fix(hono): classify matched handlers by position, not arity alone

Arity alone cannot tell a middleware from a route handler declared with an unused
`next` param. The matched entries carry their registration routeMeta, so apply the
same positional heuristic as wrapSubAppMiddleware: within a method+path group the
last handler is the route handler and earlier ones are middleware; `.use()` (method
'ALL') falls back to arity. Adds node-integration coverage for the arity-2 route
handler case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mydea

dev-packages/node-integration-tests/suites/hono/scenario.mjs

@@ -19,6 +19,11 @@ app.get('/error/:param', () => {
   throw new Error('Test error from Hono app');
 });
 
+// A route handler declared with an unused `next` param (arity 2). It is the last handler in its
+// method+path group, so it must be classified as the route handler — not wrapped as a middleware
+// span — even though arity alone would misclassify it.
+app.get('/arity-two-handler', (c, _next) => c.text('handler with two params'));
+
 // A sub-app with a named middleware, mounted via `app.route()`. The sub-app is also
 // auto-instrumented (every `new Hono()` is), so its own Sentry middleware must NOT show up as an
 // `<anonymous>` middleware span when it is copied into the parent at mount time.

dev-packages/node-integration-tests/suites/hono/test.ts

@@ -101,6 +101,26 @@ describe('hono auto-instrumentation', () => {
       await runner.completed();
     });
 
+    test('does not wrap a route handler declared with an unused next param as middleware', async () => {
+      const runner = createRunner()
+        .unordered()
+        .expect({
+          span: container => {
+            const segment = container.items.find(item => item.is_segment && item.name === 'GET /arity-two-handler');
+            if (!segment) {
+              throw new Error('segment for `GET /arity-two-handler` not in this container');
+            }
+            // The arity-2 handler is the route handler (last in its method+path group), so it must not
+            // produce a middleware span.
+            const middlewareSpans = container.items.filter(item => op(item) === 'middleware');
+            expect(middlewareSpans).toHaveLength(0);
+          },
+        })
+        .start();
+      runner.makeRequest('get', '/arity-two-handler');
+      await runner.completed();
+    });
+
     test('does not create a middleware span for the Sentry middleware in a mounted sub-app', async () => {
       const runner = createRunner()
         .unordered()

packages/server-utils/src/integrations/hono/honoIntegration.ts

@@ -131,13 +131,39 @@ function injectHonoInstrumentation(
   }
   _injectedHandlerLists.add(handlers);
 
-  // Wrap matched middleware handlers. `isMiddleware` also unwraps `onError`-composed sub-app handlers
-  // before checking, which a raw arity check would miss. `wrapMiddlewareWithSpan` is idempotent and
-  // skips Sentry's own middleware, so this is safe even if a handler is shared across routes.
-  for (const entry of handlers) {
+  // Wrap the matched middleware handlers for spans, leaving the route handler alone. Each entry
+  // carries its registration `routeMeta` (`entry[0][1]`: `{ method, path, … }`), so we use the same
+  // positional heuristic as `wrapSubAppMiddleware`: within a method+path group the LAST matched
+  // handler is the route handler and earlier ones are middleware (`app.get(path, mw, handler)`);
+  // `.use()` registers as method 'ALL' where the sole entry is genuinely middleware, so fall back to
+  // arity (via `isMiddleware`, which also unwraps `onError`-composed handlers) there. Position matters
+  // because arity alone would misclassify a route handler declared with an unused `next` param.
+  // `wrapMiddlewareWithSpan` is idempotent and skips Sentry's own middleware, so this is safe even
+  // when a handler is shared across routes.
+  const lastIndexByKey = new Map<string, number>();
+  for (const [i, entry] of handlers.entries()) {
+    const routeMeta = entry?.[0]?.[1] as { method?: string; path?: string } | undefined;
+    if (routeMeta?.method != null && routeMeta.path != null) {
+      // \0 is a collision-free delimiter: it cannot appear in a valid HTTP method or URL path.
+      lastIndexByKey.set(`${routeMeta.method}\0${routeMeta.path}`, i);
+    }
+  }
+
+  for (const [i, entry] of handlers.entries()) {
     const pair = entry?.[0];
     const handler = pair?.[0];
-    if (isMiddleware(handler)) {
+    if (typeof handler !== 'function') {
+      continue;
+    }
+
+    const routeMeta = pair?.[1] as { method?: string; path?: string } | undefined;
+    const isMW =
+      routeMeta?.method != null && routeMeta.path != null
+        ? lastIndexByKey.get(`${routeMeta.method}\0${routeMeta.path}`) !== i ||
+          (routeMeta.method === 'ALL' && isMiddleware(handler))
+        : isMiddleware(handler);
+
+    if (isMW) {
       pair[0] = wrapMiddlewareWithSpan(handler as MiddlewareHandler);
     }
   }