Distillation

Date: Sep 10, 2026

• 🟡 (10:08) Background correctness review identified a MUST-FIX security issue: packages/cli/src/lib/region.ts:67-70 returns cached regions before checking claim-routed base URLs; packages/cli/src/lib/db/regions.ts:141-149 persists regions without host/identity scope, and packages/cli/src/lib/db/regions.ts:34-53 plus packages/cli/src/lib/token-host.ts:111-120 globally admit persisted regions as trusted origins.
• 🟡 (10:08) Review attack path: with stored OAuth credentials for stored.example, a cached organization region at that host, SENTRY_FORCE_ENV_TOKEN=1, and an environment sntrys_ token claimed for claimed.example, debug-files upload calls getChunkUploadOptions() at packages/cli/src/commands/debug-files/upload.ts:697, which uses src/lib/api/chunk-upload.ts:135-143; global trusted-region checks permit the stale stored.example URL and prepareHeaders() at src/lib/sentry-client.ts:121-149 attaches the forced environment token. Assemble and chunk-upload paths have the same exposure.
• 🟡 (10:08) Review recommended scoping persisted region trust to the active credential/host, or rejecting and refreshing cached regions outside that trust class; it also recommended a regression that seeds a foreign cached org region, forces an environment sntrys_ token, exercises the debug-files chunk-options/assemble path, and proves no old-host request receives the token.
• 🟡 (10:08) Review verified correct behavior for explicit URL precedence including blank SENTRY_HOST, direct stored-versus-forced-environment token host selection, malformed-claim fail-closed behavior, and uncached-region fallback; targeted tests passed 35/35.
• 🟡 (10:08) Assistant accepted the cache-trust finding and stated intent to scope cached-region reuse to the active credential host and add an adversarial regression before rerunning validation.
• 🟡 (10:09) packages/cli/src/lib/db/regions.ts currently uses process-local trustedRegionOrigins: Set<string> and lazy-seeds it once by selecting DISTINCT region_url from all org_regions rows; isTrustedRegionOrigin(origin) checks that global set. registerTrustedRegionUrls(), setOrgRegion(), and setOrgRegions() add region origins globally; clearTrustedHostState() clears the set and resets lazy seeding.
• 🟡 (10:09) getOrgRegion(orgSlug) in packages/cli/src/lib/db/regions.ts:141-149 selects region_url solely by org_slug, records a region cache hit, and returns the URL with no credential or host provenance check.
• 🟡 (10:09) Assistant concluded that both stale cache reuse and the global trust extension lack provenance, and stated intent to trace the region schema/update path so persisted regions and in-memory trust are tied to the host that discovered them instead of weakening the fetch guard.
• 🔴 (10:09) User specified migration 11 → 12 must replace pagination_cursors with the cursor-stack schema: cursor_stack is a JSON array and page_index supports bidirectional navigation; because cursors have a 5-minute TTL, the migration drops and recreates pagination_cursors.
• 🔴 (10:09) User stated the legacy single-row defaults table was never written by production code. Migration 12 → 13 reads any defaults.id = 1 organization and project values, writes them to metadata keys defaults.org and defaults.project, then drops defaults; new default keys are defaults.org, defaults.project, defaults.telemetry, and defaults.url.
• 🟡 (10:09) packages/cli/src/lib/db/schema.ts defines org_regions with org_slug as primary key; optional org_id added in schema v8, org_name in v9, org_role in v10; plus required region_url and updated_at. Current migration sequence includes migration 15 → 16 adding nullable auth.host for host-scoped tokens, lazily backfilled by getAuthConfig using the configured host after upgrade.
• 🟡 (10:10) listOrganizationsUncached() in packages/cli/src/lib/api/organizations.ts gets controlSiloUrl via getControlSiloUrl(), calls paginated GET /organizations/, creates regionEntries using each organization’s links.regionUrl or controlSiloUrl fallback, then calls setOrgRegions(regionEntries); it currently does not pass discovery-host provenance.
• 🟡 (10:10) setOrgRegions(entries) in packages/cli/src/lib/db/regions.ts:204-232 upserts org_slug, region_url, updated_at, and optional org_id, org_name, and org_role keyed only by org_slug, then globally registers all entry region URLs as trusted.
• 🟡 (10:10) clearOrgRegions() deletes all org_regions rows and calls clearTrustedHostState(); getAllOrgRegions() returns a Map<string, string> of every cached org_slug to region_url without host scoping. src/commands/org/list.ts:144 uses getAllOrgRegions().
• 🟡 (10:10) Code search found 100+ test/source usages of setOrgRegion() or setOrgRegions(), including packages/cli/test/lib/api-client.test.ts, packages/cli/test/lib/api-client.multiregion.test.ts, command tests, API tests, and packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts:278, where registerTrustedRegionUrls(["https://us.sentry.acme.com"]) is used; any provenance API/schema change will require compatibility consideration across these callers.