Distillation

Date: Sep 10, 2026

• 🟡 (11:06) packages/cli/src/lib/errors.ts:124-165 defines HostScopeError extends CliError for destination hosts that do not match the active token’s scoped host; fetch-layer and entry-point guards throw it, and withAuthGuard rethrows it like AuthError while swallowing ApiError and other transient failures.
• 🟡 (11:06) HostScopeError has two constructor forms: new HostScopeError(source, destinationUrl, tokenHost) for standard mismatch errors and new HostScopeError(message) for the login-command refusal requiring confirmation with --url. It always uses EXIT.AUTH_HOST_SCOPE and sets this.name = "HostScopeError".
• 🟡 (11:06) With destinationUrl but no tokenHost, HostScopeError states no Sentry credentials are configured for that host and instructs sentry auth login --url ${destinationUrl}. With both values, it states the destination does not match credential host ${tokenHost}, gives the same login command, and advises removing the URL override to retain current credentials.
• 🟡 (11:06) Located OAuth tests at packages/cli/test/lib/oauth.test.ts; no file contents were provided in this turn.