OUT-4026: suppress AssemblyMissingHeadersError bot noise

[SandipBajracharya]

Changes

• Fix the Sentry onRequestError suppression in src/instrumentation.ts to match by error name instead of instanceof. The original guard never fired — instrumentation.ts is a separate bundle, so its copy of AssemblyMissingHeadersError has a different class identity than the one thrown in app code, making instanceof always false. Every occurrence of this error has been reaching Sentry since the guard was introduced.
• Extract a shared ASSEMBLY_MISSING_HEADERS_ERROR_NAME constant in src/lib/assembly/errors.ts so the filter and the error definition can't drift apart.
• Add src/app/robots.ts (disallow all crawling) and src/app/sitemap.ts (empty) so bot hits to /robots.txt and /sitemap.xml resolve to static 200s instead of falling through to the authenticated root layout, which throws AssemblyMissingHeadersError.

Root cause

/robots.txt and /sitemap.xml are excluded from the proxy matcher (src/proxy.ts), so no auth headers are injected. With no route defined, Next.js rendered the not-found page, which still runs the root layout.tsx → authenticateHeaders() → throws. Bots/crawlers probing those paths generated the noise (75 occurrences / 30 "users", escalating).

Testing Criteria

• pnpm typecheck and pnpm lint pass clean.
• Verified by reproduction: pre-change, curl /robots.txt 500s through the root layout with AssemblyMissingHeadersError; post-change, both /robots.txt and /sitemap.xml return static-prerendered 200s and bypass the layout.
• Loom walkthrough to be added.

Notes

• Two-layer design is intentional: robots.ts/sitemap.ts eliminate the error for the two well-known probed paths; the instrumentation.ts fix is the safety net that correctly suppresses the same error for any other unrouted path a bot might guess.
• Fixes CLIENT-HOME-V3-1P — auto-closes the Sentry issue on merge.

Impact & Surface Area of Change

• onRequestError now suppresses any error named AssemblyMissingHeadersError. String is highly specific, so collision risk is negligible, but note the check is broader than instanceof by design.
• New metadata routes only affect /robots.txt and /sitemap.xml; no existing route behavior changes. Disallowing all crawling is intended for this token-authenticated, per-tenant app.

🤖 Generated with Claude Code

[linear-code]

OUT-4026

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
client-home-v3	Ready	Preview	Aug 13, 2026 7:02am

[greptile-apps]

Greptile Summary

The PR prevents crawler requests from generating expected missing-auth-header events in Sentry.

• Adds standalone /robots.txt and /sitemap.xml metadata routes that bypass the authenticated layout.
• Replaces a cross-bundle instanceof check with a shared error-name comparison.
• Centralizes the AssemblyMissingHeadersError name to prevent drift between construction and filtering.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or non-blocking defects identified.

The metadata routes align with the configured Next.js routing behavior, and the shared name-based filter matches the error factory’s assigned name while continuing to forward other errors.

Important Files Changed

Filename	Overview
src/app/robots.ts	Adds a valid disallow-all Next.js metadata route for the token-authenticated application.
src/app/sitemap.ts	Adds an empty sitemap metadata route so crawler requests resolve without entering the authenticated layout.
src/instrumentation.ts	Filters the expected missing-header error by its stable name rather than bundle-sensitive class identity.
src/lib/assembly/errors.ts	Exports and reuses the canonical missing-header error name without changing the constructed error behavior.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Bot requests robots.txt or sitemap.xml] --> B[Next.js metadata route]
    B --> C[Static 200 response]
    D[Other request without injected auth headers] --> E[AssemblyMissingHeadersError]
    E --> F{Error name matches shared constant?}
    F -->|Yes| G[Skip Sentry capture]
    F -->|No| H[Capture request error in Sentry]

Loading

_{Reviews (1): Last reviewed commit: "fix(OUT-4026): suppress AssemblyMissingH..." | Re-trigger Greptile}

[priosshrsth]

lgtm