Distillation

🔴 (16:00) User showed packages/cli/src/cli.ts: shell completion command __complete is dispatched before heavy imports to avoid loading @sentry/node-core (~280ms); other commands use the full CLI with telemetry, middleware, and error recovery. bin.ts remains a thin wrapper that registers stream error handlers and calls startCli().

🔴 (16:00) User showed packages/cli/src/cli.ts::preloadProjectContext(cwd): dynamically imports and calls captureEnvTokenHost() before .sentryclirc or persistent defaults can mutate env.SENTRY_HOST/env.SENTRY_URL; concurrently imports findProjectRoot and setCachedProjectRoot, caches projectRoot and reason, applies applySentryCliRcEnvShim(cwd), then uses getDefaultUrl() only when neither SENTRY_HOST nor SENTRY_URL is nonempty. Database failure while reading the persistent URL default is ignored.

🔴 (16:00) User showed packages/cli/src/cli.ts::runCompletion(completionArgs): sets SENTRY_CLI_NO_TELEMETRY = "1" so db/index.ts skips the @sentry/node-core lazy require (~280ms), dynamically imports ./lib/complete.js, and calls handleComplete(completionArgs).

🔴 (16:00) User stated values of sensitive flags must never be sent to telemetry. In packages/cli/src/cli.ts, SENSITIVE_ARGV_FLAGS is new Set(["token", "auth-token"]); sensitiveArgvFlag(token) detects case-insensitive --flag=value and --flag <value> forms, returning "eq", "next", or null.

🔴 (16:00) User showed packages/cli/src/lib/db/defaults.ts stores persistent CLI defaults in metadata keys: defaults.org, defaults.project, defaults.telemetry, defaults.url, defaults.headers, and defaults.ca-cert. DefaultsState exposes organization, project, telemetry ("on" | "off" | null), url, headers, and "ca-cert"; custom headers use semicolon-separated Name: Value pairs, and the CA certificate value is a PEM file path.

🔴 (16:00) User showed getters in packages/cli/src/lib/db/defaults.ts: getDefaultOrganization(), getDefaultProject(), getDefaultUrl(), getDefaultHeaders(), and getDefaultCaCert() return stored strings or null; getTelemetryPreference() maps "on" to true, "off" to false, and an absent/unrecognized value to undefined; getAllDefaults() returns all six defaults as a structured object.

🔴 (16:00) User showed a change to packages/cli/src/lib/constants.ts::getConfiguredSentryUrl(): it now independently normalizes env.SENTRY_HOST and then env.SENTRY_URL using normalizeUrl(env.SENTRY_HOST) ?? normalizeUrl(env.SENTRY_URL), returning undefined when neither explicit environment setting is usable.

🔴 (16:00) User showed regional trust/cache changes in packages/cli/src/lib/db/regions.ts: process-local regional origins are now grouped by the control-silo source origin using Map<string, Set<string>> trustedRegionOrigins and Set<string> seededSourceOrigins. registerTrustedRegionOrigins(sourceOrigin, urls) normalizes the source and each regional URL; invalid origins are excluded. resetTrustedRegionUrlsForTesting() clears both collections.

🔴 (16:00) User showed packages/cli/src/lib/db/regions.ts now persists source_origin with org_slug, region_url, and updated_at; region cache reads are filtered by normalized source origin. setOrgRegion() accepts a source origin, defaulting to DEFAULT_SENTRY_URL, and resolveOrgRegionUncached() calls setOrgRegion(orgSlug, regionUrl, baseUrl) so regional trust is tied to the control silo that discovered it.

🔴 (16:00) User showed an OAuth redirect implementation that follows redirects only within the configured origin’s trust class, applies custom TLS options, reapplies custom headers per request URL, enforces MAX_REDIRECTS, throws HostScopeError for an untrusted redirect, resolves relative Location headers against the current request URL, and converts applicable redirected requests to GET.

🔴 (16:01) User stated credentials must never hit the wire when host scoping rejects a request; the security test explicitly verifies “Token never hit the wire.”

🔴 (16:01) User stated a forced environment token never uses a region cached for stored OAuth. The test forced env token never uses a region cached for stored OAuth sets SENTRY_FORCE_ENV_TOKEN = "1" and verifies source-scoped regional cache separation.

🔴 (16:01) User showed security tests covering: a token-claim/request-host mismatch is refused before credentials are transmitted; a token whose claim matches the request proceeds normally; cross-origin redirects are refused before forwarding custom headers; and a non-sntrys_ token with no SENTRY_HOST snapshots to the SaaS default.

🔴 (16:01) User showed packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts test forged claim url is captured (claim is NOT a security primitive): a minted sntrys_ token with iat: 1_700_000_000, url: "https://evil.com", and org: "victim" causes getEnvTokenHost() to return "https://evil.com" after captureEnvTokenHost().

🔴 (16:01) User stated the sntrys_ claim trust contract: for a legitimate token, its url is authoritative; if a user pastes a forged attacker token, they have already authorized that server and this is outside the threat model. The CLI prevents other inputs such as rc files or URL arguments from redirecting credentials away from the token’s host rather than second-guessing the token itself.