Distillation

Date: Sep 10, 2026

• 🔴 (09:08) User stated that a sntrys_ token has format sntrys_<base64(JSON{iat, url, region_url, org})>_<random-secret> and that standard Base64 contains no _, so the second underscore always separates payload from secret.
• 🔴 (09:08) User stated that .sentryclirc files are never consulted when snapshotting an environment-token host because they have weaker integrity than environment values or token claims.
• 🔴 (09:08) User stated apiRequestToRegion always sends JSON and explicitly sets its Content-Type; SDK functions set their own Content-Type.
• 🔴 (09:08) User stated the request-retry loop's final attempt always returns "done" or "throw".
• 🔴 (09:08) User stated throwOnError for @sentry/api SDK request configuration is always false, because CLI code handles errors itself.
• 🟡 (09:08) parseSntrysClaim() in packages/cli/src/lib/token-claims.ts accepts only nonempty sntrys_ tokens up to MAX_TOKEN_LENGTH = 2048, requires exactly 2 underscores, Base64-decodes and JSON-parses the payload, requires truthy iat and nonempty string url, and returns { url, regionUrl, org } with optional nonempty region_url and org.
• 🟡 (09:08) Token-host trust model in packages/cli/src/lib/token-host.ts: exact normalized-origin equality is trusted; SaaS tokens scoped to https://sentry.io also trust https default-port *.sentry.io origins; non-SaaS origins never use suffix/subdomain matching. Invalid or absent trusted origins return false.
• 🟡 (09:08) getActiveTokenHost() uses stored OAuth token host over an environment token unless SENTRY_FORCE_ENV_TOKEN is nonempty; it otherwise uses getEnvTokenHost() when an environment token exists.
• 🟡 (09:08) registerLoginTrustAnchor() pins a normalized explicit login URL for the process; isLoginTrustAnchorFor() requires host-scoped matching rather than merely anchor existence, preventing stale anchors from admitting a different auth login --url <other-host> target in library/test mode. resetLoginTrustAnchorForTesting() clears it.
• 🟡 (09:08) isRequestOriginTrusted() permits all origins when no token is active; with a token, it requires host trust or isTrustedRegionOrigin(). isRequestOriginTrustedForCustomHeaders() permits custom headers only for an active token's trusted origin, or when no token exists for a matching explicit login trust anchor; otherwise it fails closed.
• 🟡 (09:08) captureEnvTokenHost() in packages/cli/src/lib/env-token-host.ts is idempotent and resolves the pinned environment-token host in this order: normalized sntrys_ embedded claim url; normalized SENTRY_HOST or SENTRY_URL; then DEFAULT_SENTRY_URL. getEnvTokenHost() auto-captures for library-mode callers; resetEnvTokenHostForTesting() clears the pin.
• 🟡 (09:08) Environment-token host capture must occur in src/cli.ts::preloadProjectContext before findProjectRoot, applySentryCliRcEnvShim, and getDefaultUrl(), because later paths may populate .sentryclirc state or write env.SENTRY_URL.
• 🟡 (09:08) The authenticated fetch layer includes authentication, timeout, retry, caching, 401 token refresh, API analytics User-Agent, response-cache age hints, automatic cache invalidation after successful non-GET mutations, and retry logging formatted as ${method} ${new URL(fullUrl).pathname} → retry ${attempt + 1}/${MAX_RETRIES} after ${delay}ms.