fix(core,mcp): Bugbot follow-ups from the shared search parser

[sentry-junior]

Follow-ups to the Cursor Bugbot review on #1532.

MCP regex scanner missed canonical array keys

Sentry's grammar (array_includes_tag_key) writes array membership on an explicit tag inside the brackets: tags[k[*],array]. REGEX_FILTER_KEY_SOURCE in mcp-core/.../search-events/utils.ts only accepted tags[k,array][*], which the grammar doesn't parse. So searchFilterOccurrences skipped canonical array-includes regex filters, and isSemanticFilterDowngrade couldn't tell when one was rewritten into a wildcard or full-text match.

The key pattern now takes [*] inside the brackets, matching the grammar and the CLI's REGEX_FILTER_KEY_SOURCE. New tests cover tags[k[*],array]://^a b// rewritten to tags[k[*],array]:*a* and to message:"*a b*"; both fail without the fix.

Aggregate size filters skipped the key check

predicateFilter checked argument types for AGGREGATE_DURATION, AGGREGATE_DATE and AGGREGATE_PERCENTAGE, but let AGGREGATE_SIZE match any aggregate whose value looked like a size. It now requires a size-key argument, like the others. A new test fails without the fix.

Behavior change: with the default config, sizeKeys is empty, so avg(x):>1kb no longer parses as a typed filter and falls back to free text. avg(span.duration):>1s already works this way, because span.duration isn't a default duration key. Callers that know their size fields should pass sizeKeys. CLI and MCP don't set any key sets today.

This diverges from the frontend, whose searchSyntax/parser.tsx predicateFilter has the same fall-through. It's noted in #1533 so it can be fixed upstream or settled when the frontend switches to the shared package.

Checks

• toolkit-core: 332 tests pass
• CLI search-query: 122 tests pass
• mcp-core: 1823 tests pass
• oxlint, oxfmt and toolkit-core tsc are clean

via byk.

--

View Junior Session [Sentry]

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
sentry-local	Skipped		Oct 17, 2026 12:54am UTC

[BYK]

Not changed: aggregate size filters skip key checks

Well if this is a bug upstream, let's fix it here and note it in #1533

[sentry-junior]

Done in a96b664. AGGREGATE_SIZE now requires a size-key argument, like the other typed aggregates, and a new test covers it (it fails without the fix). I noted the divergence from the frontend in #1533 (comment) and updated the PR description, including the behavior change: with the default empty sizeKeys, avg(x):>1kb now falls back to free text.

[sentry-junior]

Correction to my comment above: the link to the #1533 note is broken. The note is here: #1533 (comment). The PR title and description are now updated to cover both fixes.