Distillation

Date: Sep 10, 2026

• 🔴 (09:08) User stated getEnvToken() always returns an environment token when one is set, unlike stored-token-first accessors when SENTRY_FORCE_ENV_TOKEN is unset.
• 🔴 (09:08) User stated auth-row host values are always normalized to scheme + host + optional port through normalizeOrigin.
• 🔴 (09:08) User stated the refresh-token option can bypass the threshold check and always refresh.
• 🔴 (09:08) User stated migrateNullHost(row: AuthRow): string never returns NULL; it lazy-migrates pre-schema-v16 auth rows with NULL host values.
• 🔴 (09:08) User stated authentication fingerprints are included in response-cache keys so cached entries never leak across accounts.
• 🟡 (09:09) refreshToken(options: RefreshTokenOptions = {}) in packages/cli/src/lib/db/auth.ts honors nonempty SENTRY_FORCE_ENV_TOKEN first: returns getEnvToken().token with { refreshed: false } and performs no refresh. Without a stored token, it falls back to an environment token or throws new AuthError("not_authenticated").
• 🟡 (09:09) refreshToken() returns an unexpired stored bearer token unchanged when expires_at is absent, or when force is false, remainingRatio > REFRESH_THRESHOLD, and now < expiresAt; it includes expiresAt and expiresIn = max(0, floor(remainingLifetime / 1000)) in the latter result.
• 🟡 (09:09) Expired stored credentials without refresh_token are cleared via clearAuth(); refreshToken() then falls back to an environment token if available, otherwise throws AuthError("expired", "Session expired and no refresh token available. Run 'sentry auth login'.").
• 🟡 (09:09) Concurrent stored-token refreshes are deduplicated with refreshPromise: performTokenRefresh(row.refresh_token) is awaited and refreshPromise is reset to null in finally.
• 🟡 (09:09) preloadProjectContext(cwd) in packages/cli/src/cli.ts calls captureEnvTokenHost() before findProjectRoot(cwd), setCachedProjectRoot, applySentryCliRcEnvShim(cwd), and persistent default-URL fallback, pinning env-token trust scope to the shell environment before repo-local .sentryclirc or defaults can mutate env.SENTRY_HOST/env.SENTRY_URL.
• 🟡 (09:09) preloadProjectContext() caches { projectRoot: result.projectRoot, reason: result.reason } through setCachedProjectRoot(cwd, ...), then applies .sentryclirc token/URL env shim. It sets env.SENTRY_URL = getDefaultUrl() only if neither env.SENTRY_HOST nor env.SENTRY_URL is nonempty; unavailable DB errors are ignored.
• 🟡 (09:09) runCompletion(completionArgs) sets SENTRY_CLI_NO_TELEMETRY = "1" before dynamically importing and calling handleComplete(completionArgs), preserving the completion fast path from loading @sentry/node-core, @stricli/core, and other heavy dependencies.
• 🟡 (09:09) CLI telemetry redacts values for --token and --auth-token case-insensitively in both --flag=value and --flag <value> forms, replacing values with [REDACTED]; SENSITIVE_ARGV_FLAGS is new Set(["token", "auth-token"]).
• 🟡 (09:09) Code change in packages/cli/src/lib/constants.ts: getConfiguredSentryUrl() now resolves in precedence order: normalized SENTRY_HOST, normalized SENTRY_URL, then normalized url from parseSntrysClaim() on trimmed SENTRY_AUTH_TOKEN or SENTRY_TOKEN; otherwise it returns undefined. Explicit URL configuration retains precedence over a sntrys_ claim.
• 🟡 (09:09) Tests added in packages/cli/test/lib/constants.test.ts: with no SENTRY_HOST/SENTRY_URL, a minted sntrys_ claim { iat: 1_700_000_000, url: "http://localhost:8000" } makes getConfiguredSentryUrl() return http://localhost:8000; explicit SENTRY_HOST = "https://configured.example.com" overrides a token claim URL of https://claimed.example.com. Tests preserve and restore SENTRY_AUTH_TOKEN and SENTRY_TOKEN alongside host/URL variables.
• 🟡 (09:09) Security regression test added in packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts: a sntrys_ token claim with url: "http://localhost:8000" and org: "x" routes getApiBaseUrl() and apiRequestToRegion(baseUrl, "/organizations/", { method: "GET" }) to http://localhost:8000/api/0/organizations/ with a Bearer authorization header when no explicit URL is configured.
• 🟡 (09:09) The sntrys-claim-mismatch security suite covers refusal to attach a sntrys_ bearer token when explicit SENTRY_HOST mismatches the embedded claim, acceptance of trusted self-hosted multi-region URLs registered through registerTrustedRegionUrls, fallback routing from claim URL, and the distinction that opaque sntryu_ user-auth tokens have no embedded-claim guard.