Dashboard › cli › Distillation
866f40f8-1148-40c5-b0e1-fcf01671c1b8["lore_tm_v1_34jM48Tcw8UzMm_Uln9PawQl1_b2xY9HVkwecpaOrhM","lore_tm_v1_fmRnzQq2K8xFmQDUrgLDA9lu9R6BexbhIWqnH5i0T0k","lore_tm_v1_qb4hrZFHBr2nJeaCSULsVGl_aqbBE3ttNS9EufO9aaw","lore_tm_v1_oXVDxmPrclWln7dMnhXDwiWlZfE9XlSFmDogMf8QMcA","lore_tm_v1_BsG06rSgvlvCZtukzeIl5hYKpoDFY_2HdKpmQe_X7qI","lore_tm_v1_3w9TxG_Y1qvw_M3bvfN2cy7T9GZjSHGXLaDtQ9k2weE","lore_tm_v1_lwn8Qx6_85-wvkq9PYSb4iuB9CF09KZ0QI_V2rkC0QA","lore_tm_v1_3kFSOeDI-UI6bfhWZ_cwnpQekxNGmdIQBOZa5FsiCXM","lore_tm_v1_-heUcaFcZN2x-xyFWO0-MsD-UKEleWIuHo8BdXwRzr0","lore_tm_v1_KOJacfPSlJGz7eocpxbZjcXge6xV3C-fUOIAdhwEN2I","lore_tm_v1_4L-XYANFlBYEezUfDOyMCES7bf9f3uDAY9x4EJN9QXQ","lore_tm_v1_qkfkwGT65mlgAVkMBUdwruT1N_5_dutGVyU1qflMNbw","lore_tm_v1_gn1ZBNy-CWLMNX8UBox-YFxvfCNzCym3SyhUYDeqg_c","lore_tm_v1_fVItWxQHEGBsWXlnH7Q3REwL0l9zxmOr7sd-KKi5PSA","lore_tm_v1_Dmv4t2jI8oZVwXXi_ugkQ2N6yyVrjilS2gkavY59j5U","lore_tm_v1_k18ObNkrUXEAx6XOnK-dxnUSGUuNJHwx--x0vBKhbw8","lore_tm_v1_2TcXZJDn-HA1lPnoXxRlOW7sKpI_S8fqPHHCOgSFtOE","lore_tm_v1_kCI0DEPC6colDAKuERSaX19Kv8fow3-MRValF3wwmQI","lore_tm_v1_BOh1QqIOtY-pJ9vJ-9VeB5L5DfAhGnOwseLDKtQEWxY","lore_tm_v1_KvE9WRjCIImLQNpt3Ri85SGlNt4XASWx6RL4VEKfUsM","lore_tm_v1_kDNbSs1SDIzr4F4ObkCa-XhR5ark_aSlXXd3wOjDAYY","lore_tm_v1_ya9hC0JupnzRhwb7aHhV4ibyWBGKxZEqEZg6vOFgUKE","lore_tm_v1_Tx_o4Uslw1Y6AQap1Ie6hG2P6_N6-WtTQjAOBFCGkmw"]
Date: Sep 10, 2026
getSdkConfig(regionUrl) in packages/cli/src/lib/sentry-client.ts normalizes a trailing slash, supplies the shared authenticated fetch, and sets throwOnError: false as const because errors are always handled by the CLI itself.getControlSdkConfig() is for endpoints always hosted on the control silo, specifically OAuth, user accounts, and regions.getApiBaseUrl() and getControlSiloUrl() resolve in this order: getConfiguredSentryUrl() ?? getActiveTokenHost() ?? DEFAULT_SENTRY_URL.https://sentry.io can trust strict HTTPS/default-port *.sentry.io subdomains; non-SaaS hosts never use suffix matching.getActiveTokenHost() mirrors authentication precedence: stored OAuth credentials win over an environment token unless SENTRY_FORCE_ENV_TOKEN is set and an environment token exists.loginTrustAnchor may be registered from explicit --url or the boot-time environment snapshot, but the .sentryclirc shim does not register it. With no active token, custom headers are allowed only when the request matches this explicit anchor; with neither token nor anchor, the check fails closed.captureEnvTokenHost() snapshots an environment token’s host before .sentryclirc or later code can mutate env.SENTRY_HOST/env.SENTRY_URL; capture is idempotent.sntrys_ claim url, authoritative for org-auth tokens; 2. SENTRY_HOST/SENTRY_URL for non-sntrys_ tokens; 3. DEFAULT_SENTRY_URL..sentryclirc files are never consulted by packages/cli/src/lib/env-token-host.ts because they have weaker integrity than environment values or token claims.src/cli.ts::preloadProjectContext is: 1. captureEnvTokenHost(), 2. findProjectRoot, 3. applySentryCliRcEnvShim, 4. getDefaultUrl() fallback.HEAD, verify success in the current tree, and review token-precedence and host-scope invariants.docs: documentation audit — fix gaps between implementation and docs; #1269 docs: documentation audit — fix toolchain drift, stale versions, and coverage gaps; #1302 with the same toolchain-drift title; and #1432 docs: documentation audit — fix env var gaps and clarify agent skills. All were authored by app/cursor.packages/cli/package.json identifies package sentry version 0.40.0-dev.0, Node runtime >=18.0, development runtime >=22.15, package manager pnpm@10.11.0, TypeScript ^5.9.3, Vitest ^4.1.9, fast-check ^4.8.0, and Zod ^3.25.76.test.poolOptions was removed and its prior options are now top-level.chore/preshape-monorepo at commit 605e8318d (chore: regenerate docs). The existing worktree diff covered 29 files with 1,210 insertions and 485 deletions, including packages/cli/src/lib/sentry-client.ts, packages/cli/src/lib/token-host.ts, region/auth/schema code, and security regression tests.605e8318d to reproduce issue #1568 independently of the existing uncommitted changes.@sentry/cli and sharp were ignored pending pnpm approve-builds.packages/cli/src/lib/token-claims.ts parses tokens with format sntrys_<base64(JSON{iat, url, region_url, org})>_<random-secret>, limits token length to 2,048 bytes, and requires exactly 2 underscores._, so the second underscore in an sntrys_ token always separates the encoded payload from the secret.parseSntrysClaim() returns undefined for non-sntrys_ tokens, oversized or malformed tokens, missing/truthy-false iat, or missing/empty url; valid output is { url, regionUrl, org }, with region_url mapped to regionUrl.sntrys_ claim is not signed and can be forged, but is authoritative for legitimate tokens because the issuing server wrote it and an environment-injection attacker cannot read or modify the token bytes; forged-token risk is outside the threat model because supplying one already compromises the credential.sntrys_ token configured, expected API base URL http://localhost:8000 from the embedded claim but received https://sentry.io.packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts, including tests named claim URL routes requests when no explicit URL is configured and claim URL routes organization region resolution, plus checks involving getApiBaseUrl() and getControlSiloUrl().605e8318d returns https://sentry.io when only the sntrys_ token is set; the current worktree instead returns the embedded http://localhost:8000 claim URL and sends the request there. The fix is the active token-host fallback in getApiBaseUrl(), while preserving explicit configuration and stored-OAuth/env-token precedence.test/lib/resolve-target.test.ts > fetchProjectId > returns undefined on transient server error, caused by SQLite disk I/O error at src/lib/db/sqlite.ts:460 during Database.exec, not by the issue #1568 routing regression.test/lib/resolve-target.test.ts passed all 61 tests in 23.64s, ruling the earlier failure as parallel/shared SQLite interference rather than a deterministic product regression.