Dashboard › cli › Distillation
ffdb7f28-a2d0-4570-b7f8-d49bbf34e43d["lore_tm_v1_6ZlvRRnCw0RS-CHi0cGvqfHZbazHJBe7H_cE0s9GmGY","lore_tm_v1_qu9xZRsc1URQTDVeL43k5YgCCQOIbtkCQ8X-FNJGcvo","lore_tm_v1_qM-P60pu2KCY6u3u9FqFaBpvTve1HntSq5eKmIvokMQ","lore_tm_v1_7Gf9d0dQ4Rp0i8B_5eTfu4mNpC7gZNZYDmzysGB2GaU","lore_tm_v1_ia-evVLlQBlQD1DAwqC3QiamiyqITFH28_pobF3TnEE","lore_tm_v1_1aAqk_AJlsJ0vXwa7rq02U98g2k8aDrv4sTFDNnsC3A"]
Date: Sep 10, 2026
preload.ts always sets SENTRY_CONFIG_DIR; therefore savedConfigDir is always defined in practice.packages/cli/test/helpers.ts: test cleanup deliberately does not delete process.env.SENTRY_CONFIG_DIR/CONFIG_DIR_ENV_VAR; deletion causes later-loaded test files’ module-level code or beforeEach hooks to read it as undefined. If savedConfigDir !== undefined, cleanup restores it verbatim, then calls cleanupTestDir(dir).useEnvSandbox(keys: readonly string[]) in packages/cli/test/helpers.ts must be called at module scope or inside describe(). Its beforeEach saves each named process.env value and deletes all listed keys; its afterEach restores saved defined values verbatim and deletes keys originally absent. It is intended for security/host-scoping tests.resetHostScopingState() in packages/cli/test/helpers.ts dynamically imports resetEnvTokenHostForTesting from ../src/lib/env-token-host.js, ../src/lib/db/regions.js, and resetLoginTrustAnchorForTesting from ../src/lib/token-host.js; it resets the env-token host snapshot, trusted region URLs, and login trust anchor to prevent cross-test state bleed.mintSntrysToken(payload) serializes payload as JSON, base64-encodes UTF-8 JSON with trailing = padding stripped, and returns sntrys_${b64}_test-secret-tail. The fixed secret tail is irrelevant to parsing and matches the server generate_token shape in getsentry/sentry/src/sentry/utils/security/orgauthtoken_token.py.extractFetchUrl(input: RequestInfo | URL) in packages/cli/test/helpers.ts returns a string input unchanged, URL.href for a URL, and Request.url otherwise; tests use it to assert intercepted globalThis.fetch destination URLs.packages/cli/src/lib/telemetry.ts detects node:util.getSystemErrorMap once at module load via dynamic _require("node:util"); hasGetSystemErrorMap is false on require failure or absent function. This excludes the SDK NodeSystemError integration when Bun lacks that Node API, preventing its processEvent hook from crashing during event processing (CLI-K1).getSentryTracePropagationTargets() in packages/cli/src/lib/telemetry.ts always returns regex targets SENTRY_SAAS_SUBDOMAIN_RE = /^https:\/\/[^/]*\.sentry\.io(\/|$)/ and SENTRY_SAAS_ROOT_RE = /^https:\/\/sentry\.io(\/|$)/; it additionally includes getConfiguredSentryUrl() only when configured and non-SaaS. SaaS matching covers regional URLs such as us.sentry.io, de.sentry.io, and o1234.ingest.us.sentry.io.setLibcTag() in packages/cli/src/lib/telemetry.ts is a non-Linux no-op; on Linux it sets Sentry tag cli.libc to "musl" when isMusl() else "glibc". setAgentTags(info: AgentInfo) sets agent to info.name and conditionally sets agent.version and agent.role.packages/cli/src/lib/region.ts::resolveOrgRegion() throws response.error so withAuthGuard can propagate AuthError; other errors such as network failures or 404s fall back to baseUrl, supporting self-hosted instances without multi-region. A successful response uses response.data?.links?.regionUrl ?? baseUrl, then setOrgRegion(orgSlug, regionUrl), which also extends in-process request trust to that regional URL.isMultiRegionEnabled() returns false only when a configured SENTRY_HOST/SENTRY_URL is non-SaaS; otherwise it returns true.resolveEffectiveOrg(orgSlug) first checks local cache via resolveOrgFromCache(): direct slug lookup through getOrgRegion(orgSlug), then DSN-style oNNNNN lookup by stripping o and using getOrgByNumericId(numericId). For normal slugs it tries one resolveOrgRegion() request rather than heavy listOrganizationsUncached() fan-out; DSN numeric IDs require full org-list fan-out to populate numeric-ID-to-slug mappings before retrying cache, then fall back to original input.packages/cli/src/lib/oauth.ts implements RFC 8628 Device Authorization Grant. getSentryUrl() reads getConfiguredSentryUrl() ?? DEFAULT_SENTRY_URL lazily, allowing URL-argument parsing to set SENTRY_URL after import for self-hosted device flow and token refresh.packages/cli/src/lib/oauth.ts::getClientId() is getEnv().SENTRY_CLIENT_ID, then build-time SENTRY_CLIENT_ID_BUILD, then committed DEFAULT_OAUTH_CLIENT_ID (a public-client ID); self-hosted instances must override via SENTRY_CLIENT_ID or SENTRY_CLIENT_ID_BUILD.OAUTH_SCOPES exact ordered defaults are: 1. project:read; 2. project:write; 3. project:admin; 4. org:read; 5. event:read; 6. event:write; 7. member:read; 8. team:read; 9. team:write; 10. alerts:read; 11. alerts:write. SCOPES is their space-joined form; read-only scopes are derived by scope.endsWith(":read").resolveOAuthScopeString(selection) precedence is explicit selection.scopes, then selection.readOnly, then full SCOPES. Explicit scopes are validated against SENTRY_SCOPES, normalized lowercase, and de-duplicated while preserving first-seen order; it throws ValidationError if normalized scopes are empty or contain unknown values.packages/cli/src/lib/custom-headers.ts validates SENTRY_CUSTOM_HEADERS: each parsed header requires a nonempty RFC 7230-token-compatible name; invalid names and attempts to override names in FORBIDDEN_HEADER_NAMES throw ConfigError. Parsed entries are [name, value].getEnv().SENTRY_CUSTOM_HEADERS over trimmed SQLite getDefaultHeaders() (defaults.headers); no configured value returns undefined.getCustomHeaders() returns [] when no headers are configured or target is not self-hosted. Self-hosted means getConfiguredSentryUrl() exists and !isSentrySaasUrl(configured); a missing configured URL implies SaaS. When headers are configured for SaaS, it logs once: "SENTRY_CUSTOM_HEADERS is set but no self-hosted Sentry instance is configured. Headers will be ignored." Parsed headers are cached, but self-hosted status is reevaluated each call because URL argument parsing can dynamically set SENTRY_HOST.