Dashboard › cli › Distillation
1674af2d-e7c2-4419-9184-c8fd7fd894b1["lore_tm_v1_pZLG4kKZiHIxhrxTYZvOhdp7h2ylh8zY6I1vQmB2VRk","lore_tm_v1_4q46mto2boWp_f39zF3kjIEvZXacdU46QyK-rg9U7Jo","lore_tm_v1_HM9JcP3DvbPVtgHHCjvPBlum69ffaqRzIuglw0Xm-AQ","lore_tm_v1__uYe1NdN6UdGqSQ07OZ27JX11SWZQxJl7ddKxZD0aoQ","lore_tm_v1_lRYObIFnRCEniSTlvlFOR5GNvRArLTx0B1ej7dHlVXs","lore_tm_v1_n66eCgeg7Z3vGPWnYDk8MtEHI6qI0jJsCmTCy60nuo8","lore_tm_v1_9Ae7JxwldpYTTpoj2aATcRXcohuE06lU0CH2mAtbEhc","lore_tm_v1_VXvTmKbHB229141Y73Jb0bQaOduw47POHfqw86mJuVA","lore_tm_v1_rTZMRfjuZQPgPCdgNTpDAOP61y9oR_G5vG-fIgspNBc","lore_tm_v1_WDXwsyjQpxF31Q0bTIkuAZUverITIEAIGGoi9ufyvXc","lore_tm_v1_2zUsnSS-fjRAgyGMEPvyWOeTyn-fOjFq8RAUZPumqZQ","lore_tm_v1_1QaSCB3QzgPX5VPN4P0HCH1f3CSrlO6qAPUsziR2mqA"]
apiRequestToRegion always sends JSON and sets Content-Type explicitly; prepareHeaders() intentionally sets only Authorization and User-Agent, while SDK functions set their own Content-Type and rawApiRequest may omit it for bodies such as strings..sentryclirc files are never consulted by captureEnvTokenHost() because they have weaker integrity than environment configuration or embedded token claims.src/lib/sentry-client.ts showed prepareHeaders(input, init, token) preserves headers from init?.headers or, when the SDK invokes fetch(request) without init, from input.headers; this avoids replacing SDK-set headers and causing HTTP 415 errors under Node.js. The same Headers object is intentionally mutated across retries so handleUnauthorized() can replace Authorization and set x-sentry-cli-retry.prepareHeaders() enforces two credential guards before attaching authorization: isRequestOriginTrusted(input) checks the active token host, and an available unsigned sntrys_ url claim is checked with isHostTrustedForClaim(input, claimUrl). Either mismatch throws HostScopeError; claim parsing fails open, and trusted dynamically discovered regional silos remain allowed.src/lib/token-host.ts defines host equivalence as exact normalized origin for non-SaaS instances and strict HTTPS/default-port SaaS equivalence across *.sentry.io. getActiveTokenHost() mirrors auth precedence: stored OAuth host wins unless a present env token is forced with SENTRY_FORCE_ENV_TOKEN; otherwise it uses getEnvTokenHost().src/lib/token-host.ts uses a process-local loginTrustAnchor registered only through explicit --url or the boot-time environment snapshot, not through .sentryclirc. With an active token, custom headers use isRequestOriginTrusted(); without a token, they require a matching login anchor; with neither, isRequestOriginTrustedForCustomHeaders() fails closed.src/lib/env-token-host.ts snapshots an env token’s host once, before .sentryclirc can mutate SENTRY_HOST/SENTRY_URL. Resolution order is: 1. normalized embedded sntrys_ url claim, 2. normalized SENTRY_HOST then SENTRY_URL, 3. DEFAULT_SENTRY_URL. The claim is authoritative because it was embedded by the issuing server; for non-sntrys_ tokens, environment configuration is the only available host signal and layered-CI residual risk is documented.src/lib/constants.ts showed getConfiguredSentryUrl() checks SENTRY_HOST before SENTRY_URL, normalizes bare hostnames by prefixing https://, and returns undefined if neither is configured.getApiBaseUrl() and getControlSiloUrl(). Explicit URL configuration continues to take precedence, while the fetch-layer host guard continues to reject mismatched origins; independent correctness and security reviews were launched against that exact scope.SENTRY_AUTH_TOKEN unless SENTRY_FORCE_ENV_TOKEN=1, and credential migration exercised hosts https://legacy-configured.example.com and https://sentry.io.test.poolOptions was removed in Vitest 4, and its former options must now be configured as top-level options..lore.md; plugin references packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md, event.md, explore.md, feedback.md, issue.md, log.md, replay.md, span.md, and trace.md; source files packages/cli/src/commands/org/list.ts, packages/cli/src/commands/project/delete.ts, packages/cli/src/lib/api/organizations.ts, packages/cli/src/lib/api/projects.ts, packages/cli/src/lib/constants.ts, packages/cli/src/lib/db/regions.ts, packages/cli/src/lib/db/schema.ts, packages/cli/src/lib/oauth.ts, packages/cli/src/lib/region.ts, packages/cli/src/lib/resolve-target.ts, packages/cli/src/lib/sentry-client.ts, and packages/cli/src/lib/token-host.ts; and tests packages/cli/test/lib/constants.test.ts, packages/cli/test/lib/db/auth.host.test.ts, packages/cli/test/lib/db/schema.test.ts, packages/cli/test/lib/resolve-target.mocked.test.ts, packages/cli/test/lib/security/refresh-token-poison.test.ts, packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts, and packages/cli/test/lib/sentry-client.test.ts.git diff --check passed. Assistant characterized the 145-test matrix as covering routing, auth, region, schema, and security, with independent correctness and security reviews still running before the final report.