fix: add trace ID validation to trace view + UUID dash-stripping

Fix two related issues (CLI-7Z, CLI-4X) in `sentry trace view`:

1. Add missing `validateTraceId()` call in `parsePositionalArgs()` —
   the raw, unvalidated trace ID was going directly to the API, causing
   confusing "No trace found" errors for malformed input. Now matches
   the pattern used by `trace logs` and `log view`.

2. Add UUID dash-stripping in `validateHexId()` — when input matches
   UUID format (8-4-4-4-12 hex with dashes), dashes are automatically
   stripped and a warning is printed to stderr. This handles the common
   case of users copy-pasting trace IDs in UUID format (e.g.,
   `ed29abc8-71c4-475b-9675-4655ef1a02d0`).

Changes:
- src/lib/hex-id.ts: Add UUID_DASH_RE regex and dash-stripping before
  validation in validateHexId()
- src/commands/trace/view.ts: Add validateTraceId() at all 4 return
  paths in parsePositionalArgs(), with validateAndWarn() helper for
  UUID auto-correction warnings
- Updated tests: hex-id (unit + property), trace-id (unit + property),
  trace view (unit, property, func)

Author: BYK

src/commands/trace/view.ts

@@ -34,6 +34,7 @@ import {
   resolveProjectBySlug,
 } from "../../lib/resolve-target.js";
 import { buildTraceUrl } from "../../lib/sentry-urls.js";
+import { validateTraceId } from "../../lib/trace-id.js";
 import type { Writer } from "../../types/index.js";
 
 type ViewFlags = {
@@ -46,18 +47,51 @@ type ViewFlags = {
 /** Usage hint for ContextError messages */
 const USAGE_HINT = "sentry trace view <org>/<project> <trace-id>";
 
+/**
+ * Validate a trace ID and detect UUID auto-correction.
+ *
+ * Returns the validated trace ID and an optional warning when dashes were
+ * stripped from a UUID-format input (e.g., `ed29abc8-71c4-475b-...`).
+ */
+function validateAndWarn(raw: string): {
+  traceId: string;
+  uuidWarning?: string;
+} {
+  const traceId = validateTraceId(raw);
+  const trimmedRaw = raw.trim().toLowerCase();
+  const uuidWarning =
+    trimmedRaw.includes("-") && trimmedRaw !== traceId
+      ? `Auto-corrected trace ID: stripped dashes → ${traceId}`
+      : undefined;
+  return { traceId, uuidWarning };
+}
+
+/**
+ * Merge multiple optional warning strings into a single warning, or undefined.
+ */
+function mergeWarnings(
+  ...warnings: (string | undefined)[]
+): string | undefined {
+  const filtered = warnings.filter(Boolean);
+  return filtered.length > 0 ? filtered.join("\n") : undefined;
+}
+
 /**
  * Parse positional arguments for trace view.
  * Handles: `<trace-id>` or `<target> <trace-id>`
  *
+ * Validates the trace ID format (32-character hex) and auto-corrects
+ * UUID-format inputs by stripping dashes.
+ *
  * @param args - Positional arguments from CLI
  * @returns Parsed trace ID and optional target arg
  * @throws {ContextError} If no arguments provided
+ * @throws {ValidationError} If the trace ID format is invalid
  */
 export function parsePositionalArgs(args: string[]): {
   traceId: string;
   targetArg: string | undefined;
-  /** Warning message if arguments appear to be in the wrong order */
+  /** Warning message if arguments appear to be in the wrong order or UUID was auto-corrected */
   warning?: string;
   /** Suggestion when first arg looks like an issue short ID */
   suggestion?: string;
@@ -72,23 +106,38 @@ export function parsePositionalArgs(args: string[]): {
   }
 
   if (args.length === 1) {
-    const { id: traceId, targetArg } = parseSlashSeparatedArg(
+    const { id, targetArg } = parseSlashSeparatedArg(
       first,
       "Trace ID",
       USAGE_HINT
     );
-    return { traceId, targetArg };
+    const validated = validateAndWarn(id);
+    return {
+      traceId: validated.traceId,
+      targetArg,
+      warning: validated.uuidWarning,
+    };
   }
 
   const second = args[1];
   if (second === undefined) {
-    return { traceId: first, targetArg: undefined };
+    const validated = validateAndWarn(first);
+    return {
+      traceId: validated.traceId,
+      targetArg: undefined,
+      warning: validated.uuidWarning,
+    };
   }
 
   // Detect swapped args: user put ID first and target second
   const swapWarning = detectSwappedViewArgs(first, second);
   if (swapWarning) {
-    return { traceId: first, targetArg: second, warning: swapWarning };
+    const validated = validateAndWarn(first);
+    return {
+      traceId: validated.traceId,
+      targetArg: second,
+      warning: mergeWarnings(swapWarning, validated.uuidWarning),
+    };
   }
 
   // Detect issue short ID passed as first arg (e.g., "CAM-82X some-trace-id")
@@ -97,7 +146,13 @@ export function parsePositionalArgs(args: string[]): {
     : undefined;
 
   // Two or more args - first is target, second is trace ID
-  return { traceId: second, targetArg: first, suggestion };
+  const validated = validateAndWarn(second);
+  return {
+    traceId: validated.traceId,
+    targetArg: first,
+    warning: validated.uuidWarning,
+    suggestion,
+  };
 }
 
 /**

src/lib/hex-id.ts

@@ -10,13 +10,25 @@ import { ValidationError } from "./errors.js";
 /** Regex for a valid 32-character hexadecimal ID */
 export const HEX_ID_RE = /^[0-9a-f]{32}$/i;
 
+/**
+ * Regex for UUID format with dashes: 8-4-4-4-12 hex groups.
+ * Users often copy trace/log IDs from tools that display them in UUID format.
+ * Stripping the dashes yields a valid 32-character hex ID.
+ */
+export const UUID_DASH_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 /** Max display length for invalid IDs in error messages before truncation */
 const MAX_DISPLAY_LENGTH = 40;
 
 /**
  * Validate that a string is a 32-character hexadecimal ID.
  * Trims whitespace and normalizes to lowercase before validation.
  *
+ * When the input matches UUID format (8-4-4-4-12 hex with dashes), the dashes
+ * are automatically stripped. This is a common copy-paste mistake — the
+ * underlying hex content is valid, just formatted differently.
+ *
  * Normalization to lowercase ensures consistent comparison with API responses,
  * which return lowercase hex IDs regardless of input casing.
  *
@@ -29,7 +41,12 @@ const MAX_DISPLAY_LENGTH = 40;
  * @throws {ValidationError} If the format is invalid
  */
 export function validateHexId(value: string, label: string): string {
-  const trimmed = value.trim().toLowerCase();
+  let trimmed = value.trim().toLowerCase();
+
+  // Auto-correct UUID format: strip dashes (8-4-4-4-12 → 32 hex chars)
+  if (UUID_DASH_RE.test(trimmed)) {
+    trimmed = trimmed.replace(/-/g, "");
+  }
 
   if (!HEX_ID_RE.test(trimmed)) {
     const display =

test/commands/trace/view.func.test.ts

@@ -197,7 +197,7 @@ describe("viewCommand.func", () => {
         context,
         { json: false, web: false, spans: 100 },
         "test-org/test-project",
-        "0000000000000000"
+        "00000000000000000000000000000000"
       )
     ).rejects.toThrow(ValidationError);
   });
@@ -213,12 +213,14 @@ describe("viewCommand.func", () => {
         context,
         { json: false, web: false, spans: 100 },
         "test-org/test-project",
-        "deadbeef12345678"
+        "deadbeef12345678deadbeef12345678"
       );
       expect.unreachable("Should have thrown");
     } catch (error) {
       expect(error).toBeInstanceOf(ValidationError);
-      expect((error as ValidationError).message).toContain("deadbeef12345678");
+      expect((error as ValidationError).message).toContain(
+        "deadbeef12345678deadbeef12345678"
+      );
     }
   });
 

test/commands/trace/view.property.test.ts

@@ -9,14 +9,13 @@ import { describe, expect, test } from "bun:test";
 import {
   array,
   assert as fcAssert,
-  pre,
   property,
   string,
   stringMatching,
   tuple,
 } from "fast-check";
 import { parsePositionalArgs } from "../../../src/commands/trace/view.js";
-import { ContextError } from "../../../src/lib/errors.js";
+import { ContextError, ValidationError } from "../../../src/lib/errors.js";
 import { DEFAULT_NUM_RUNS } from "../../model-based/helpers.js";
 
 /** Valid trace IDs (32-char hex) */
@@ -28,16 +27,21 @@ const slugArb = stringMatching(/^[a-z][a-z0-9-]{1,20}[a-z0-9]$/);
 /** Non-empty strings for general args */
 const nonEmptyStringArb = string({ minLength: 1, maxLength: 50 });
 
-/** Non-empty strings without slashes (valid plain IDs) */
-const plainIdArb = nonEmptyStringArb.filter((s) => !s.includes("/"));
+/**
+ * Insert dashes at UUID positions (8-4-4-4-12) into a 32-char hex string.
+ */
+function toUuidFormat(hex: string): string {
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
 
 describe("parsePositionalArgs properties", () => {
-  test("single arg without slashes: returns it as traceId with undefined targetArg", async () => {
+  test("single valid trace ID: returns it as traceId with undefined targetArg", async () => {
     await fcAssert(
-      property(plainIdArb, (input) => {
+      property(traceIdArb, (input) => {
         const result = parsePositionalArgs([input]);
         expect(result.traceId).toBe(input);
         expect(result.targetArg).toBeUndefined();
+        expect(result.warning).toBeUndefined();
       }),
       { numRuns: DEFAULT_NUM_RUNS }
     );
@@ -69,18 +73,13 @@ describe("parsePositionalArgs properties", () => {
     );
   });
 
-  test("two args: first is always targetArg, second is always traceId", async () => {
+  test("two args with valid trace ID: first is targetArg, second is traceId", async () => {
     await fcAssert(
-      property(
-        tuple(nonEmptyStringArb, nonEmptyStringArb),
-        ([first, second]) => {
-          // Skip swap-detection cases (second has / but first doesn't)
-          pre(first.includes("/") || !second.includes("/"));
-          const result = parsePositionalArgs([first, second]);
-          expect(result.targetArg).toBe(first);
-          expect(result.traceId).toBe(second);
-        }
-      ),
+      property(tuple(nonEmptyStringArb, traceIdArb), ([first, traceId]) => {
+        const result = parsePositionalArgs([first, traceId]);
+        expect(result.targetArg).toBe(first);
+        expect(result.traceId).toBe(traceId);
+      }),
       { numRuns: DEFAULT_NUM_RUNS }
     );
   });
@@ -106,17 +105,15 @@ describe("parsePositionalArgs properties", () => {
       property(
         tuple(
           nonEmptyStringArb,
-          nonEmptyStringArb,
+          traceIdArb,
           array(nonEmptyStringArb, { minLength: 1, maxLength: 5 })
         ),
-        ([first, second, extras]) => {
-          // Skip swap-detection cases (second has / but first doesn't)
-          pre(first.includes("/") || !second.includes("/"));
-          const args = [first, second, ...extras];
+        ([first, traceId, extras]) => {
+          const args = [first, traceId, ...extras];
           const result = parsePositionalArgs(args);
 
           expect(result.targetArg).toBe(first);
-          expect(result.traceId).toBe(second);
+          expect(result.traceId).toBe(traceId);
         }
       ),
       { numRuns: DEFAULT_NUM_RUNS }
@@ -125,17 +122,12 @@ describe("parsePositionalArgs properties", () => {
 
   test("parsing is deterministic: same input always produces same output", async () => {
     await fcAssert(
-      property(
-        array(nonEmptyStringArb, { minLength: 1, maxLength: 3 }),
-        (args) => {
-          // Skip single-arg with slashes — those throw ContextError (tested separately)
-          pre(args.length > 1 || !args[0]?.includes("/"));
-
-          const result1 = parsePositionalArgs(args);
-          const result2 = parsePositionalArgs(args);
-          expect(result1).toEqual(result2);
-        }
-      ),
+      property(tuple(slugArb, traceIdArb), ([target, traceId]) => {
+        const args = [target, traceId];
+        const result1 = parsePositionalArgs(args);
+        const result2 = parsePositionalArgs(args);
+        expect(result1).toEqual(result2);
+      }),
       { numRuns: DEFAULT_NUM_RUNS }
     );
   });
@@ -144,19 +136,48 @@ describe("parsePositionalArgs properties", () => {
     expect(() => parsePositionalArgs([])).toThrow(ContextError);
   });
 
-  test("result always has traceId property defined", async () => {
+  test("result always has traceId property defined (valid inputs)", async () => {
     await fcAssert(
-      property(
-        array(nonEmptyStringArb, { minLength: 1, maxLength: 3 }),
-        (args) => {
-          // Skip single-arg with slashes — those throw ContextError (tested separately)
-          pre(args.length > 1 || !args[0]?.includes("/"));
+      property(traceIdArb, (traceId) => {
+        const result = parsePositionalArgs([traceId]);
+        expect(result.traceId).toBeDefined();
+        expect(typeof result.traceId).toBe("string");
+      }),
+      { numRuns: DEFAULT_NUM_RUNS }
+    );
+  });
 
-          const result = parsePositionalArgs(args);
-          expect(result.traceId).toBeDefined();
-          expect(typeof result.traceId).toBe("string");
-        }
-      ),
+  test("UUID-format trace IDs are accepted and produce 32-char hex", async () => {
+    await fcAssert(
+      property(traceIdArb, (hex) => {
+        const uuid = toUuidFormat(hex);
+        const result = parsePositionalArgs([uuid]);
+        expect(result.traceId).toBe(hex);
+        expect(result.warning).toContain("Auto-corrected");
+      }),
+      { numRuns: DEFAULT_NUM_RUNS }
+    );
+  });
+
+  test("UUID-format trace IDs work in two-arg case", async () => {
+    await fcAssert(
+      property(tuple(slugArb, traceIdArb), ([target, hex]) => {
+        const uuid = toUuidFormat(hex);
+        const result = parsePositionalArgs([target, uuid]);
+        expect(result.traceId).toBe(hex);
+        expect(result.targetArg).toBe(target);
+        expect(result.warning).toContain("Auto-corrected");
+      }),
+      { numRuns: DEFAULT_NUM_RUNS }
+    );
+  });
+
+  test("invalid trace IDs always throw ValidationError", async () => {
+    const invalidIdArb = stringMatching(/^[g-z]{10,20}$/);
+    await fcAssert(
+      property(invalidIdArb, (badId) => {
+        expect(() => parsePositionalArgs([badId])).toThrow(ValidationError);
+      }),
       { numRuns: DEFAULT_NUM_RUNS }
     );
   });