Distillation

🔴 (16:02) User showed packages/cli/src/lib/region.ts::resolveOrgRegion(orgSlug): the process-local regionCache is Map<string, Promise<string>>, keyed by ${baseUrl}\0${orgSlug}, deduplicating concurrent requests and serving as a warm cache. Rejected promises are evicted so retries after re-authentication work; non-auth failures resolve to the base URL fallback.

🔴 (16:02) User showed packages/cli/src/lib/region.ts::resolveOrgRegionUncached(orgSlug, baseUrl): resolution checks getOrgRegion(orgSlug, baseUrl), otherwise calls SDK getOrganization(), uses response.data?.links?.regionUrl ?? baseUrl, and persists via setOrgRegion(orgSlug, regionUrl, baseUrl). withAuthGuard() propagates authentication errors while network, 404, and other errors fall back to baseUrl.

🔴 (16:02) User showed packages/cli/src/lib/region.ts::isMultiRegionEnabled(): it returns false when getConfiguredSentryUrl() yields a non-SaaS URL according to isSentrySaasUrl(), otherwise true.

🔴 (16:02) User showed packages/cli/src/lib/region.ts::resolveOrgFromCache(orgSlug): it first checks a directly cached slug using the active getApiBaseUrl(), then strips a DSN-style o prefix with stripDsnOrgPrefix() and resolves the numeric ID through getOrgByNumericId(numericId, baseUrl).

🔴 (16:02) User showed packages/cli/src/lib/region.ts::resolveEffectiveOrg(orgSlug): cached mappings win; a normal slug triggers one resolveOrgRegion() request rather than the heavier listOrganizationsUncached() fan-out (1+N requests), then returns the original slug for downstream error handling on failure. A DSN numeric identifier such as o1081365 dynamically imports ./api-client.js, calls listOrganizationsUncached() to populate numeric-ID mappings, retries the cache, and falls back to the original identifier.

🔴 (16:02) User showed packages/cli/src/lib/api/organizations.ts::getUserRegions(): it remains a lightweight, side-effect-free token-validation call to control-silo endpoint /users/me/regions/ via apiRequestToRegion<UserRegionsResponse>(); organization listing no longer depends on this region-discovery endpoint.

🔴 (16:02) User showed packages/cli/src/lib/api/organizations.ts::listOrganizationsPage(baseUrl, options): it requests /organizations/ using SDK pagination fields cursor and per_page; unwrapPaginatedResult() centrally handles enriched 401/403 errors. A non-array response throws ApiError with status 0 and explains that an incompatible self-hosted Sentry version or proxy/WAF may be interfering.

🔴 (16:02) User showed packages/cli/src/lib/api/organizations.ts::listOrganizations(): cached organizations are read from getCachedOrganizations(getApiBaseUrl()) and mapped with id, slug, name, and optional orgRole; a cold cache calls listOrganizationsUncached(). This avoids an approximately 200-400ms organization-list API round trip on every command.

🔴 (16:02) User showed packages/cli/src/lib/api/organizations.ts::listOrganizationsUncached(): it makes one paginated control-silo /organizations/ request rather than discovering regions through /users/me/regions/ and fanning out. Pagination uses API_MAX_PER_PAGE and a cap of MAX_PAGINATION_PAGES * API_MAX_PER_PAGE; each cache entry contains slug, regionUrl: org.links?.regionUrl ?? controlSiloUrl, sourceOrigin: controlSiloUrl, orgId, orgName, and orgRole, then setOrgRegions(regionEntries) persists them.

🔴 (16:03) User stated the sntrys_ server token contract has exactly 2 underscores; because standard base64 has no _, the second underscore always separates payload from secret.

🔴 (16:03) User showed packages/cli/src/lib/token-claims.ts::parseSntrysClaim(token): format is sntrys_<base64(JSON{iat, url, region_url, org})>_<random-secret>, with SNTRYS_PREFIX = "sntrys_" and MAX_TOKEN_LENGTH = 2048. It returns undefined for absent or oversized tokens, non-sntrys_ prefixes, an underscore count other than exactly 2, empty payloads, base64/JSON failures, non-object payloads, falsy iat, or missing/empty string url; valid output is { url, regionUrl?, org? }, with region_url mapped to regionUrl.

🔴 (16:03) User showed the trust rationale in packages/cli/src/lib/token-claims.ts: sntrys_ claims are unsigned and forgeable, but a legitimate token’s claim is authoritative and resistant to environment injection because an attacker poisoning $GITHUB_ENV cannot read or alter token bytes. Supplying a forged token means the credential itself is already compromised and is outside the threat model.

🔴 (16:03) User showed packages/cli/src/lib/sentry-urls.ts separates routing classification from credential trust: isSentrySaasUrl(url) checks only whether the hostname is sentry.io or a subdomain and intentionally accepts examples such as http://sentry.io and https://sentry.io:8443; isSaaSTrustOrigin(url) additionally requires protocol https: and an empty/default port.

🔴 (16:03) User stated http://sentry.io is never legitimate and a crafted plaintext URL must NOT inherit SaaS trust.

🔴 (16:03) User showed packages/cli/src/lib/sentry-urls.ts::normalizeOrigin(input): it accepts string | URL | Request | undefined | null, returns canonical scheme://host[:port], rejects bare/unparseable hostnames, and returns undefined for nullish or invalid inputs. normalizeUserInputToOrigin(input) first applies normalizeUrl() so user-supplied bare hostnames such as sentry.acme.com receive an https:// prefix before origin parsing.

🔴 (16:04) User showed packages/cli/src/lib/db/auth.ts: REFRESH_THRESHOLD = 0.1, and DEFAULT_TOKEN_LIFETIME_MS = 3600 * 1000. AuthRow.host stores the credential’s issuance origin and may be null only for rows written before schema v16.

🔴 (16:04) User showed packages/cli/src/lib/db/auth.ts::migrateNullHost(row): lazy migration uses the boot-time getEnvTokenHost() snapshot captured before .sentryclirc can mutate the environment, normalizes it with normalizeOrigin(), and falls back to DEFAULT_SENTRY_URL. It writes UPDATE auth SET host = ? WHERE id = 1 inside withDbSpan("migrateAuthHost", ...); write failure is non-fatal, the migration retries on later access, and callers still receive a well-formed host.

🔴 (16:04) User stated migrateNullHost(row) is never NULL on return.

🔴 (16:04) User showed packages/cli/src/lib/db/schema.ts has CURRENT_SCHEMA_VERSION = 17. Schema v16 added nullable auth.host for host-scoped credentials; schema v17 added nullable org_regions.source_origin, recording the origin that returned a regional URL so a row extends trust only for credentials scoped to that control-silo origin. org_regions also contains primary-key org_slug, org_id added in v8, org_name added in v9, org_role added in v10, non-null region_url, and non-null updated_at.