Dashboard › cli › Distillation
f15c83d5-b111-49af-a14f-a7cc1abdf990["lore_tm_v1_lAtHzfbqrN66bWH9HXVZbASBQDUh5JWHqwhSjQkRyhk","lore_tm_v1_CTTd62DigV-IKTE_QR7k-0iyiUJA9b0G9J_px8qYt0U","lore_tm_v1_-1GLgeOjEs21x2Q9GewUPGHPK94_whk-pEFDxW4kBZM","lore_tm_v1_rSHSl_EmTv6xMxLUrN2dCok6ehIKJZ5r8OZXIjs8Ak0","lore_tm_v1_eHdPV-g5jfAVr9dSiLGTNwL_Sht2QLg4orXwPTkcbd0","lore_tm_v1_IPzaKEbKHQm0dmkoufAkSassDbDUt3sWOUQvw8eYM2k","lore_tm_v1_vbDarzEP0caMZbIztJdSK3qd97Ycz4QzeRU02h16ih4","lore_tm_v1_Do-BH15Pyds6zROxlFMHpco5_seme_aRc4btW4jADdA","lore_tm_v1_MQ8xjuug0JIRBQjawRR1xWdbXVUXYvhfsUDaD1XRB1U","lore_tm_v1_rMVbfa7V0fiyecLW80Vx0Zvr-YJ31PXDTIX6fcJbApI","lore_tm_v1_ia0xN8rrFud7VSYmclSPYInBezU-jHsTx5TGCf1ZUss","lore_tm_v1_7pgUpwi3xCeLajuFzc8kyYnh82tpzRO7i7Aue3oPSjY","lore_tm_v1_4iiGbBb8GXEgaHMXWZ3MvlG7pN6xP0FYNNwXWZtrSC4","lore_tm_v1_zVv5Vt1LqL2lzyna0i-mR8U8J5aPRIN3YlZsek4IsN8","lore_tm_v1_N7dUEMUM8iNlfDSCaVfmtGZo4Nkh6qUxGx8hm5QQiDY","lore_tm_v1_i722W6ylT5LRoQ48oUvHTSae9B3jkd7wLOYqxUUOZ5c","lore_tm_v1_hT4Z2gaRjDURrBHlfZGhRHkfM3bLL4VFawOQTYhWcCI","lore_tm_v1_eBwE6JgvEKkskJgKva_o9TLLI-ZX2l1Z0-xIANMz4LA","lore_tm_v1_n1422djJS0ejVLskKOtldRb4YjLQGlj4h8NBr2HqorE","lore_tm_v1_QQROMSopOrBZQiWlemiDDX-V6-c0GgOkyFa0W7EVj10","lore_tm_v1_JrjeFsXFEBVCyPswSJ07UXGfoxpeFQR2Y1YqN1LIhBU","lore_tm_v1_ek6SicpsDRv0F0PjME3ns0iee4s4B_2JCe0KTD8iGT4","lore_tm_v1_NOghbBRejcY2iHW-frmz8TXYFNIlQb7f_9uXzbhJ-qo","lore_tm_v1_osrBqF1546eueaow9GJn42S3hLaNEVN7KagfeDXQqlY","lore_tm_v1_PTAN8rX7X8C1svEHKsxzKKGoyqviYxvvStDhJ015Pds","lore_tm_v1_VZPe3clO-Nas9kh6Ms9PWHf81t5HhgFEOQdcRBxNkLc","lore_tm_v1_DVIzDIs-U73blSewCT0umE8E9RuVPctnm-NOck3uek4"]
Date: Sep 10, 2026
ses_f75566a54ffezgWSWXjMJrPrN1) completed with MUST-FIX: issue #1568 remained broken for org-scoped requests because packages/cli/src/lib/region.ts:73 used getSentryBaseUrl(), which defaults to https://sentry.io absent configured env URLs, while debug-files upload reaches resolveOrgRegion() through packages/cli/src/lib/api/debug-files.ts:441; a self-hosted sntrys_ env token therefore initiated its region lookup against SaaS, and packages/cli/src/lib/sentry-client.ts:121-126 rejected that host against the token claim host before the new getApiBaseUrl() fallback could apply.test/lib/security/sntrys-claim-mismatch.test.ts:130-151 directly tested apiRequestToRegion() and bypassed resolveOrgRegion()/the failing debug-files upload path; no regression covered stored OAuth plus env token with SENTRY_FORCE_ENV_TOKEN enabled proving the env claim selects both route and bearer; malformed-claim coverage at sntrys-claim-mismatch.test.ts:181-191 tested only base-URL selection rather than authenticated request behavior and token non-disclosure.ses_f75564b8cffeuB7Nyp76Re1IuM) completed with PASS and no merge-blocking security defects: claim routing uses the active credential’s trusted host only when no explicit URL exists (sentry-client.ts:685-697); stored OAuth wins over an unforced env token while forced env credentials win only when present (token-host.ts:57-68, db/auth.ts:158-203, db/auth.ts:634-657); hostile explicit-host overrides fail before bearer/custom-header attachment (sentry-client.ts:121-169), with independent custom-header guarding at custom-headers.ts:216-239; self-hosted origins use exact host trust and SaaS trust is tightly scoped (token-host.ts:31-48).sntrys-claim-mismatch.test.ts:181-190), although a syntactically parsed but invalid claim URL fails closed before a bearer is sent at sentry-client.ts:133-140; this was assessed as token-local denial of service rather than credential leakage. Coverage also lacked full base-URL tests for SENTRY_FORCE_ENV_TOKEN plus stored OAuth and the equivalent control-silo getter, though source precedence was consistent.tsc --noEmit passed; reviewed patch hash was d23acb520090d4c7431575e80a0497b112a8ce284254e36cd10edca27e01c08c.packages/cli/src/lib/region.ts implementation details inspected: resolveOrgRegion() maintains a Map<string, Promise<string>> in-process cache keyed by orgSlug, returns cached/in-flight promises, and evicts rejected promises; resolveOrgRegionUncached() checks SQLite getOrgRegion(orgSlug), fetches organization metadata with SDK getOrganization(), caches response.data?.links?.regionUrl ?? baseUrl using setOrgRegion(), propagates auth errors via withAuthGuard(), and otherwise falls back to baseUrl.resolveOrgRegion()’s web-only getSentryBaseUrl() initial lookup with getApiBaseUrl(), because region.ts already imports getSdkConfig() from sentry-client; planned regression location: packages/cli/test/lib/region.test.ts.packages/cli/src/lib/env-token-host.ts trust model states that sntrys_ embedded url claims are authoritative and override SENTRY_HOST/SENTRY_URL; non-sntrys_ tokens fall back to normalized SENTRY_HOST/SENTRY_URL, then DEFAULT_SENTRY_URL; the host is process-pinned by idempotent captureEnvTokenHost() and retrievable via auto-capturing getEnvTokenHost()..sentryclirc files are never consulted for env-token host selection because they have weaker integrity than environment values or token claims.packages/cli/src/lib/token-host.ts host trust details inspected: exact normalized origin matching is required for non-SaaS; SaaS equivalence permits only strict HTTPS/default-port https://sentry.io and *.sentry.io origins; getActiveTokenHost() uses stored OAuth unless an env token exists and nonblank SENTRY_FORCE_ENV_TOKEN is set, otherwise returns the env-token host.resolveOrgRegion() use the API resolver and test the exact organization lookup preceding debug-file uploads.packages/cli/src/lib/region.ts and packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts.resolveOrgRegion() now starts organization metadata retrieval from getApiBaseUrl(), thereby using the active token host; it planned to run affected regression suites and format both changed files.test.poolOptions was removed in Vitest 4 and prior pool options are now top-level options.packages/cli passed 3 test files and 57/57 tests in 14.93s (transform 9.43s, setup 511ms, import 11.88s, tests 9.99s); auth logs twice reported that SENTRY_AUTH_TOKEN was detected but stored OAuth was used, advising SENTRY_FORCE_ENV_TOKEN=1 to prefer env credentials.apiRequestToRegion always sends JSON and explicitly sets it; rawApiRequest may intentionally omit Content-Type for cases such as string bodies.packages/cli/src/lib/sentry-client.ts header-preparation behavior inspected: prepareHeaders() rejects untrusted request origins before attaching credentials (isRequestOriginTrusted()); for sntrys_ tokens it rejects a parsed claim URL that does not trust the request origin via isHostTrustedForClaim(); it preserves headers from a Request when SDK calls fetch(request) without init to prevent Node.js HTTP 415 errors; it mutates one shared Headers instance across retries, attaches Authorization: Bearer <token>, defaults User-Agent, injects sentry-trace/baggage, and applies URL-scoped custom headers.SENTRY_FORCE_ENV_TOKEN precedence and malformed-claim failure before any bearer reaches the wire.packages/cli/src/lib/region.ts and packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts; assistant reported the added cases prove forced env precedence for API and control-silo routing and prove malformed claims never send a bearer.test.poolOptions deprecation and twice-repeated stored-OAuth-over-env-token informational auth logs appeared.