feat(debug-files): scan inside .zip archives on upload

.github/workflows/ci.yml

@@ -710,7 +710,13 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: "24"
+          # Pin exact patch: Node 24.17.0 (and 22.23.0) shipped CVE-2026-48931's
+          # http.Agent fix, which added a `data` listener on idle sockets that
+          # makes keep-alive fetch reuse throw false ERR_STREAM_PREMATURE_CLOSE.
+          # This surfaces as "Premature close" in the skill-eval planner's HTTP
+          # calls. Fixed in 24.18.0 (nodejs/node#64004). A floating "24" silently
+          # reuses the runner's pre-cached buggy 24.17.0, so pin the exact patch.
+          node-version: "24.18.0"
       - uses: actions/cache@v5
         id: cache
         with:

docs/src/fragments/commands/debug-files.md

@@ -30,6 +30,10 @@ sentry debug-files bundle-jvm --output ./out --debug-id <uuid> --json ./src
 sentry debug-files upload ./build
 sentry debug-files upload ./libexample.so --include-sources
 
+# .zip archives are scanned in place; use --no-zips to skip them
+sentry debug-files upload ./symbols.zip
+sentry debug-files upload ./build --no-zips
+
 # Restrict by type or debug id, and wait for server-side processing
 sentry debug-files upload ./dsyms --type dsym --wait
 sentry debug-files upload ./build --id <debug-id> --require-all
@@ -60,14 +64,16 @@ sentry debug-files upload ./build --no-upload
   files via the chunk-upload protocol. Use `--type`/`--id` to restrict which
   files are sent, `--no-debug`/`--no-unwind`/`--no-sources` to drop files whose
   only useful feature is the named one, and `--include-sources` to attach a
-  source bundle per file. `--derived-data` additionally scans Xcode's
+  source bundle per file. `.zip` archives are scanned in place by default (their
+  entries run through the same filters; nested archives are not recursed) — pass
+  `--no-zips` to skip them. `--derived-data` additionally scans Xcode's
   `~/Library/Developer/Xcode/DerivedData` folder (macOS only). `--no-upload`
   previews the selection without credentials; `--wait`/`--wait-for` block on
   server-side processing and exit non-zero if any file fails. `--require-all`
   fails if a requested `--id` was not found. The server-advertised maximum file
   size and maximum processing wait are honored automatically (oversized files
-  are skipped with a warning). Scanning inside ZIP archives, `--symbol-maps`,
-  and `--il2cpp-mapping` line mappings are not yet supported.
+  are skipped with a warning). `--symbol-maps` (BCSymbolMap resolution) and
+  `--il2cpp-mapping` line mappings are not yet supported.
 - Upload a JVM bundle separately via `sentry debug-files upload --type jvm`.
 - Supported JVM source file extensions: `.java`, `.kt`, `.scala`, `.sc`,
   `.groovy`, `.gvy`, `.gy`, `.gsh`, `.clj`, `.cljc`

package.json

@@ -32,6 +32,7 @@
     "consola": "^3.4.2",
     "esbuild": "^0.28.1",
     "fast-check": "^4.8.0",
+    "fflate": "^0.8.3",
     "fossilize": "^0.10.1",
     "hono": "^4.12.27",
     "http-cache-semantics": "^4.2.0",

plugins/sentry-cli/skills/sentry-cli/references/debug-files.md

@@ -28,6 +28,7 @@ Upload debug information files to Sentry
 - `--no-sources - Do not upload files whose only feature is source info`
 - `--include-sources - Build and upload a source bundle for each file with debug info`
 - `--derived-data - Also scan Xcode's DerivedData folder (macOS only)`
+- `--no-zips - Do not scan inside .zip archives`
 - `--no-upload - Scan and print what would be uploaded without uploading`
 - `--wait - Wait for server-side processing and report any errors`
 - `--wait-for <value> - Wait up to this many seconds for server-side processing`
@@ -81,6 +82,10 @@ sentry debug-files bundle-jvm --output ./out --debug-id <uuid> --json ./src
 sentry debug-files upload ./build
 sentry debug-files upload ./libexample.so --include-sources
 
+# .zip archives are scanned in place; use --no-zips to skip them
+sentry debug-files upload ./symbols.zip
+sentry debug-files upload ./build --no-zips
+
 # Restrict by type or debug id, and wait for server-side processing
 sentry debug-files upload ./dsyms --type dsym --wait
 sentry debug-files upload ./build --id <debug-id> --require-all

src/commands/debug-files/upload.ts

@@ -9,9 +9,10 @@
  * vars, config defaults), so `--no-upload` (dry-run) needs no credentials.
  *
  * Honors the server-advertised `max_file_size` (oversized files are skipped)
- * and `max_wait` (clamps the processing wait). `--derived-data` additionally
- * scans Xcode's DerivedData folder on macOS. ZIP scanning, `--symbol-maps`,
- * and `--il2cpp-mapping` line mappings are deferred to follow-up PRs (see the
+ * and `max_wait` (clamps the processing wait). `.zip` archives are scanned in
+ * place (disable with `--no-zips`); `--derived-data` additionally scans Xcode's
+ * DerivedData folder on macOS. `--symbol-maps` (BCSymbolMap resolution) and
+ * `--il2cpp-mapping` line mappings are deferred to follow-up PRs (see the
  * command's full description).
  */
 
@@ -126,6 +127,7 @@ type UploadFlags = {
   "no-sources"?: boolean;
   "include-sources"?: boolean;
   "derived-data"?: boolean;
+  "no-zips"?: boolean;
   "no-upload"?: boolean;
   wait?: boolean;
   "wait-for"?: number;
@@ -448,16 +450,19 @@ export const uploadCommand = buildCommand({
       "  --id       Only upload the object with the given debug id (repeatable)\n" +
       "  --no-debug / --no-unwind / --no-sources   Drop files whose only\n" +
       "             useful feature is the named one\n" +
-      "  --derived-data   Also scan Xcode's DerivedData folder (macOS only)\n\n" +
+      "  --derived-data   Also scan Xcode's DerivedData folder (macOS only)\n" +
+      "  --no-zips        Do not scan inside .zip archives\n\n" +
+      ".zip archives are scanned in place by default; nested archives are not " +
+      "recursed.\n\n" +
       "Usage:\n" +
       "  sentry debug-files upload ./build\n" +
+      "  sentry debug-files upload ./symbols.zip\n" +
       "  sentry debug-files upload ./libexample.so --include-sources\n" +
       "  sentry debug-files upload ./dsyms --type dsym --wait\n" +
       "  sentry debug-files upload --derived-data --no-upload\n" +
-      "  sentry debug-files upload ./build --no-upload\n\n" +
-      "Not yet supported (planned): scanning inside ZIP archives, " +
-      "--symbol-maps (BCSymbolMap resolution), and --il2cpp-mapping line " +
-      "mappings.",
+      "  sentry debug-files upload ./build --no-zips --no-upload\n\n" +
+      "Not yet supported (planned): --symbol-maps (BCSymbolMap resolution) " +
+      "and --il2cpp-mapping line mappings.",
   },
   output: {
     human: formatUploadResult,
@@ -524,6 +529,12 @@ export const uploadCommand = buildCommand({
         optional: true,
         default: false,
       },
+      "no-zips": {
+        kind: "boolean",
+        brief: "Do not scan inside .zip archives",
+        optional: true,
+        default: false,
+      },
       "no-upload": {
         kind: "boolean",
         brief: "Scan and print what would be uploaded without uploading",
@@ -590,6 +601,7 @@ export const uploadCommand = buildCommand({
     const files = await scanPaths(scanTargets);
     const { prepared, oversizedCount } = await prepareDifs(files, filters, {
       maxFileSize,
+      scanZips: !flags["no-zips"],
     });
     const difs = dedupeDifs(
       buildDifList(prepared, Boolean(flags["include-sources"]))