Distillation

Date: Sep 10, 2026

• 🔴 (16:47) User-provided verification output showed repository revision 605e8318d1f316bd28f53763f71ed716d1869616 and patch hash d6fb08a6fc3ccdd14c52020f745eb20893148998, matching the required review hash.
• 🟡 (16:47) The reviewed patch comprised 31 modified files with exactly 1,329 insertions and 500 deletions: .lore.md; packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md, event.md, explore.md, feedback.md, issue.md, log.md, replay.md, span.md, trace.md; packages/cli/src/commands/org/list.ts; packages/cli/src/commands/project/delete.ts; packages/cli/src/lib/api/organizations.ts; packages/cli/src/lib/api/projects.ts; packages/cli/src/lib/constants.ts; packages/cli/src/lib/db/auth.ts; packages/cli/src/lib/db/regions.ts; packages/cli/src/lib/db/schema.ts; packages/cli/src/lib/env-token-host.ts; packages/cli/src/lib/oauth.ts; packages/cli/src/lib/region.ts; packages/cli/src/lib/resolve-target.ts; packages/cli/src/lib/sentry-client.ts; packages/cli/src/lib/token-host.ts; packages/cli/test/lib/constants.test.ts; packages/cli/test/lib/db/auth.host.test.ts; packages/cli/test/lib/db/schema.test.ts; packages/cli/test/lib/resolve-target.mocked.test.ts; packages/cli/test/lib/security/refresh-token-poison.test.ts; packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts; and packages/cli/test/lib/sentry-client.test.ts.
• 🔴 (16:47) User stated legacy NULL-host migration “never uses an env token's embedded claim because” and uses normalizeOrigin(getBootConfiguredSentryUrl()); the migrated host is “never NULL on return.”
• 🔴 (16:47) User established the redirect security rule: “Never forward headers across an unvalidated origin.”
• 🟡 (16:47) The patch changed region/cache lookups to be control-origin scoped: packages/cli/src/commands/org/list.ts now calls getAllOrgRegions(getApiBaseUrl()), while packages/cli/src/commands/project/delete.ts now calls getCachedOrgRole(orgSlug, getApiBaseUrl()).
• 🟡 (16:47) packages/cli/src/lib/db/schema.ts adds nullable source_origin (TEXT, addedInVersion: 17) to the regional organization data schema. Its documented purpose is to record the origin that returned a regional URL so rows extend trust only for credentials scoped to that control-silo origin.
• 🟡 (16:47) The trusted-region registration API changed from registerTrustedRegionUrls(urls: readonly string[]) to registerTrustedRegionUrls(sourceOrigin: string, urls: readonly string[]), delegating to registerTrustedRegionOrigins(sourceOrigin, urls) so trusted regional URLs are associated with their source origin.
• 🟡 (16:47) packages/cli/src/lib/sentry-client.ts adds manual redirect handling around fetches, including custom-TLS handling, invalid or missing Location errors, redirect-limit checks, redirect-method handling including HTTP 303, bearer-token/header validation, and rebuilding redirected requests only after destination-origin validation.