Distillation

Date: Sep 10, 2026

• 🟡 (11:57) packages/cli/src/lib/oauth.ts fetchWithConnectionError(url, init) manually follows redirects with redirect: "manual" and MAX_REDIRECTS; for each request it clones request headers, applies applyCustomHeaders(headers, request.url), fetches with custom TLS options, and returns non-redirect responses.
• 🟡 (11:57) OAuth redirect handling in fetchWithConnectionError() accepts statuses 301, 302, 303, 307, and 308; getRedirectUrl() throws ApiError for missing or invalid Location; redirects beyond MAX_REDIRECTS throw ApiError("Too many redirects (maximum ${MAX_REDIRECTS})", response.status, undefined, request.url).
• 🟡 (11:57) OAuth redirects validate isHostTrusted(destination, url) before continuing; an untrusted destination throws HostScopeError("OAuth request", normalizeOrigin(destination) ?? "<unknown host>", normalizeOrigin(url)).
• 🟡 (11:57) OAuth getRedirectRequest() changes a non-GET/non-HEAD request to GET for 303, changes POST to GET for 301/302, and otherwise preserves request semantics with new Request(destination, request).
• 🟡 (11:57) assertRefreshHostTrusted() in packages/cli/src/lib/oauth.ts obtains refreshUrl = getSentryUrl() and rejects an untrusted refresh endpoint with HostScopeError("OAuth refresh token", normalizeOrigin(refreshUrl) ?? "<unknown host>", getActiveTokenHost()); it is defense-in-depth for mutation of SENTRY_HOST/SENTRY_URL outside URL-argument or rc-shim guards.
• 🟡 (11:57) Assistant stated cache provenance focused tests passed and was tightening remaining cache readers and validating schema migration before final package checks.
• 🟡 (11:58) packages/cli/src/lib/db/schema.ts defines org_regions.source_origin as TEXT, introduced in schema version 17. Documentation says it is the origin returning the regional URL, and rows only extend trust for credentials scoped to that control-silo origin.
• 🟡 (11:58) An attempted apply_patch to packages/cli/src/lib/api/projects.ts failed because expected import line import { getSdkConfig } from "../sentry-client.js"; was not found.
• 🟡 (11:58) packages/cli/src/lib/api/organizations.ts listOrganizations() reads cached organizations through getCachedOrganizations() and returns cached { id, slug, name, orgRole? } values when nonempty; on cache miss it calls listOrganizationsUncached().
• 🟡 (11:58) listOrganizationsUncached() queries organizations from controlSiloUrl = getControlSiloUrl() using paginated listOrganizationsPage, then calls setOrgRegions() with each org’s slug, regionUrl: org.links?.regionUrl ?? controlSiloUrl, sourceOrigin: controlSiloUrl, orgId, orgName, and orgRole.
• 🟡 (11:58) packages/cli/src/lib/api/projects.ts imports getCachedOrganizations from ../db/regions.js and getApiBaseUrl from ../sentry-client.js, indicating active-origin-aware organization-cache updates were being applied.
• 🔴 (11:58) User asserted that project delete never suggests sentry auth login; re-authenticating via OAuth will not change permissions.
• 🟡 (11:58) packages/cli/src/commands/project/delete.ts buildPermissionError(orgSlug, projectSlug) first reads getCachedOrgRole(orgSlug) and falls back to getOrganization(orgSlug); users with member or billing roles receive a 403 explaining that deletion requires Manager, Owner, or Admin and should contact an org admin. The documented alternative for privileged roles is checking custom-token project:admin scope, not OAuth re-login.
• 🟡 (11:59) Search found registerTrustedRegionUrls() at packages/cli/src/lib/db/regions.ts:76, with call sites at regions.ts:233 and regions.ts:282; related tests are packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts:380 and packages/cli/test/lib/db/auth.host.test.ts:220.
• 🟡 (11:59) Updated files: packages/cli/src/lib/db/regions.ts, packages/cli/src/lib/api/organizations.ts, packages/cli/src/lib/api/projects.ts, packages/cli/src/commands/project/delete.ts, and packages/cli/src/commands/org/list.ts.
• 🟡 (12:00) Biome checked 5 files in 1793ms and fixed 2 files. Vitest v4.1.10 emitted the known deprecation warning that test.poolOptions was removed and previous poolOptions must be top-level options.
• 🟡 (12:00) Active-source cache-reader focused suites passed: 5 test files, 65/65 tests, duration 10.63s (transform 6.72s, setup 349ms, import 12.73s, tests 8.65s, environment 1ms). Logs again showed detected SENTRY_AUTH_TOKEN defers to stored OAuth unless SENTRY_FORCE_ENV_TOKEN=1.
• 🟡 (12:00) Assistant stated active-source cache-reader suites passed and planned to add schema-v16 migration regression, then run complete unit, type, lint, and policy matrix.
• 🟡 (12:01) Updated packages/cli/test/lib/db/schema.test.ts with a migration regression intended to verify legacy org_regions rows remain unproven after upgrading to schema version 17.
• 🟡 (12:01) Assistant stated the final migration regression verifies legacy region rows remain unproven after upgrade and began full validation against the settled source.
• 🟡 (12:01) Full validation found lint failure in packages/cli/src/lib/oauth.ts:200: Biome rule lint/complexity/noExcessiveCognitiveComplexity measured fetchWithConnectionError() complexity 17, above maximum 15. The check processed 17 files in 4s, applied no fixes, and reported 1 error.
• 🟡 (12:01) Assistant identified the new OAuth redirect handling as the source of the complexity-limit failure and chose to extract the redirect loop while preserving request and host-scope behavior; planned to rerun the complete validation matrix afterward.
• 🟡 (12:01) Task status: “Inspect issue and affected CLI behavior” completed; “Add regression coverage and implement fix” completed; “Close redirect and region-trust review findings” in progress; “Run focused and repository checks” pending; “Review final diff and report outcome” pending.
• 🟡 (12:02) Updated packages/cli/src/lib/oauth.ts to refactor the excessive-complexity redirect logic. No post-refactor validation result was shown.