Distillation

Date: Sep 10, 2026

• 🟡 (11:56) Biome checked and fixed 1 file in 1269ms. Vitest v4.1.10 continued to emit the deprecation warning that test.poolOptions was removed and previous poolOptions must be top-level options.
• 🟡 (11:56) Focused CLI validation passed all 6 test files and 92/92 tests in 10.68s (transform 5.67s, setup 314ms, import 9.58s, tests 19.50s, environment 1ms). Logs confirmed env SENTRY_AUTH_TOKEN was detected but stored OAuth login remained active unless SENTRY_FORCE_ENV_TOKEN=1; stored credentials were migrated to host-scoped entries for https://legacy-configured.example.com and https://sentry.io.
• 🟡 (11:56) Assistant stated the provenance migration and targeted suites pass, and planned to review settled cache and redirect changes before the full package matrix and add any missing migration or state-isolation regression.
• 🔴 (11:56) User asserted: “Never forward headers across an unvalidated origin.”
• 🔴 (11:56) User asserted that the CLI never forwards a refresh token to a cross-origin redirect.
• 🔴 (11:56) User asserted that a forced env token never uses a region cached for stored OAuth.
• 🟡 (11:56) Patch diff showed resetTrustedRegionUrlsForTesting() in packages/cli/src/lib/db/regions.ts now clears seededSourceOrigins rather than obsolete trustedRegionOriginsSeeded.
• 🟡 (11:56) resolveOrgRegion(orgSlug) now obtains baseUrl = getApiBaseUrl(), keys its promise cache as ${baseUrl}\0${orgSlug}, and falls back to the base API URL when resolution fails, preventing cached region resolution from being reused across active API origins.
• 🟡 (11:56) normalizeNumericOrg(orgId) now passes getApiBaseUrl() as the provenance argument to getOrgByNumericId(orgId, baseUrl).
• 🟡 (11:56) Redirect handling was added in packages/cli/src/lib/sentry-client.ts, including isRedirect(response) for status codes 301, 302, 303, 307, and 308; validation that redirects contain a valid Location header; redirect request-method handling; redirect-limit handling; and mutable request-header handling across retries/redirects.
• 🟡 (11:56) getRedirectRequest() changes a non-GET/non-HEAD request to GET on 303, and changes POST to GET on 301 or 302; otherwise it retains the original request semantics via new Request(destination, request).
• 🟡 (11:56) Redirect security logic explicitly checks a destination origin before forwarding headers, implementing the rule that headers are never forwarded across an unvalidated origin.
• 🟡 (11:56) A defense-in-depth regression test was added: never forwards a refresh token to a cross-origin redirect, covering a 307 redirect.
• 🟡 (11:56) Additional regression coverage shown in the patch includes claim URL routes requests when no explicit URL is configured and forced env token never uses a region cached for stored OAuth; the latter expects safe failure matching /Unexpected response format from organizations\/cached-org\/chunk-upload\//i.
• 🟡 (11:56) Assistant identified two remaining consistency points before full-matrix testing: single-entry provenance writes must reject invalid values, and every organization-cache read must respect the active source origin.
• 🟡 (11:56) Search found 12 organization-cache-related call sites: packages/cli/src/lib/complete.ts lines 190 and 295; packages/cli/src/lib/api/projects.ts lines 77 and 575; packages/cli/src/lib/api/organizations.ts line 109; packages/cli/src/lib/org-list.ts line 1054; packages/cli/src/commands/project/delete.ts line 71; packages/cli/src/commands/org/list.ts line 144; and cache APIs in packages/cli/src/lib/db/regions.ts including getAllOrgRegions() line 304, getCachedOrganizations() line 343, and getCachedOrgRole(orgSlug) line 377.
• 🔴 (11:57) User asserted that apiRequestToRegion always sends JSON and sets Content-Type explicitly.
• 🟡 (11:57) packages/cli/src/lib/sentry-client.ts documentation specifies prepareHeaders() sets only Authorization and User-Agent; it deliberately does not set Content-Type, because SDK callers set their own, apiRequestToRegion explicitly sends JSON, and rawApiRequest may require no content type for bodies such as strings.
• 🟡 (11:57) prepareHeaders(input, init, token) preserves source request headers when the SDK invokes fetch(request) without init, preventing Node.js fetch(request, {headers}) semantics from stripping SDK-set Content-Type and causing HTTP 415 errors. It intentionally shares and mutates the returned Headers across retries so handleUnauthorized() can replace Authorization and set RETRY_MARKER_HEADER.
• 🟡 (11:57) prepareHeaders() defense-in-depth checks isRequestOriginTrusted(input) and throws HostScopeError("Credentials", normalizeOrigin(input) ?? "<unknown host>", getActiveTokenHost()) for an untrusted request origin; it also validates an sntrys_ token’s parsed url claim through isHostTrustedForClaim(input, claimUrl) and throws HostScopeError on a mismatch.
• 🟡 (11:57) prepareHeaders() applies telemetry sentry-trace and baggage headers from getTraceData() when available, then scopes user-configured proxy/IAP/mTLS custom headers through applyCustomHeaders(headers, input).
• 🟡 (11:57) handleUnauthorized(headers) refuses a second refresh when RETRY_MARKER_HEADER exists; otherwise it runs refreshToken({ force: true }), updates Authorization and adds retry marker "1" only when { refreshed: true }, and logs token-refresh failures at debug level.