Distillation

Date: Sep 10, 2026

• 🔴 (09:33) User specified that throwOnError is always false because errors are handled by the CLI itself.
• 🔴 (09:33) User specified that control-silo endpoints are always on the control silo, including OAuth, user accounts, and regions.
• 🟡 (09:33) Review evidence: worktree is /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus; modified review-relevant files include packages/cli/src/lib/constants.ts and packages/cli/src/lib/sentry-client.ts.
• 🟡 (09:33) Patch changes getConfiguredSentryUrl() in packages/cli/src/lib/constants.ts from normalizeUrl(getEnv().SENTRY_HOST || getEnv().SENTRY_URL || undefined) to caching const env = getEnv() and returning normalizeUrl(env.SENTRY_HOST) ?? normalizeUrl(env.SENTRY_URL), so a whitespace/invalid SENTRY_HOST can fall through to a valid SENTRY_URL.
• 🟡 (09:33) Patch changes both getApiBaseUrl() and getControlSiloUrl() in packages/cli/src/lib/sentry-client.ts to resolve URL precedence as getConfiguredSentryUrl() ?? getActiveTokenHost() ?? DEFAULT_SENTRY_URL; intended behavior is explicit URL configuration first, then active credential’s trusted host so org-auth tokens can route self-hosted requests without SENTRY_URL.
• 🟡 (09:33) getControlSdkConfig() returns getSdkConfig(getControlSiloUrl()); its documented use is OAuth, user-account, and regions endpoints.
• 🟡 (09:33) Review source-search evidence identified token-host behavior in packages/cli/src/lib/token-host.ts: getActiveTokenHost() gives storage OAuth precedence over an environment token unless SENTRY_FORCE_ENV_TOKEN is set; forceEnv is computed as hasEnvToken && !!getEnv().SENTRY_FORCE_ENV_TOKEN?.trim().
• 🟡 (09:33) Review source-search evidence identified relevant host/configuration defenses and routing paths: packages/cli/src/lib/sentryclirc.ts only injects [defaults] url into SENTRY_URL if both SENTRY_HOST and SENTRY_URL are unset/blank; packages/cli/src/lib/sentry-url-parser.ts can set both env.SENTRY_HOST and env.SENTRY_URL to baseUrl; packages/cli/src/lib/oauth.ts retains control-silo resolution as getConfiguredSentryUrl() ?? DEFAULT_SENTRY_URL; packages/cli/src/lib/login-host-guard.ts uses normalizeUserInputToOrigin(env.SENTRY_HOST || env.SENTRY_URL) ?? DEFAULT_SENTRY_URL.
• 🟡 (09:33) Relevant tests available for the requested review include packages/cli/test/lib/token-host.test.ts, token-host.property.test.ts, token-claims.test.ts, token-claims.property.test.ts, sentry-client.test.ts, sentry-client.invalidation.test.ts, env-token-host.test.ts, constants.test.ts, and constants.property.test.ts.