Dashboard › cli › Distillation
b5462fd2-7dd0-4b6b-ba3b-8335f79c047b["lore_tm_v1_YM_3Yg81FeyM2TwtyZPz8QhmCrkp6Cl4WwnZIC0iZ9w","lore_tm_v1_Fw_TBwuRBwHCNqiN7DWeRMyepxeViPUL1TJE-WvvYDA","lore_tm_v1_PVxWBjTZ-CZ8VkMrQaZE4L_hcGB-R3GIVxc-a_fJ6GE","lore_tm_v1_SI5QxWQa7fu3rDENj8SPCyyxDeGzuRBDdwLfhNJmMVM","lore_tm_v1_T5nJzjdP9WYnWMAFJeGvKKo9MqhBeU7nrFv68w6KNXM","lore_tm_v1_Fmntr_N8V3ABOIvr5ryNwz06sFOfnDPVAixcZ-zYsZY","lore_tm_v1_b4IUSyFUfV2keZNYWnQyRUIWzOIcYUYfnVW5T5xWeB4","lore_tm_v1_HrI4YHno2pe-ifv3epTVawIUAvDDurc7Tu1Joed1ghM","lore_tm_v1_oWi0l3dq883tC9jj8jmeTo7ePp_Ju3wCw1ybI1cYXcQ","lore_tm_v1_91T3b-9fH-QjsFNl3fWLxVubYs8DZOvxAx4t9eFbMU4","lore_tm_v1_z_MFWtydmMstfyD4apCRprr8aGvZ8BHNrab-zIJ-5So","lore_tm_v1_F4bG--RdmS_obIb-8Xa4iu2Bg3ZpnVnlCfPRqoHMJgg","lore_tm_v1_QhhCOEdY9DgxOTOwyQ5AhGkN9ru9ErMO46OO5XHuLMw","lore_tm_v1_4IVdPoRNRgXRFIkMpIwc-I0eCzxEEI4r1lBCljymVZU","lore_tm_v1_tHM10DSFlhjFVnqWCrHG_izdFs5FavbN3gQFLkR78VA"]
Date: Sep 10, 2026
packages/cli/src/lib/db/schema.ts currently exports CURRENT_SCHEMA_VERSION = 16; references appear at lines 22, 581, 719, 872, and 874.packages/cli/src/lib/errors.ts:175-213 defines ApiError extends CliError with status: number, optional detail and endpoint, and enriched403: boolean; its five-parameter constructor defaults enriched403 to false, calls super(message, EXIT.API), and format() appends endpoint and distinct detail lines.packages/cli/src/commands/org/list.ts implements sentry org list: calls listOrganizationsUncached() under withProgress, limits results via flags.limit, obtains cached organization regions with getAllOrgRegions(), and displays/injects a region field only when more than one unique region exists. getRegionDisplayName() maps sentry.io/us.sentry.io to US, de.sentry.io to EU, other .sentry.io prefixes to uppercase, and invalid URLs to ?; human table columns are SLUG, optional REGION, and escaped NAME.packages/cli/src/lib/custom-headers.ts:174-250 has getCustomHeaders() returning no headers when unconfigured or targeting SaaS, warning once for configured SaaS headers, caching parsed raw headers, and reevaluating the self-hosted guard each call. applyCustomHeaders(headers, requestUrl) applies headers only when isRequestOriginTrustedForCustomHeaders(requestUrl) succeeds; otherwise it warns once and skips headers to prevent SENTRY_CUSTOM_HEADERS leakage. _resetCustomHeadersCache() clears parsed-header and warning caches for tests.packages/cli/src/lib/db/schema.ts canonical pagination_cursors schema has non-null command_key, context, cursor_stack, page_index INTEGER DEFAULT "0", and expires_at, with composite primary key ["command_key", "context"].pagination_cursors with a cursor-stack schema: the old single cursor is replaced by JSON cursor_stack plus page_index for bidirectional navigation; because cursors have a 5-minute TTL, migration drops and recreates the table without meaningful loss.defaults table was never written by production code; migration 12 → 13 moves any manually edited/JSON-migrated organization and project values to metadata keys defaults.org and defaults.project, then drops defaults.runMigrations(db) in packages/cli/src/lib/db/schema.ts:741-877 sequentially: creates org_regions, user_info, and instance_info for v2; adds user_info.name for v3; adds DSN detection-cache columns and project_root_cache for v4; creates pagination_cursors for v5; repairs an incorrect non-composite pagination_cursors primary key for v6; adds project_cache.project_id for v7; adds org_regions.org_id, .org_name, and .org_role for v8–10; creates completion_telemetry_queue for v11; replaces pagination schema for v12; consolidates defaults into metadata for v13; creates repo_cache for v14 and issue_org_cache for v15; adds nullable auth.host for v16; then updates schema_version to CURRENT_SCHEMA_VERSION.packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts includes tests covering sntrys_ token claim URL/origin disagreement, including a case where a mismatched token never hits the wire; claim URL routing when no explicit URL is set; organization-region resolution; stored OAuth versus inactive or forced environment token precedence; invalid claim URL fallback; self-hosted multi-region regional-silo trust; opaque non-sntrys_ tokens; and an env-token-host UX fallback to the sntrys_ claim URL.apiRequestToRegion always sends JSON and sets Content-Type explicitly; prepareHeaders() deliberately sets only Authorization and User-Agent, while SDK callers preserve/set their own Content-Type and rawApiRequest may use non-JSON/string bodies.packages/cli/src/lib/sentry-client.ts:95-169 prepareHeaders(input, init, token) first rejects untrusted request origins through isRequestOriginTrusted(input) with HostScopeError, then parses sntrys_ claim URLs and rejects destinations failing isHostTrustedForClaim(input, claimUrl); it preserves request headers when SDK calls fetch(Request) without init to avoid stripping Content-Type and Node.js HTTP 415 errors, sets bearer authorization and absent User-Agent, injects sentry-trace/baggage telemetry headers when available, and applies origin-scoped custom headers..lore.md; nine packages/cli/plugins/sentry-cli/skills/sentry-cli/references/*.md files (dashboard.md, event.md, explore.md, feedback.md, issue.md, log.md, replay.md, span.md, trace.md); packages/cli/src/lib/constants.ts; packages/cli/src/lib/region.ts; packages/cli/src/lib/sentry-client.ts; packages/cli/test/lib/constants.test.ts; and packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts.packages/cli/src/lib/constants.ts: getConfiguredSentryUrl() now uses normalizeUrl(env.SENTRY_HOST) ?? normalizeUrl(env.SENTRY_URL) rather than normalizeUrl(getEnv().SENTRY_HOST || getEnv().SENTRY_URL || undefined), so whitespace/invalid SENTRY_HOST does not prevent fallback to SENTRY_URL. Regression test verifies SENTRY_HOST = " " and SENTRY_URL = "https://configured.example.com" resolve to "https://configured.example.com".packages/cli/src/lib/sentry-client.ts: both getApiBaseUrl() and getControlSiloUrl() now resolve getConfiguredSentryUrl() ?? getActiveTokenHost() ?? DEFAULT_SENTRY_URL, allowing self-hosted/org-auth credentials to route requests through the active credential’s trusted host when no explicit SENTRY_URL/SENTRY_HOST exists.packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts: added useTestConfigDir("sntrys-claim-mismatch-") and SENTRY_FORCE_ENV_TOKEN to ENV_KEYS; tests assert: (1) a sntrys_ claim URL http://localhost:8000 routes getApiBaseUrl() and /api/0/organizations/ requests there; (2) resolveOrgRegion("claim-routed-org") requests http://localhost:8000/api/0/organizations/claim-routed-org/; (3) stored OAuth host https://stored.example.com and token take precedence over an inactive environment-token claim; (4) SENTRY_FORCE_ENV_TOKEN = "1" makes claim host https://claimed.example.com and its environment token take precedence over stored OAuth; and (5) invalid claim URL "not a URL" falls back to https://sentry.io, rejects with /Credentials/, and produces no fetch calls.