One-click install dependencies button for sentry-triage setup gate

[liztom]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

The sentry-triage canvas's package-missing setup gate currently tells users to ask Copilot to install its optional sentry dependency and reload extensions. In practice that flow is unreliable — an agent has to guess which of several possible directories the extension actually materialized into (repo source, user extension, project extension, or an installed plugin's own copy), and users have to manually kick the canvas afterward.

This replaces that with real one-click setup buttons on the gate:

• sentryClient.mjs — installPackage() runs npm install (async, via execFile) rooted at the file's own directory (via import.meta.url), so the path is never guessed and the shared extension process's event loop isn't blocked for the duration. Concurrent install clicks share one in-flight install promise instead of queueing redundant npm install runs. loadFactory() lazily retries the normal dynamic import('sentry') after install while still distinguishing a genuinely missing sentry package from a transitive-dependency defect in an already-resolved install, so the latter isn't masked as "package missing." login() fails fast with a clear message when SENTRY_AUTH_TOKEN/SENTRY_TOKEN is active in the environment (which takes precedence over the OAuth login this button drives), treats an empty/falsy auth.login() result as a failed sign-in instead of silently re-probing, and coalesces concurrent sign-in clicks onto one in-flight OAuth flow.
• preflight.mjs — installDependencies() runs the install and re-probes the connection; authenticate() classifies the new error codes for gate messaging.
• server.mjs / extension.mjs — wire POST /api/install-dependencies and POST /api/auth-login routes (through the existing CSRF/Host gate) to the new preflight functions, publishing refreshed connection state to the canvas.
• components/page.mjs / styles.mjs — the install and sign-in buttons, with loading/success/failure states and accessible live-region status updates; a live multi-org <select> dropdown that rebuilds in place once org discovery completes post-signin, without requiring a canvas reopen.
• README.md — documents the one-click flow; manual npm install / sentry auth login kept as a fallback.

Verified end-to-end against a materialized installed-plugin copy: simulated a missing sentry package, confirmed the gate shows, ran the install path, confirmed the connection state clears in the same process without a reload; then ran the sign-in flow through to a working multi-org canvas.

New install flow:

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[Copilot]

Pull request overview

Adds one-click dependency installation and Sentry authentication to the existing triage canvas.

Changes:

• Adds dependency-install and OAuth login APIs.
• Updates setup gates, live status, and organization discovery.
• Documents the streamlined setup flow.

Show a summary per file

File	Description
components/page.mjs	Adds setup actions and dynamic organization controls.
extension.mjs	Connects setup handlers to canvas state.
preflight.mjs	Adds installation and authentication flows.
sentryClient.mjs	Installs and reloads the Sentry SDK and performs login.
server.mjs	Exposes protected setup endpoints.
styles.mjs	Styles setup actions and statuses.
README.md	Documents one-click and manual setup.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (1)

extensions/sentry-triage/sentryClient.mjs:280

• This has the same constructor mismatch after the real SDK error class is loaded: { code: ... } becomes exitCode, while SENTRY_LOGIN_INCOMPLETE is discarded. Create a valid SentryError and attach the extension-specific code separately.

      throw new SentryError('Sign-in was not completed (denied, cancelled, or the code expired).', { code: 'SENTRY_LOGIN_INCOMPLETE' })

• Files reviewed: 7/7 changed files
• Comments generated: 4
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

extensions/sentry-triage/components/page.mjs:1984

• After a successful install that still requires authentication, applyConnectionState() hides the setup body while focus remains on its disabled install button. The success text is then written to that now-hidden live region, so keyboard and screen-reader users can lose their position without a reliable cue that the sign-in action appeared. Move focus to the newly visible sign-in button when making this transition.

          fetch("/api/install-dependencies", { method: "POST" })
            .then((res) => {
              if (!res.ok) throw new Error("install-dependencies " + res.status);
              return res.json();

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 3
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

extensions/sentry-triage/components/page.mjs:2092

• This selector always picks the connectivity lead first, including when a non-transient failure makes that panel hidden and exposes the unknown-error panel instead. Choose the lead using sentryConn.transient so keyboard focus moves into the panel that is actually visible.

                  const connLead = document.querySelector("#gate-body-conn .gate-lead, #gate-body-unknown .gate-lead");
                  if (connLead) { connLead.setAttribute("tabindex", "-1"); connLead.focus(); }

• Files reviewed: 7/7 changed files
• Comments generated: 3
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 3
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Balanced