fix(OUT-3553): drop browser-extension noise from Sentry

[priosshrsth]

Changes

• Adds a denyUrls list in the client Sentry init for chrome-extension://, moz-extension://, and safari(-web)?-extension:// so any native exception whose top stack frame lives in extension-owned code is dropped.
• Adds a beforeSend marker filter that drops events whose serialized message / exception / extra / recent breadcrumbs contain any of: multichainWallet, contentscriptFunctionCall, postMessageToContentScript, or the extension URL schemes. This catches extensions that inject content scripts into our page context and log errors via console (no stack frame to denyUrls on).

Root cause (OUT-3553)

The Sentry issue "Error: Origin not allowed" was being emitted from a visitor's crypto wallet browser extension. The Sentry event payload included:

{
  arguments: [ [postMessageToContentScript],
    { callFrom: inPage, funcName: getExtensionInfo,
      moduleName: multichainWallet, type: contentscriptFunctionCall, … } ],
  logger: console
}

This is the extension's own content script failing its own origin-allowlist check and logging via console.error. Because enableLogs: true is on in the client init, Sentry's console integration captures those logs and files them against our project. Nothing in our code triggers this, there is no user-facing impact, and there is no fix possible on the producer side (we don't control the extension).

Testing Criteria

• Verify a synthetic extension-shaped console error is dropped. In a browser console on a preview build, run:

  console.error('Error: Origin not allowed', { arguments: [['postMessageToContentScript'], { moduleName: 'multichainWallet', type: 'contentscriptFunctionCall' }], logger: 'console' })

  and confirm the event does not appear in Sentry.
• Verify an ordinary error still reports. throw new Error('sentry-smoke-test') in the console and confirm it does appear in Sentry with stack + replay.
• Confirm OUT-3553 stops receiving new events after release.
• Loom: pending

Notes

• Filter is intentionally narrow (specific wallet-extension markers + extension URL schemes) so we do not accidentally swallow legitimate errors. If a different extension starts leaking, we extend EXTENSION_NOISE_MARKERS.
• No server-side change required — extensions don't run server-side.

Impact & Surface Area of Change

• Only src/instrumentation-client.ts is touched. Behavior change is limited to the client Sentry pipeline: two extra short-circuits before events are sent.
• Other Sentry features untouched: replay integration, tracesSampleRate, enableLogs, sendDefaultPii are all preserved.
• Watch for: unexpected drop in total Sentry event volume (expected, that's the point) — confirm by checking that non-extension issues are still being reported for a release window.

🤖 Generated with Claude Code

[linear-code]

OUT-3553 Error: Origin not allowed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
client-home-v3	Ready	Preview, Comment	Apr 23, 2026 0:15am

[greptile-apps]

Greptile Summary

This PR adds two Sentry client-side filters to suppress browser-extension console errors from polluting the project's issue feed: a denyUrls list (covers stack-frame exceptions) and a beforeSend content scan against known wallet-extension string markers (covers console-injected events without stack frames).

• P1 bug: event.breadcrumbs?.slice(-10) always throws TypeError because breadcrumbs is { values?: Breadcrumb[] }, not an array. The try/catch silently swallows it and returns false, so the breadcrumb leg of the probe is never evaluated. Fix: use event.breadcrumbs?.values?.slice(-10).
• P2: EXTENSION_NOISE_MARKERS includes safari-web-extension:// but not safari-extension://, while the denyUrls regex covers both via safari(-web)?-extension://.

Confidence Score: 4/5

Safe to merge after fixing the breadcrumb .slice() bug; the primary filtering goal for OUT-3553 still works via the message/exception/extra probe.

One P1 defect: the breadcrumb path of isBrowserExtensionNoise always throws a TypeError (caught silently), making that leg of the filter non-functional. The specific OUT-3553 marker values appear in extra/message so the immediate fix still works, but the code doesn't match its stated intent and future breadcrumb-only extension noise would slip through.

src/instrumentation-client.ts — specifically line 28 (event.breadcrumbs?.slice → event.breadcrumbs?.values?.slice)

Important Files Changed

Filename	Overview
src/instrumentation-client.ts	Adds denyUrls and beforeSend to filter browser-extension noise; the breadcrumb slice path silently throws because breadcrumbs is {values:[]} not an array, rendering that leg of the filter inoperative.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Sentry captures event] --> B{denyUrls match?\nTop stack frame in\nextension:// URL?}
    B -- Yes --> C[Drop event]
    B -- No --> D{beforeSend:\nisBrowserExtensionNoise?}
    D --> E[JSON.stringify probe\nmessage + exception\n+ extra + breadcrumbs]
    E --> F{breadcrumbs exists?}
    F -- No --> G[probe includes message/exception/extra only]
    F -- Yes --> H['.slice -10' throws TypeError\n→ catch returns false\n⚠️ breadcrumb path broken]
    G --> I{Any EXTENSION_NOISE_MARKERS\nin probe?}
    H --> I
    I -- Yes --> J[Return null → Drop event]
    I -- No --> K[Return event → Send to Sentry]

Loading

_{Reviews (1): Last reviewed commit: "fix(OUT-3553): drop browser-extension no..." | Re-trigger Greptile}

[greptile-apps]

Breadcrumbs are an object, not an array — .slice() always throws

Sentry.ErrorEvent.breadcrumbs is typed as { values?: Breadcrumb[] } | undefined, not an array. Calling .slice(-10) on the wrapper object throws TypeError: event.breadcrumbs.slice is not a function, which the try/catch silently swallows, returning false. This means the breadcrumb path of the probe is always empty — any extension noise that only surfaces in breadcrumbs (e.g., a console.log breadcrumb containing multichainWallet) will not be filtered.

The fix is to access .values first:

Suggested change

	breadcrumbs: event.breadcrumbs?.slice(-10),
	breadcrumbs: event.breadcrumbs?.values?.slice(-10),

[greptile-apps]

safari-extension:// missing from string markers

The denyUrls regex uses safari(-web)?-extension://, which matches both safari-extension:// and safari-web-extension://. The EXTENSION_NOISE_MARKERS list only includes safari-web-extension://, leaving safari-extension:// uncovered for the isBrowserExtensionNoise content-scan path. For consistency, add the plain variant:

Suggested change

	'safari-web-extension://',
	'safari-web-extension://',
	'safari-extension://',