Distillation

Date: Sep 10, 2026

• 🔴 (10:11) User stated apiRequestToRegion always sends JSON and explicitly sets Content-Type; prepareHeaders intentionally sets only Authorization and User-Agent, while SDK functions set their own Content-Type and rawApiRequest may omit it for bodies such as strings.
• 🟡 (10:11) Completed background task “Review final routing security” reported a MUST-FIX high-severity redirect vulnerability: with whitespace SENTRY_HOST, self-hosted SENTRY_URL, and SENTRY_CUSTOM_HEADERS, routing attaches custom headers and native fetch() follows a cross-origin redirect without re-running the trust check. Node strips Authorization but retains arbitrary headers; reproduction confirmed redirected origin received X-IAP-Token: custom-secret.
• 🟡 (10:11) Security-review remediation recommended manual redirect handling, validation of every redirect destination origin, reapplication of custom headers only after validation, and a two-origin regression test for the whitespace-SENTRY_HOST fallback.
• 🟡 (10:11) Assistant stated intent to fix both routing-security boundaries together: source-scope persisted-region trust/cache reuse and validation of each redirect destination before forwarding credentials or custom headers.
• 🟡 (10:11) Existing fetchWithTimeout() in packages/cli/src/lib/sentry-client.ts:244-287 calls native fetch(input, { ...init, headers, signal: controller.signal, ...customTls }) without specifying redirect, so it follows redirects by default; it applies getCustomTlsOptions() and invokes warnIfSaasWithEnvCa(extractFullUrl(input)) when custom TLS options exist.
• 🟡 (10:11) Existing retry configuration in packages/cli/src/lib/sentry-client.ts: REQUEST_TIMEOUT_MS = 30_000; ENDPOINT_TIMEOUT_OVERRIDES maps /\/autofix\/?(?:\?|$)/ to 120_000; MAX_RETRIES = 2; MAX_BACKOFF_MS = 10_000; retryable HTTP statuses are [408, 429, 500, 502, 503, 504]; RETRY_MARKER_HEADER = "x-sentry-cli-retry"; exponential backoff is Math.min(1000 * 2 ** attempt, MAX_BACKOFF_MS).
• 🟡 (10:11) AttemptResult in packages/cli/src/lib/sentry-client.ts:289-293 has variants { action: "done"; response: Response }, { action: "retry" }, and { action: "throw"; error: unknown }; handleResponse() treats a refreshed 401 and non-final retryable status as "retry", otherwise returns "done".
• 🟡 (10:11) Repository precedent in packages/cli/src/lib/ghcr.ts:318-391: downloadNightlyBlob() manually handles a GHCR blob redirect because redirect: "follow" would forward Authorization to Azure and yield 404. Step 1 uses customFetch(blobUrl, { headers: { Authorization: \Bearer ${token}`, "User-Agent": getUserAgent() }, redirect: "manual", signal: buildSignal(GHCR_BLOB_TIMEOUT, signal) }); it accepts direct 200or301/302/307/308, requires a locationheader, then fetches the redirect URL with only"User-Agent"andsignal`.
• 🟡 (10:12) resolveEffectiveOrg() in packages/cli/src/lib/region.ts:165-203 resolves an org first from local cache; for a normal slug, it calls resolveOrgRegion(orgSlug) once and falls back to the original slug on failure; for DSN numeric IDs such as o1081365, it refreshes with listOrganizationsUncached(), retries cache lookup, then falls back to the original identifier. resolveOrgFromCache() handles direct slug cache entries and strips the o prefix to query numeric-ID mappings.
• 🟡 (10:12) buildAttemptFactory() in packages/cli/src/lib/sentry-client.ts:481-498 creates fresh request inputs for retries: Request inputs are cloned per attempt; ReadableStream bodies are drained once into an ArrayBuffer; other bodies (string, ArrayBuffer, TypedArray, Blob, FormData, URLSearchParams, or none) are retained to preserve behavior including FormData’s auto-negotiated multipart boundary.
• 🟡 (10:12) createAuthenticatedFetch() in packages/cli/src/lib/sentry-client.ts:574-631 resets cache-hit age, calls maybeWarnEnvTokenIgnored(), derives method from init?.method or a Request input (default "GET"), wraps execution in withTracingSpan, performs tryCacheHit(method, fullUrl, authHeaders(getAuthToken())) before auth refresh/retry, then calls fetchWithRetry(input, init, method, fullUrl) on a cache miss and records response status/span status.
• 🟡 (10:12) executeAttempt() in packages/cli/src/lib/sentry-client.ts:645-664 calls fetchWithTimeout() and passes its response to handleResponse(); errors are classified through handleFetchError(error, init?.signal, isLastAttempt).