[betegon]

Project-scoped OAuth requests can spend five seconds verifying project capabilities before continuing with unknown capabilities. The project response also serializes organization metadata that this preflight does not use; production traces showed that work waiting on an auth-config RPC.

Request collapse=organization only for this preflight, preserving the shared client's default response and all four capabilities. Cache timeout fallbacks for 60 seconds and register writes with waitUntil. Timeout entries use separate keys, and verified entries are read first, so a late concurrent timeout cannot overwrite known capabilities or shorten their 15-minute TTL. Project verification failures with HTTP 401/403/404 remain uncached.

This supersedes the 60-second project-timeout cache and waitUntil cache-write scheduling proposed in #1035. Its v2 cache format, Zod validation, slug validation, and reuse of organization cache entries during project verification remain outside this PR.

Verification

• Root pnpm run tsc and pnpm run lint passed. Full pnpm run test passed on Linux x64 (14,049 tests; 51 existing skips).
• The concurrency regression fails before the fix: a successful verification is replaced by null after an overlapping request times out. It passes afterward, retaining verified capabilities even after the timeout entry expires, without another API request.
• All 259 tests across the five focused test files pass, including timeout expiry/recovery without extra API calls, shared-client compatibility, and upstream HTTP 403 with cached unknown capabilities. SDK v1/v2 coverage rejects catalog calls without the required skill before contacting Sentry.
• The cache-write lifetime test uses Cloudflare’s ExecutionContext and consumes the MCP response while KV is blocked. Controlled mutations removing waitUntil, passing it unbound, and sharing the timeout/verified key each fail the corresponding regression test. Production code was restored before the full gate.
• Live API A/B on October 20: 10 alternating pairs, caching and retries disabled. Median time to response headers fell from 516 ms to 390 ms, with identical consumed fields. A separate trace pair confirmed that organization serialization and its auth-config RPC disappear with collapse=organization.

The API timings are not full MCP latency, and no benchmark request reproduced a five-second spike. Production timeout-rate reduction remains unverified. KV propagation and requests already in flight can still temporarily return unknown capabilities; separate keys prevent destructive overwrites, not propagation delays.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
sentry-local	Skipped		Oct 20, 2026 4:21pm UTC