srpSessionData de-flake.
Root cause of the snap/multichain e2e failures: the shared
`waitForNonEvmAccountsLoaded` (hit by every login-based test) waits for the
Solana/Bitcoin snap account icons with the default 10s timeout. The icons
render in <1s locally, but on constrained 2-core CI runners the v10 Sentry
SDK's heavier startup pushes the render just past 10s — so it's a runner
timing margin, not a functional regression (the specs pass locally on v10).
Allow 30s for these snap-backed icons.
Reconcile `yarn.lock` against the merged `package.json`, keeping the v10
`@sentry/*` resolutions alongside main's dependency bumps.
After a wallet unlock the controllers re-initialize, and the v10 Sentry SDK's
heavier startup pushes `.controller-loaded` past the default 10s selenium wait
on 2-core CI runners (`multichain-accounts/add-account.spec.ts` "added account
should persist after wallet lock"). Bump the startup wait in `navigate` and
`waitForControllersLoaded` to 30s without inflating the global `this.timeout`.
Resolve `errors.spec.ts`: drop `MetaMetricsController.latestNonAnonymousEventTimestamp`
from `removedBackgroundFields` per main's #43556 (the field was removed from the
controller), keeping the timing-dependent `pendingShieldCohort` / `srpSessionData`
masks. Reconcile and dedupe `yarn.lock` against the merged `package.json`
(material-ui→mui migration, `transaction-controller` 67→68).
The `.controller-loaded` and snap-backed non-EVM icon waits are polled
ceilings, not fixed delays — they return as soon as their readiness signal
appears. The earlier hard-coded 30s only mattered on a genuine hang, but it
also slowed local failures from 10s to 30s for no benefit (local runners
aren't the 2-core CI constraint). Replace the four literals with a single
named `STARTUP_LOAD_TIMEOUT` (30s on CI, 10s locally): CI keeps the headroom
for the heavier Sentry v10 startup, local fails fast again.
Port newly-merged trace-propagation code off the v10-removed `@sentry/utils`:
`addFetchInstrumentationHandler` now imports from `@sentry/core`, and the scope
propagation context's `spanId` is read as v10's renamed `propagationSpanId`
(`sentry-trace-propagation.ts` + its test). Reconcile and dedupe `yarn.lock`
against the merged `package.json`.

Drop the e2e startup-timeout band-aids (`STARTUP_LOAD_TIMEOUT` and the 30s
`.controller-loaded` / non-EVM-icon bumps). The "heavier v10 startup" premise
behind them was never measured, so restore the default 10s waits and let CI
reveal whether the slowness is real rather than masking it.
On 2-core CI the Solana/Bitcoin snap account discovery hits an unmocked-network
retry storm (~9s) before the icons render, landing at the default 10s wait. Give
`waitForNonEvmAccountsLoaded` a 20s ceiling as a stopgap; it stays polled, so the
happy path is unaffected. Not a Sentry/v10 issue — root cause and the real fix
(globalize the snap discovery mocks) are tracked in #43817; revert this then.
…re globalized

#43818 globalized the Bitcoin esplora and Solana `getSignaturesForAddress`
discovery mocks in `mock-e2e.js`, eliminating the unmocked-network retry storm
that delayed non-EVM icon render. `waitForNonEvmAccountsLoaded` returns to the
default timeout, matching `main`. Resolves the stopgap tracked by #43817.
… v10

Reverting the stopgap removal: with the default 10s wait, three webpack-chrome
e2e shards time out on `img[src="./images/bitcoin-logo.svg"]` (`test-snap-bip-44`,
`multichain-account-list-menu`, `add-account`), each at ~10s. #43818's globalized
Bitcoin/Solana discovery mocks are present in this branch but the non-EVM icons
still render between 10s and 20s on the v10 SDK, so the widened wait is required.
The residual latency (v10 snap-account discovery vs. a remaining unmocked call)
needs a separate root-cause pass.
Root cause of the slow non-EVM account icons (and the e2e timeouts that the
`NON_EVM_ICON_TIMEOUT` stopgap was masking): the Bitcoin snap requests
`GET /esplora/block-height/{n}` during account discovery, but the global
`setupDefaultNonEvmDiscoveryMocks` only covered `/blocks`, `/blocks/tip/*`,
`/scripthash/*` and `/fee-estimates`. The unmocked `/block-height` request fell
through to the generic empty-200 catch-all, whose malformed body throws in the
snap and restarts the entire discovery cycle. The failing CI run shows the storm
directly: `/blocks`, `/scripthash/<h>/txs` and `/block-height/0` each requested
97 times in one spec, so the Bitcoin icon never renders within the default wait.

The snap is byte-identical on v8 and v10, so the gap predates this PR; the v10
SDK's far heavier startup envelope volume (~1100 Sentry POSTs per spec vs. a
fraction of that on v8) is what tips the same storm past the 10s threshold v8
fit under. Mocking `/block-height` lets discovery complete in a single pass on
both, eliminating the storm at its source and removing the need for the stopgap.
The previous mock returned the chain-tip hash for every `/block-height/{n}`, but
the Bitcoin snap only ever requests `/block-height/0` — the genesis block — and
validates the response as a network-identity check. A non-genesis hash there
makes the snap throw during account creation (`bitcoin-wallet-snap was stopped
... the Snap crashed`), which the previous fix surfaced once discovery stopped
storming. Return the canonical mainnet genesis hash for height 0 (tip for any
other height) so account creation completes.
Bitcoin discovery is now fully mocked in this PR, but the Solana snap's other 14
discovery RPC methods (incl. the `getGenesisHash` network-identity check) remain
unmocked in `setupDefaultNonEvmDiscoveryMocks`, so they fall through to the
empty-200 catch-all and drive a ~516-request retry storm that delays the Solana
icon past the default wait — amplified by the v10 SDK's heavier startup envelope
volume. Widen the wait as an explicit, root-caused interim until #43958 completes
the Solana discovery mocks, at which point this is removed.
Log-only variant of the #43820 coverage spec on the v10 (#42867) build: captures
the Sentry envelope set and prints `[SENTRY-COVERAGE-SUMMARY]` for offline
v8-vs-v10 diffing. Not for merge — paired with the v8 capture (#43964).
@github-actions

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@mm-token-exchange-service mm-token-exchange-service Bot added the team-extension-platform Extension Platform team label Jun 26, 2026
@mm-token-exchange-service

Copy link
Copy Markdown

✨ Files requiring CODEOWNER review ✨

👨‍🔧 @MetaMask/extension-platform (3 files, +11 -0)
  • 📁 development/
    • 📁 build/
      • 📄 index.js +2 -0
      • 📄 scripts.js +4 -0
    • 📁 webpack/
      • 📁 utils/
        • 📁 plugins/
          • 📁 LavamoatPlugin/
            • 📄 index.ts +5 -0

📜 @MetaMask/policy-reviewers (8 files, +216 -296)
  • 📁 lavamoat/
    • 📁 webpack/
      • 📁 mv2/
        • 📁 beta/
          • 📄 policy.json +27 -37
        • 📁 experimental/
          • 📄 policy.json +27 -37
        • 📁 flask/
          • 📄 policy.json +27 -37
        • 📁 main/
          • 📄 policy.json +27 -37
      • 📁 mv3/
        • 📁 beta/
          • 📄 policy.json +27 -37
        • 📁 experimental/
          • 📄 policy.json +27 -37
        • 📁 flask/
          • 📄 policy.json +27 -37
        • 📁 main/
          • 📄 policy.json +27 -37

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.


🧪 @MetaMask/qa (2 files, +63 -11)
  • 📁 test/
    • 📁 e2e/
      • 📁 page-objects/
        • 📁 pages/
          • 📁 home/
            • 📄 homepage.ts +18 -2
        • 📄 mock-e2e.js +45 -9

👨‍🔧 @itsyoboieltr (3 files, +11 -0)
  • 📁 development/
    • 📁 build/
      • 📄 index.js +2 -0
      • 📄 scripts.js +4 -0
    • 📁 webpack/
      • 📁 utils/
        • 📁 plugins/
          • 📁 LavamoatPlugin/
            • 📄 index.ts +5 -0

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​sentry/​types@​8.33.1 ⏵ 10.38.010010077 -296 +1100
Updated@​sentry/​browser@​8.33.1 ⏵ 10.38.079 +210091 +196100
Updated@​sentry/​core@​8.33.1 ⏵ 10.38.084 -1610083 +196100
Updated@​sentry/​node@​10.30.0 ⏵ 10.38.097 +110095 +196100

View full report

@socket-security

Copy link
Copy Markdown

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block High
Obfuscated code: npm @sentry-internal/feedback is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@sentry/browser@10.38.0npm/@sentry-internal/feedback@10.38.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry-internal/feedback@10.38.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm @sentry/browser is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.jsonnpm/@sentry/browser@10.38.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/browser@10.38.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm @sentry/core is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.jsonnpm/@sentry/core@10.38.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/core@10.38.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm @sentry/node-core is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@sentry/node@10.38.0npm/@sentry/node-core@10.38.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/node-core@10.38.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Medium CVE: OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation in npm @opentelemetry/core

CVE: GHSA-8988-4f7v-96qf OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation (MODERATE)

Affected versions: < 2.8.0

Patched version: 2.8.0

From: ?npm/@opentelemetry/core@2.5.0

ℹ Read more on: This package | This alert | What is a medium CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known medium severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentelemetry/core@2.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Potential code anomaly (AI signal): npm @sentry-internal/replay-canvas is 61.0% likely to have a medium risk anomaly

Notes: The fragment appears to be an instrumentation/telemetry component (likely part of a canvas/WebGL replay library) designed to intercept rendering calls, serialize complex graphics data, and forward mutations to a worker or callback for replay. While the data collection capabilities are extensive and involve potentially sensitive canvas/WebGL state, there is no clear evidence of active data exfiltration, backdoors, or credential theft within this module alone. The primary risk stems from data handling and transmission paths (mutationCb/worker), as well as aggressive runtime patching that could mask failures. Recommend strict data minimization, clear privacy policy, and secure, authenticated sinks for any mutation data in downstream paths.

Confidence: 0.61

Severity: 0.55

From: ?npm/@sentry/browser@10.38.0npm/@sentry-internal/replay-canvas@10.38.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry-internal/replay-canvas@10.38.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Potential code anomaly (AI signal): npm import-in-the-middle is 62.0% likely to have a medium risk anomaly

Notes: This code is an import-hook framework: it registers a global hook into Node’s/module loader pipeline, executes a caller-provided hookFn with module resolution context, and can overwrite namespace.default based on hookFn’s return value. While there is no direct evidence of data exfiltration or system compromise in the shown fragment, the capability to tamper with module exports during import is high-impact and could be abused for supply-chain sabotage. Additional risk signals include a broad builtin-detection override and weak MessageChannel acknowledgement handling (no message validation).

Confidence: 0.62

Severity: 0.56

From: ?npm/@sentry/node@10.38.0npm/import-in-the-middle@2.0.6

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/import-in-the-middle@2.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
12.5% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

@mm-token-exchange-service

Copy link
Copy Markdown
Builds ready [d9b183f]
Deprecated Browserify fallback builds
⚡ Performance Benchmarks (Total: 🟢 14 pass · 🟡 11 warn · 🔴 0 fail)

Baseline (latest main): a0fd448 | Date: 6/26/2026 | Pipeline: 28261853909 | Baseline logs

Interaction Benchmarks · Samples: 5
Benchmarkchrome-webpackfirefox-webpack
loadNewAccount
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
confirmTx
[Sentry log · main/release]
🟢 [CI log]
🟡 confirm_tx
🟢 [CI log]
bridgeUserActions
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]

📈 Results compared to the previous 5 runs on main

  • loadNewAccount/load_new_account: -34%
  • loadNewAccount/total: -34%
  • loadNewAccount/inp: -18%
  • loadNewAccount/fcp: -21%
  • confirmTx/confirm_tx: +71%
  • confirmTx/longTaskCount: +33%
  • confirmTx/longTaskMaxDuration: -20%
  • confirmTx/tbt: -11%
  • confirmTx/total: +71%
  • confirmTx/fcp: -20%
  • bridgeUserActions/longTaskCount: -29%
  • bridgeUserActions/longTaskTotalDuration: -36%
  • bridgeUserActions/longTaskMaxDuration: -20%
  • bridgeUserActions/tbt: -50%
  • bridgeUserActions/fcp: -18%
  • loadNewAccount/load_new_account: +24%
  • loadNewAccount/total: +24%
  • loadNewAccount/fcp: -50%
  • loadNewAccount/lcp: +1071%
  • confirmTx/confirm_tx: +10%
  • confirmTx/longTaskCount: -100%
  • confirmTx/longTaskTotalDuration: -100%
  • confirmTx/longTaskMaxDuration: -100%
  • confirmTx/tbt: -100%
  • confirmTx/total: +10%
  • confirmTx/lcp: +1138%
  • bridgeUserActions/bridge_load_page: +114%
  • bridgeUserActions/bridge_load_asset_picker: +48%
  • bridgeUserActions/longTaskCount: -100%
  • bridgeUserActions/longTaskTotalDuration: -100%
  • bridgeUserActions/longTaskMaxDuration: -100%
  • bridgeUserActions/tbt: -100%
  • bridgeUserActions/total: +25%
  • bridgeUserActions/fcp: -50%
  • bridgeUserActions/lcp: +1164%
Startup Benchmarks · Samples: 100
Benchmarkchrome-webpackfirefox-webpack
startupStandardHome
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]
startupPowerUserHome
[Sentry log · main/release]
🟡 [CI log]🟡 [CI log]

📈 Results compared to the previous 5 runs on main

  • startupStandardHome/numNetworkReqs: +20%
  • startupStandardHome/inp: +15%
  • startupStandardHome/lcp: -29%
  • startupPowerUserHome/uiStartup: -12%
  • startupPowerUserHome/load: -11%
  • startupPowerUserHome/domContentLoaded: -11%
  • startupPowerUserHome/domInteractive: -15%
  • startupPowerUserHome/backgroundConnect: -11%
  • startupPowerUserHome/firstReactRender: -11%
  • startupPowerUserHome/loadScripts: -11%
  • startupPowerUserHome/setupStore: -26%
  • startupPowerUserHome/longTaskCount: -17%
  • startupPowerUserHome/longTaskTotalDuration: -16%
  • startupPowerUserHome/longTaskMaxDuration: -12%
  • startupPowerUserHome/tbt: -16%
  • startupPowerUserHome/inp: -11%
  • startupPowerUserHome/fcp: -11%
  • startupStandardHome/domInteractive: +70%
  • startupStandardHome/setupStore: +11%
  • startupStandardHome/fcp: +65%
  • startupPowerUserHome/domInteractive: -29%
  • startupPowerUserHome/backgroundConnect: -35%
  • startupPowerUserHome/inp: +19%
  • startupPowerUserHome/fcp: -28%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 startupPowerUserHome/INP: p75 464ms
  • 🟡 startupPowerUserHome/INP: p75 240ms
  • 🟡 startupPowerUserHome/LCP: p75 3.5s
User Journey Benchmarks · Samples: 5 · mock API
Benchmarkchrome-webpackfirefox-webpack
onboardingImportWallet
[Sentry log · main/release]
🟡 [CI log]
🟡 total
🟢 [CI log]
onboardingNewWallet
[Sentry log · main/release]
🟢 [CI log]🟡 [CI log]
🟡 total
assetDetails
[Sentry log · main/release]
🟡 [CI log]🟡 [CI log]
solanaAssetDetails
[Sentry log · main/release]
🟡 [CI log]🟡 [CI log]
importSrpHome
[Sentry log · main/release]
🟡 [CI log]🟡 [CI log]
sendTransactions
[Sentry log · main/release]
🟡 [CI log]🟢 [CI log]
swap
[Sentry log · main/release]
🟢 [CI log]🟢 [CI log]

📈 Results compared to the previous 5 runs on main

  • onboardingImportWallet/srpButtonToSrpForm: +16%
  • onboardingImportWallet/metricsToWalletReadyScreen: -17%
  • onboardingImportWallet/doneButtonToHomeScreen: -62%
  • onboardingImportWallet/openAccountMenuToAccountListLoaded: -13%
  • onboardingImportWallet/longTaskCount: -74%
  • onboardingImportWallet/longTaskTotalDuration: -93%
  • onboardingImportWallet/longTaskMaxDuration: -90%
  • onboardingImportWallet/tbt: -98%
  • onboardingImportWallet/total: -65%
  • onboardingNewWallet/srpButtonToPwForm: -34%
  • onboardingNewWallet/createPwToRecoveryScreen: -23%
  • onboardingNewWallet/skipBackupToMetricsScreen: -30%
  • onboardingNewWallet/agreeButtonToOnboardingSuccess: -51%
  • onboardingNewWallet/doneButtonToAssetList: -65%
  • onboardingNewWallet/longTaskCount: -55%
  • onboardingNewWallet/longTaskTotalDuration: -64%
  • onboardingNewWallet/longTaskMaxDuration: -42%
  • onboardingNewWallet/tbt: -81%
  • onboardingNewWallet/total: -57%
  • solanaAssetDetails/assetClickToPriceChart: -62%
  • solanaAssetDetails/longTaskCount: -100%
  • solanaAssetDetails/longTaskTotalDuration: -100%
  • solanaAssetDetails/longTaskMaxDuration: -100%
  • solanaAssetDetails/tbt: -100%
  • solanaAssetDetails/total: -62%
  • solanaAssetDetails/inp: +20%
  • solanaAssetDetails/cls: +49%
  • importSrpHome/openAccountMenuAfterLogin: +14%
  • importSrpHome/homeAfterImportWithNewWallet: +72%
  • importSrpHome/longTaskCount: -25%
  • importSrpHome/longTaskTotalDuration: -21%
  • importSrpHome/longTaskMaxDuration: -10%
  • importSrpHome/tbt: -22%
  • importSrpHome/total: +56%
  • importSrpHome/inp: -36%
  • importSrpHome/cls: -34%
  • sendTransactions/openSendPageFromHome: -46%
  • sendTransactions/reviewTransactionToConfirmationPage: -36%
  • sendTransactions/longTaskCount: -50%
  • sendTransactions/longTaskTotalDuration: -53%
  • sendTransactions/longTaskMaxDuration: -16%
  • sendTransactions/tbt: -78%
  • sendTransactions/total: -35%
  • sendTransactions/inp: -17%
  • sendTransactions/cls: -89%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 assetDetails/FCP: p75 1.8s
  • 🟡 solanaAssetDetails/FCP: p75 1.8s
  • 🟡 importSrpHome/FCP: p75 1.9s
  • 🟡 sendTransactions/FCP: p75 1.8s
  • 🟡 assetDetails/FCP: p75 1.8s
  • 🟡 solanaAssetDetails/FCP: p75 1.9s
  • 🟡 importSrpHome/FCP: p75 1.9s
Dapp Page Load Benchmarks · Samples: 100
Benchmarkchrome-webpack
dappPageLoad
[Sentry log · main/release]
🟢 [CI log]
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 107.4 KiB (0.97%)
  • ui: 112.54 KiB (0.65%)
  • common: 0 Bytes (0%)
  • other: 0 Bytes (0%)
  • contentScripts: 1.48 KiB (0.08%)
  • zip: 99.63 KiB (0.37%)

@MajorLift

Copy link
Copy Markdown
Contributor Author

Throwaway capture branch — coverage summary read (both v8 and v10 captured only {session:1} in the harness window; transactions/errors not exercised). Closing. Finding fed back to #43819/#43820.

@MajorLift MajorLift closed this Jun 26, 2026
@MajorLift MajorLift deleted the capture/sentry-cov-v10 branch June 26, 2026 20:40
@github-actions github-actions Bot locked and limited conversation to collaborators Jun 26, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

size-XL team-extension-platform Extension Platform team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants