Distillation

Date: Sep 10, 2026

• 🔴 (09:13) User stated .sentryclirc discovery must always check global fallback locations in this order: $SENTRY_CONFIG_DIR/.sentryclirc, then ~/.sentryclirc.
• 🔴 (09:13) User stated SaaS rc URLs are always trusted because there is no credential-leak risk.
• 🟡 (09:13) In packages/cli/src/lib/sentryclirc.ts, loadSentryCliRc(cwd) caches merged .sentryclirc configuration promises for the process lifetime keyed by cwd; concurrent callers share a promise, and rejected loads evict their cache entry so later calls retry.
• 🟡 (09:13) applySentryCliRcEnvShim(cwd) maps [auth] token to SENTRY_AUTH_TOKEN only when neither SENTRY_AUTH_TOKEN nor SENTRY_TOKEN is set, and maps normalized [defaults] url to SENTRY_URL only when both SENTRY_HOST and SENTRY_URL are unset. It applies the rc URL during boot and defers trust validation to assertRcUrlTrusted().
• 🟡 (09:13) assertRcUrlTrusted(cwd) in packages/cli/src/lib/sentryclirc.ts no-ops for no rc URL, a SaaS rc URL, or a non-SaaS rc URL trusted against getActiveTokenHost() via isHostTrusted(). For an untrusted non-SaaS rc URL—including when no active token exists—it throws HostScopeError(source, normalizedRcUrl, tokenHost). auth login and auth logout can opt out through skipRcUrlCheck: true.
• 🟡 (09:13) clearSentryCliRcCache() clears the process-lifetime rc cache and resets globalPaths = null, supporting tests that change SENTRY_CONFIG_DIR.
• 🟡 (09:13) Search found 18 flags.web conditionals across CLI commands: feedback/view.ts:131, trace/view.ts:547, trace/logs.ts:192, issue/view.ts:234, dashboard/view.ts:222, dashboard/list.ts:419, replay/view.ts:393, project/view.ts:363, event/view.ts:1108 and 1149, org/view.ts:72, log/view.ts:511, alert/metrics/view.ts:86 and 100, alert/metrics/list.ts:558, alert/issues/view.ts:85 and 101, and alert/issues/list.ts:564.
• 🟡 (09:13) In packages/cli/src/commands/issue/view.ts, the issue view command exposes boolean --web (-w, default false) described as “Open in browser”; when set, it calls openInBrowser(issue.permalink, "issue") after resolveIssue() and returns without fetching the latest event, replay IDs, or span tree.
• 🟡 (09:13) Normal issue view output resolves the issue through resolveIssue({ issueArg, cwd, command: "view" }); when an organization slug exists, concurrently calls tryGetLatestEvent(orgSlug, issue.id) and tryListReplayIdsForIssue(orgSlug, issue.id), combines event and related replay IDs with collectReplayIds(), and fetches span-tree lines only when orgSlug, event, and flags.spans > 0 are present.