Distillation

Date: Sep 10, 2026

• 🔴 [requested-review] (16:45) User requested a substantive, independent, read-only correctness/adversarial review of the current uncommitted getsentry/cli worktree patch for GitHub issue #1568, with a non-empty findings-first report and exact file:line references.
• 🔴 [enforced-read-only-review] (16:45) User directed that the review must not edit any file, run formatting or generation, or alter Git state.
• 🔴 (16:45) User specified worktree root /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus and base revision HEAD=605e8318d.
• 🔴 (16:45) User stated the exact launch-time patch identity is SHA-1 d6fb08a6fc3ccdd14c52020f745eb20893148998, computed using git diff --binary | git hash-object --stdin; it must be verified before and after review, with the result classified BLOCKED if it changes.
• 🔴 (16:45) User requested review of all issue-relevant production and test changes, especially packages/cli/src/lib/sentry-client.ts, token-host.ts, env-token-host.ts, db/auth.ts, region.ts, db/regions.ts, oauth.ts, constants.ts, resolve-target.ts, and corresponding tests.
• 🔴 (16:45) User stated the key required behavior: when only SENTRY_AUTH_TOKEN is an sntrys_ token with an embedded custom URL and neither SENTRY_HOST nor SENTRY_URL is explicit, requests must use the token claim URL.
• 🔴 (16:45) User requires explicit URL precedence to be preserved.
• 🔴 (16:45) User requires stored OAuth precedence to be preserved unless SENTRY_FORCE_ENV_TOKEN is active.
• 🔴 (16:45) User requires legacy NULL stored-host migration provenance to be preserved.
• 🔴 (16:45) User requires region-cache identity isolation to be preserved.
• 🔴 (16:45) User requires exact-origin credential guards to be preserved.
• 🔴 (16:45) User requires redirect method/body semantics and SDK/raw request headers to be preserved.
• 🔴 (16:45) User stated that headers must never be forwarded across an unvalidated origin.
• 🔴 (16:45) User stated a new fail-first regression found that a legacy NULL-host stored OAuth row plus an inactive forged environment-token claim was incorrectly migrated/routed to the forged claim.
• 🔴 (16:45) User stated the final patch separates the explicit boot URL snapshot from environment-token claim scope, so migration defaults to SaaS when there is no explicit boot URL.
• 🔴 (16:45) User requested inspection of tests for deterministic coverage, early-return or cache holes, and behavioral regressions.
• 🔴 (16:45) User stated prior validation passed 266 focused tests; the complete suite passed across 416 files with 8,768 passing tests; typecheck, Biome, and policy checks also passed. User directed that correctness must not be inferred from these results.
• 🔴 (16:45) User requires each review point to be classified as PASS, CONCERN, MUST-FIX, or BLOCKED; defects must include a deterministic regression and concrete fix; the report must state reviewed scope and residual risks and end with exactly MERGE or DO-NOT-MERGE.
• 🔴 (16:46) User requires always checking package.json for the latest scripts; commands run from packages/cli or via pnpm --filter sentry run <script> from the repository root.
• 🔴 (16:46) User stated all packages must be placed in devDependencies, never dependencies, because everything is bundled at build time with esbuild; CI enforces this using pnpm run check:deps.
• 🔴 (16:46) User requires always using pnpm add -D <package> when adding a package, including the -D flag.
• 🔴 (16:46) User stated property-test properties should always hold regardless of input.
• 🔴 (16:46) User’s repository convention prefers execFileSync with array arguments over execSync with a string when passing user-controlled values, to avoid shell injection.
• 🔴 (16:46) User’s repository convention requires importing buildCommand from ../../lib/command.js, never directly from @stricli/core, because the wrapper adds telemetry, --json/--fields injection, and output rendering.
• 🔴 (16:46) User’s repository convention bans stderr.write() in command files via a GritQL rule; diagnostics should use logger, and data output should use CommandOutput.
• 🔴 (16:46) User’s repository convention uses parseSlashSeparatedArg from src/lib/arg-parsing.ts for the standard [<org>/<project>/]<id> pattern; required identifiers such as trace IDs and span IDs should be positional arguments rather than flags.
• 🔴 (16:46) User’s repository convention requires paginationHint() from src/lib/list-command.ts for bidirectional navigation strings; callers pass prebuilt prevHint/nextHint command strings, and must not manually assemble navParts arrays.
• 🔴 (16:46) User stated all CLI errors extend CliError from src/lib/errors.ts.
• 🔴 (16:46) User stated pnpm run check:errors includes a silent-catch scan that flags empty, comment-only, or return-only catch blocks that do not surface errors; it is advisory due to a pre-existing backlog, can be enforced with SENTRY_STRICT_SILENT_CATCH=1, and new silent catches must not be added.
• 🔴 (16:46) User stated all configuration operations are asynchronous and must always be awaited.
• 🔴 (16:46) User’s repository test layout is: property-based tests in test/lib/*.property.test.ts, model-based tests in test/lib/db/*.model-based.test.ts, unit tests in test/ mirroring src/, and E2E tests in test/e2e/.
• 🔴 (16:46) User stated model-based tests should be used for stateful systems where operation sequences must maintain invariants, with shared utilities from test/model-based/helpers.ts.
• 🔴 (16:46) User stated unit tests alongside property tests should cover: edge cases outside generator ranges, exact output-format documentation, concurrency/timing behavior properties cannot express, and integration behavior involving multiple functions.
• 🟡 (16:46) Repository guidance in packages/cli/CONTRIBUTING.md defines context resolution precedence as: 1. positional arguments (<org>/<project>) always win, 2. config defaults from sentry config set, 3. DSN auto-detection from SENTRY_DSN or source code.
• 🟡 (16:46) Repository guidance in packages/cli/CONTRIBUTING.md says new commands should: 1. choose list or view patterns, 2. use resolveOrg() or resolveOrgAndProject() from lib/resolve-target.ts, 3. support --json, 4. support -w/--web for view commands, 5. use ContextError for missing context, and 6. add E2E tests under test/e2e/.