fix(remix): Use npx @sentry/remix --upload-sourcemaps instead of sentry-upload-sourcemaps to avoid global bin collisions

[s1gr1d]

Reference: getsentry/sentry-javascript#20422

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3c4097b. Configure here.}

[cursor]

Wrong npx invocation syntax for scoped package binary

High Severity

The command uses npx @sentry/remix --upload-sourcemaps but the @sentry/remix package's bin field defines the binary as sentry-upload-sourcemaps, not remix. When npx resolves a scoped package, it looks for a binary matching the unscoped name (remix), which doesn't exist. The PR title itself says to use npx --package=@sentry/remix, and the correct syntax is npx --package=@sentry/remix sentry-upload-sourcemaps. The generated build scripts will fail at runtime.

Additional Locations (2)

• src/sourcemaps/tools/remix.ts#L52-L53
• src/sourcemaps/tools/remix.ts#L86-L87

 

^{Reviewed by Cursor Bugbot for commit 3c4097b. Configure here.}

[s1gr1d]

We explicitly want to change this. As @sentry/remix only has one bin script, it will just call the one, regardless of the name. I tested the command and it works

[sentry]

Bug: The generated npx command for sourcemap upload is incorrect. It uses npx @sentry/remix --upload-sourcemaps instead of the correct npx --package=@sentry/remix sentry-upload-sourcemaps.
_{Severity: HIGH}

Suggested Fix

Change the generated command to use the correct npx syntax for running a binary from a package without installing it: npx --package=@sentry/remix sentry-upload-sourcemaps --org ... --project ....

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/remix/sdk-setup.ts#L337-L338

Potential issue: The code generates an incorrect `npx` command, `npx @sentry/remix
--upload-sourcemaps ...`, and writes it into the user's `package.json` file. This
command will fail because `npx @sentry/remix` attempts to execute a binary named `remix`
from the `@sentry/remix` package, which does not exist. The correct binary is
`sentry-upload-sourcemaps`. As a result, the sourcemap upload step will silently fail
for all users who rely on the Remix wizard for setup, hindering debugging in production.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[s1gr1d]

we explicitly want to change this. As @sentry/remix only has one bin script, it will just call the one, regardless of the name