Add crashlytics:sourcemap:upload command behind experiment

[tonybaroneee]

Description

The crashlytics:sourcemap:upload command is a new Firebase CLI command that enables developers of web applications to upload JavaScript source maps to Firebase Crashlytics. This is essential for de-obfuscating JavaScript stack traces collected from web apps, allowing customers to view readable crash reports within the Crashlytics dashboard. This functionality is part of the larger effort to add support for web apps within Crashlytics.

Scenarios Tested

Unit + manually tested.

Sample Commands

firebase crashlytics:sourcemap:upload
--project <projectId>
--app-id <appID>
	--bucket-location <bucketLocation>
--app-version <appVersion>
[directory]

[wiz-9635d3485b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	5
Software Management Findings	-
Total	5

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[gemini-code-assist]

Code Review

This pull request introduces a new command crashlytics:sourcemap:upload to upload JavaScript source maps to Crashlytics for web apps, enabled under the crashlyticsWeb experiment flag. It includes the command implementation, utility functions for archiving files, and comprehensive unit tests. The code reviewer identified several critical issues, including a potential race condition and unhandled error crash in pipeAsync, a path resolution bug when using path.relative on already relative paths, a performance concern with reading entire JS files synchronously, a resource leak where temporary zip files are not deleted, and a missing retryDelay type definition in CommandOptions.

[tonybaroneee]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces the crashlytics:sourcemap:upload command, allowing users to upload JavaScript source maps for web applications to Crashlytics under the crashlyticsWeb experiment flag. The implementation includes utilities for discovering source map mappings, extracting sourceMappingURL from JS files, and uploading zipped assets to Google Cloud Storage, alongside a new MurmurHash3 hashing function. The review feedback highlights a resource leak from an unclosed file descriptor in archiveFile.ts, a path resolution bug in uploadMap when options.projectRoot is customized, a potential buffer decoding issue in getLinkedSourceMapPath, and a style guide violation regarding explicit boolean comparisons.

[gemini-code-assist]

There is a bug here when options.projectRoot is specified and differs from process.cwd().

obfuscatedFilePath is already resolved as a relative path to rootDir (which is options.projectRoot ?? process.cwd()) in findSourceMapMappings. Calling path.relative(options.projectRoot ?? process.cwd(), obfuscatedFilePath) on an already relative path will cause Node's path.relative to resolve obfuscatedFilePath against process.cwd(), resulting in an incorrect path (e.g., containing ../../ segments).

Since obfuscatedFilePath is already relative to the project root, you should use it directly instead of calling path.relative again.

Suggested change

	const obfuscatedPath = path
	.relative(options.projectRoot ?? process.cwd(), obfuscatedFilePath)
	.split(path.sep)
	.map((p) => (p === ".next" ? "_next" : p))
	const obfuscatedPath = obfuscatedFilePath
	.split(path.sep)
	.map((p) => (p === ".next" ? "_next" : p))

[joehan]

Please double check this behavior by running the command from a subdirectory of a firebase project dir, and make sure that it still works as expected.

[joehan]

Mostly LGTM after a few final fixes!

[joehan]

Please double check this behavior by running the command from a subdirectory of a firebase project dir, and make sure that it still works as expected.