fix(cloudflare): Keep request scopes for streamed responses and the body opt-out

Two Cloudflare integration tests failed after the move to the shared
request handler wrapper.

Without `nodejs_compat`, Cloudflare has no `AsyncLocalStorage`. The
wrapper ends the span of a streamed response from a stream callback,
after the handler returns, and that callback ran outside the request's
scopes. There `getClient()` found no client, so core sent the segment
span as a static transaction instead of streaming it, and a captured
stream error would not update the request session. The wrapper now runs
these callbacks in the request's isolation scope and current scope.

Before the move, removing `httpServerIntegration` turned off request
body capture on Cloudflare. The wrapper used `dataCollection.httpBodies`
instead, so bodies were attached. Cloudflare now passes
`maxRequestBodySize: 'none'` when the integration is missing, and the
CHANGELOG no longer lists that change.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: isaacs

CHANGELOG.md

@@ -122,7 +122,6 @@ Work in this release was contributed by @adityareddy-dev, @jpdefo, @Jxxunnn, @ph
   - Request spans now set `client.address` from the `CF-Connecting-IP` header (or another forwarding header), as on the other runtimes. This follows `dataCollection.userInfo`, which is `true` by default. To leave it out, set `dataCollection: { userInfo: false }`.
   - Request spans now have the response header attributes, and events have the `response` context with the status code.
   - When the source of a streamed response fails, the SDK now captures the error and marks the span as failed. With `captureErrors: false`, it does not capture it.
-  - If you removed `httpServerIntegration`, request bodies now follow `dataCollection.httpBodies`, as on the other runtimes. Before, the SDK attached no body.
 
 ## 11.8.0
 

packages/cloudflare/src/wrapRequestHandlerWithInit.ts

@@ -100,7 +100,11 @@ export function wrapRequestHandlerWithInit(
         request,
         client,
         isolationScope,
-        options: client.getIntegrationByName<Integration & HttpServerIntegrationOptions>('HttpServer'),
+        // Without the `HttpServer` integration, the SDK attaches no request body, so users can turn
+        // body capture off by removing it.
+        options: client.getIntegrationByName<Integration & HttpServerIntegrationOptions>('HttpServer') ?? {
+          maxRequestBodySize: 'none',
+        },
         origin: 'auto.http.cloudflare',
         mechanism: captureErrors ? { handled: false, type: getRequestErrorMechanismType(context) } : undefined,
         attributes,

packages/server-utils/src/utils/wrapServerRequestHandler.ts

@@ -13,6 +13,7 @@ import {
   captureBodyFromWinterCGRequest,
   captureException,
   continueTrace,
+  getCurrentScope,
   getHttpSpanDetailsFromUrlObject,
   hasSpansEnabled,
   hasSpanStreamingEnabled,
@@ -25,6 +26,8 @@ import {
   startSpanManual,
   winterCGHeadersToDict,
   winterCGRequestToRequestData,
+  withIsolationScope,
+  withScope,
 } from '@sentry/core';
 import type { ServerRequestOptions } from '@sentry/core/server';
 import {
@@ -159,7 +162,13 @@ export async function wrapServerRequestHandler(
           throw e;
         }
         isolationScope.setContext('response', { status_code: response.status });
-        return onResponseDone(response, isStreamingResponse(response), () => finish(response), captureError);
+        const inRequestScope = bindToRequestScope(isolationScope);
+        return onResponseDone(
+          response,
+          isStreamingResponse(response),
+          inRequestScope(() => finish(response)),
+          inRequestScope(captureError),
+        );
       }
 
       const [rawName, attributes] = getHttpSpanDetailsFromUrlObject(
@@ -235,10 +244,11 @@ export async function wrapServerRequestHandler(
           httpHeadersToSpanAttributes(responseHeadersToDict(response.headers), dataCollection, 'response'),
         );
 
+        const inRequestScope = bindToRequestScope(isolationScope);
         return onResponseDone(
           response,
           isStreamingResponse(response),
-          () => {
+          inRequestScope(() => {
             if (onSpanEnd) {
               safeCallback(
                 DEBUG_BUILD ? 'Error in `onSpanEnd`:' : '',
@@ -248,17 +258,34 @@ export async function wrapServerRequestHandler(
             }
             span.end();
             finish(response);
-          },
-          error => {
+          }),
+          inRequestScope((error: unknown) => {
             span.setStatus({ code: SPAN_STATUS_ERROR, message: 'internal_error' });
             captureError(error);
-          },
+          }),
         );
       });
     },
   );
 }
 
+/**
+ * Returns a function that binds a callback to the request's isolation scope and the current scope.
+ *
+ * A streamed body finishes after the handler returns. Without `AsyncLocalStorage` (Cloudflare
+ * Workers without `nodejs_compat`), its callbacks then run outside the request's scopes, where
+ * `getClient()` finds no client: the segment span would be sent as a transaction, and a captured
+ * error would not update the request session.
+ */
+function bindToRequestScope(
+  isolationScope: Scope,
+): <A extends unknown[]>(fn: (...args: A) => void) => (...args: A) => void {
+  const scope = getCurrentScope();
+  return fn =>
+    (...args) =>
+      withIsolationScope(isolationScope, () => withScope(scope, () => fn(...args)));
+}
+
 function shouldCreateSpan(
   client: Client,
   options: ServerRequestOptions<Request, Response> | undefined,