Session 0ZtdAYWYRAg0

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus</path>
<type>directory</type>
<entries>
.craft.yml
.git
.github/
.gitignore
.lore.md
.nojekyll
.npmrc
.opencode/
.plans/
.ruff_cache/
AGENTS.md
apps/
CHANGELOG.md
codemods/
coverage/
dist-bin/
dist/
docs/
LICENSE.md
node_modules/
package.json
packages/
pnpm-lock.yaml
pnpm-workspace.yaml
README.md
test-results.junit.xml

(26 entries)
</entries>

 M .lore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/event.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/explore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/feedback.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/issue.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/log.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/replay.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/span.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/trace.md
 M packages/cli/src/lib/constants.ts
 M packages/cli/test/lib/constants.test.ts
 M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

...output truncated...

Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_08a92d0990017H5H7qRcmEA002

-* **Always return to automatic detection after tests**: Always return to automatic detection after tests so we don't leak forced state. Ensures test isolation and prevents state leakage between test cases.
+<!-- lore:01a08a06-701b-7d34-932e-d3e4a4d18451 -->
+* **Ground upgrade changes in existing source and regression tests**: Before modifying CLI upgrade behavior, inspect the repository’s current implementation and tests at the specified baseline commit. Preserve exact public APIs, error types, reasons, messages, source-selection rules, cancellation behavior, and fallback semantics. Add or update focused regression tests for success paths and edge cases, including malformed responses, empty results, HTTP and transport failures, abort reasons, invalid inputs, pagination, polling, patch-chain rejection, and source affinity. ...

Found 100 matches (more matches available)
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts:
  Line 7:  * credentials when they don't match — so untrusted routing inputs can't leak

  Line 8:  * credentials to an attacker's host.

  Line 31: export function isHostTrusted(

  Line 76:  * The shell argv / boot env is at the same trust boundary as `SENTRY_AUTH_TOKEN`

  Line 99:   return isHostTrusted(host, loginTrustAnchor);

  Line 115:   if (isHostTrusted(requestInput, anchorHost)) {

  Line 140: export function isHostTrustedForClaim(

  Line 162:     return isHostTrusted(requestInput, loginTrustAnchor);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-claims.ts:
  Line 15:  * already compromised the credential itself (out of threat model).

  Line 43: export function ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/constants.ts</path>
<type>file</type>
<content>
1: /**
2:  * Runtime constants for the CLI.
3:  */
4: 
5: import { getEnv } from "./env.js";
6: import { parseSntrysClaim } from "./token-claims.js";
7: 
8: /** Build-time constant injected by esbuild/bun */
9: declare const SENTRY_CLI_VERSION: string | undefined;
10: 
11: /**
12:  * Build-time debug ID for sourcemap resolution, injected by esbuild.
13:  *
14:  * During the build, esbuild's `define` replaces this identifier with a
15:  * placeholder UUID string literal. After esbuild finishes, the build
16:  * script replaces the placeholder with the real debug ID (derived from
17:  * the minified JS + sourcemap content hash). The same-length swap keeps
18:  * sourcemap character positions valid. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-claims.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry Org-Auth-Token (`sntrys_`) Claim Extraction
3:  *
4:  * Format: `sntrys_<base64(JSON{iat, url, region_url, org})>_<random-secret>`
5:  * (server-side: getsentry/sentry `orgauthtoken_token.py`).
6:  *
7:  * The claim is **NOT signed** — anyone can forge a `sntrys_` string with any
8:  * `url`. However, for legitimate tokens the claim IS authoritative: the real
9:  * server wrote it at issuance time, and it's immune to env-injection attacks
10:  * (the attacker who can poison `SENTRY_HOST` via `$GITHUB_ENV` can't read or
11:  * modify the token bytes). `captureEnvTokenHost` uses the claim as the
12:  * primary trust source for `sntrys_` tokens, ahead of env vars. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Host-Scoped Token Trust Model
3:  *
4:  * Tokens (env or stored OAuth) are bound to a specific Sentry host. The fetch
5:  * layer (and the `.sentryclirc` / URL-arg entry points) check each request's
6:  * destination against the token's recorded host and refuse to attach
7:  * credentials when they don't match — so untrusted routing inputs can't leak
8:  * credentials to an attacker's host.
9:  *
10:  * Host equivalence:
11:  * - Exact origin match (scheme + host + explicit port).
12:  * - SaaS equivalence class: a token scoped to `https://sentry.io` is valid for
13:  *   any `*.sentry.io` subdomain. Non-SaaS hosts match exactly — no subdomain
14:  *   suffix matching (a `sentry.acme.com` token does NOT match
15:  *   `sentry.acme.evil.com`). ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/env-token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Env-Token Host Snapshot
3:  *
4:  * Captures the host an env-var auth token (`SENTRY_AUTH_TOKEN` /
5:  * `SENTRY_TOKEN`) is scoped to, BEFORE any post-boot code path can mutate
6:  * `env.SENTRY_HOST`/`env.SENTRY_URL` (specifically before
7:  * `applySentryCliRcEnvShim` writes from a `.sentryclirc` file).
8:  *
9:  * Trust model for the snapshot source:
10:  *
11:  * - `SENTRY_HOST`/`SENTRY_URL` from env are NOT unconditionally trusted.
12:  *   In layered CI environments (e.g. GitHub Actions `$GITHUB_ENV`), a
13:  *   low-privilege step can write env vars that a later high-privilege step
14:  *   inherits — without having read access to `SENTRY_AUTH_TOKEN`. So
15:  *   env-host and env-token may have different integrity levels. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry API Client Configuration
3:  *
4:  * Provides request configuration for @sentry/api SDK functions,
5:  * including authentication, retry logic, timeout, and multi-region support.
6:  *
7:  * Instead of managing client instances, we pass configuration per-request
8:  * through the SDK function options (baseUrl, fetch, headers).
9:  */
10: 
11: import { setTimeout as sleepMs } from "node:timers/promises";
12: import { getTraceData } from "@sentry/node-core/light";
13: import { maybeWarnEnvTokenIgnored } from "./auth-hint.js";
14: import { computeInvalidationPrefixes } from "./cache-keys.js";
15: import {
16:   DEFAULT_SENTRY_URL,
17:   getConfiguredSentryUrl,
18:   getUserAgent,
19: } from "./constants.js";
20: import {
21:   buildTlsErrorDetail,
22:   getCustomTlsOptions,
23:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
360: 
361: /** Extract the full URL string from a fetch input */
362: function extractFullUrl(input: Request | string | URL): string {
363:   if (typeof input === "string") {
364:     return input;
365:   }
366:   if (input instanceof URL) {
367:     return input.href;
368:   }
369:   return input.url;
370: }
371: 
372: /** Extract the URL pathname for span naming */
373: function extractUrlPath(input: Request | string | URL): string {
374:   const raw = extractFullUrl(input);
375:   try {
376:     return new URL(raw).pathname;
377:   } catch {
378:     return raw;
379:   }
380: }
381: 
382: /**
383:  * Attempt to serve a GET request from the response cache.
384:  * Returns the cached Response if valid, or undefined on miss. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
1: /**
2:  * Authentication credential storage (single-row table pattern).
3:  */
4: 
5: import { createHash } from "node:crypto";
6: import { DEFAULT_SENTRY_URL, getConfiguredSentryUrl } from "../constants.js";
7: import { getEnv } from "../env.js";
8: import { getEnvTokenHost } from "../env-token-host.js";
9: import { logger } from "../logger.js";
10: import { normalizeOrigin } from "../sentry-urls.js";
11: import { withDbSpan } from "../telemetry.js";
12: import { getDatabase } from "./index.js";
13: import { clearAllIssueOrgCache } from "./issue-org-cache.js";
14: import { clearTrustedHostState } from "./regions.js";
15: import { runUpsert } from "./utils.js";
16: 
17: /** Refresh when less than 10% of token lifetime remains */
18: export const REFRESH_THRESHOLD = 0.1;
19: 
20: /** Default token lifetime (1 hour) ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
630:   }
631: }
632: 
633: /** Get a valid token, refreshing if needed. Use force=true after 401 responses. */
634: export async function refreshToken(
635:   options: RefreshTokenOptions = {}
636: ): Promise<RefreshTokenResult> {
637:   // With SENTRY_FORCE_ENV_TOKEN, env token takes priority (no refresh needed).
638:   const forceEnv = getEnv().SENTRY_FORCE_ENV_TOKEN?.trim();
639:   if (forceEnv) {
640:     const envToken = getEnvToken();
641:     if (envToken) {
642:       return { token: envToken.token, refreshed: false };
643:     }
644:   }
645: 
646:   const { force = false } = options;
647:   const { AuthError } = await import("../errors.js");
648: 
649:   const row = getCachedAuthRow();
650: 
651:   if (!row?.token) {
652:     // No stored token — try env token as fallback
653:     const envToken = ...

Found 47 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/cli.ts:
  Line 28:   const { captureEnvTokenHost } = await import("./lib/env-token-host.js");

  Line 29:   captureEnvTokenHost();

  Line 47:   const { applySentryCliRcEnvShim } = await import("./lib/sentryclirc.js");

  Line 48:   await applySentryCliRcEnvShim(cwd);

  Line 54:       const { getDefaultUrl } = await import("./lib/db/defaults.js");

  Line 55:       const url = getDefaultUrl();


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/auth/login.ts:
  Line 52: import { registerLoginTrustAnchor } from "../../lib/token-host.js";

  Line 309:     registerLoginTrustAnchor(url);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/info.ts:
  Line 17:   getDefaultUrl,

  Line 65:     ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/cli.ts</path>
<type>file</type>
<content>
1: /**
2:  * CLI runner with fast-path dispatch.
3:  *
4:  * Shell completion (`__complete`) is dispatched before any heavy imports
5:  * to avoid loading `@sentry/node-core` (~280ms). All other commands go through
6:  * the full CLI with telemetry, middleware, and error recovery.
7:  *
8:  * Extracted from `bin.ts` so the logic is testable and reusable without
9:  * top-level side effects. `bin.ts` remains a thin wrapper that registers
10:  * stream error handlers and calls `startCli()`.
11:  */
12: 
13: import { getEnv } from "./lib/env.js";
14: import { CliError } from "./lib/errors.js";
15: import { initTimezone } from "./lib/timezone.js";
16: 
17: /**
18:  * Preload project context: walk up from `cwd` once, finding both the
19:  * project root (for DSN detection) and `.sentryclirc` config (for
20:  * org/project defaults ...

diff --git a/packages/cli/src/lib/constants.ts b/packages/cli/src/lib/constants.ts
index 4e707773a..f86998d9a 100644
--- a/packages/cli/src/lib/constants.ts
+++ b/packages/cli/src/lib/constants.ts
@@ -3,6 +3,7 @@
  */
 
 import { getEnv } from "./env.js";
+import { parseSntrysClaim } from "./token-claims.js";
 
 /** Build-time constant injected by esbuild/bun */
 declare const SENTRY_CLI_VERSION: string | undefined;
@@ -64,15 +65,23 @@ export function normalizeUrl(url: string | undefined): string | undefined {
 }
 
 /**
- * Resolve the Sentry instance URL from environment variables.
- * Checks SENTRY_HOST first, then SENTRY_URL, then falls back to undefined.
+ * Resolve the Sentry instance URL from explicit environment configuration or
+ * an org-auth token's embedded URL claim. Checks `SENTRY_HOST` first, then
+ * `SENTRY_URL`, then the `sntrys_` token claim, and otherwise returns undefined. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Defense-in-depth: `sntrys_` token claim vs request-origin mismatch.
3:  *
4:  * The fetch-layer guard refuses to attach a `sntrys_` token when its
5:  * embedded `url` claim disagrees with the request origin. Defends users
6:  * with access to multiple Sentry instances against routing one
7:  * instance's token to another. Claim is unsigned (see token-claims.ts),
8:  * so this catches honest misconfigurations more than malicious attacks.
9:  */
10: 
11: import { afterEach, beforeEach, describe, expect, test } from "vitest";
12: import {
13:   extractFetchUrl,
14:   mintSntrysToken,
15:   resetHostScopingState,
16:   useEnvSandbox,
17: } from "../../helpers.js";
18: 
19: const ENV_KEYS = [
20:   "SENTRY_AUTH_TOKEN",
21:   "SENTRY_TOKEN",
22:   "SENTRY_HOST",
23:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/infrastructure.ts</path>
<type>file</type>
<content>
1: /**
2:  * API Client Infrastructure
3:  *
4:  * Shared helpers, types, constants, and raw request functions used by
5:  * all domain-specific API modules. This is the foundation layer that
6:  * other modules in `src/lib/api/` import from.
7:  */
8: 
9: import { promisify } from "node:util";
10: import { zstdCompress as zstdCompressCb } from "node:zlib";
11: import { parseSentryLinkHeader } from "@sentry/api";
12: // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
13: import * as Sentry from "@sentry/node-core/light";
14: import type { z } from "zod";
15: 
16: import { extractRequiredScopes } from "../api-scope.js";
17: import { getActiveEnvVarName, isEnvTokenActive } from "../db/auth.js";
18: import { getEnv } from "../env.js";
19: import { ApiError, AuthError, ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/infrastructure.ts</path>
<type>file</type>
<content>
320:  * @internal Exported for testing
321:  */
322: export function buildSearchParams(
323:   params?: Record<string, string | number | boolean | string[] | undefined>
324: ): URLSearchParams | undefined {
325:   if (!params) {
326:     return;
327:   }
328: 
329:   const searchParams = new URLSearchParams();
330:   for (const [key, value] of Object.entries(params)) {
331:     if (value === undefined) {
332:       continue;
333:     }
334:     if (Array.isArray(value)) {
335:       for (const item of value) {
336:         searchParams.append(key, item);
337:       }
338:     } else {
339:       searchParams.set(key, String(value));
340:     }
341:   }
342: 
343:   return searchParams.toString() ? searchParams : undefined;
344: }
345: 
346: /**
347:  * Get SDK config for an organization's region. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-urls.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry URL Utilities
3:  *
4:  * Utilities for constructing Sentry web URLs.
5:  * Supports self-hosted instances via SENTRY_URL environment variable.
6:  */
7: 
8: import {
9:   DEFAULT_SENTRY_HOST,
10:   DEFAULT_SENTRY_URL,
11:   getConfiguredSentryUrl,
12:   normalizeUrl,
13: } from "./constants.js";
14: 
15: /**
16:  * Get the Sentry web base URL.
17:  * Supports self-hosted instances via SENTRY_URL env var.
18:  */
19: export function getSentryBaseUrl(): string {
20:   return getConfiguredSentryUrl() ?? DEFAULT_SENTRY_URL;
21: }
22: 
23: /**
24:  * Build the org-scoped base URL using the subdomain pattern.
25:  * E.g. "https://sentry.io" + "my-org" → "https://my-org.sentry.io"
26:  *
27:  * @param orgSlug - Organization slug
28:  * @returns Origin URL with org as subdomain
29:  */
30: export ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/env.ts</path>
<type>file</type>
<content>
1: /**
2:  * Environment variable registry for CLI/library isolation.
3:  *
4:  * CLI mode never calls `setEnv()`, so `getEnv()` returns `process.env`.
5:  * Library mode calls `setEnv()` with a merged env copy — the consumer's
6:  * `process.env` is never mutated.
7:  */
8: 
9: let _env: NodeJS.ProcessEnv = process.env;
10: 
11: /** Get the active environment. Library mode overrides this; CLI uses process.env. */
12: export function getEnv(): NodeJS.ProcessEnv {
13:   return _env;
14: }
15: 
16: /** Set the active environment for this invocation. */
17: export function setEnv(env: NodeJS.ProcessEnv): void {
18:   _env = env;
19: }

(End of file - total 19 lines)
</content>

Found 3 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/helpers.ts:
  Line 156: export function useEnvSandbox(keys: readonly string[]): void {

  Line 184: export async function resetHostScopingState(): Promise<void> {

  Line 207: export function mintSntrysToken(payload: Record<string, unknown>): string {

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/helpers.ts</path>
<type>file</type>
<content>
120:     process.env[CONFIG_DIR_ENV_VAR] = dir;
121:   });
122: 
123:   afterEach(async () => {
124:     closeDatabase();
125:     resetAuthTokenCache();
126:     resetAuthRowCache();
127:     resetHasStoredCredsCache();
128:     resetIdentityFingerprintCache();
129:     // Always restore the previous value — never delete.
130:     // Deleting process.env.SENTRY_CONFIG_DIR causes failures in test files
131:     // that load after this afterEach runs, because their module-level code
132:     // (or beforeEach hooks) may read the env var and get undefined.
133:     // Note: preload.ts always sets SENTRY_CONFIG_DIR, so savedConfigDir is
134:     // always defined in practice. The else branch is intentionally omitted
135:     // to avoid the "delete process.env" anti-pattern.
136:     if (savedConfigDir !== undefined) {
137: ...

Found 60 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/auth-hint.test.ts:
  Line 6:  * - Hint fires when env token + stored OAuth coexist.

  Line 8:  *   or when SENTRY_FORCE_ENV_TOKEN is set.

  Line 31:   savedForceEnv = process.env.SENTRY_FORCE_ENV_TOKEN;

  Line 34:   delete process.env.SENTRY_FORCE_ENV_TOKEN;

  Line 50:     process.env.SENTRY_FORCE_ENV_TOKEN = savedForceEnv;

  Line 52:     delete process.env.SENTRY_FORCE_ENV_TOKEN;

  Line 73:         String(call[0] ?? "").includes("SENTRY_FORCE_ENV_TOKEN=1")

  Line 94:   test("does nothing when no stored OAuth login exists", () => {

  Line 105:   test("does nothing when SENTRY_FORCE_ENV_TOKEN is set", () => {

  Line 108:     process.env.SENTRY_FORCE_ENV_TOKEN = "1";

  Line 118:   test("fires once when env token collides with stored OAuth", () => {

  Line 134:       expect(text).toContain("SENTRY_FORCE_ENV_TOKEN=1");

  Line 208:       ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/auto-login-host-guard.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Regression: auto-login (the error-recovery middleware that runs the OAuth
3:  * device flow when a command hits an auth error in an interactive TTY) must
4:  * honor the same host-trust gate as `sentry auth login`.
5:  *
6:  * Bug (getsentry/cli#1121): `sentry auth login` refuses a self-hosted host
7:  * unless `--url` confirms it, but `sentry auth whoami` (and any other command)
8:  * triggered an unconfirmed auto-login against `env.SENTRY_HOST`/`SENTRY_URL`,
9:  * bypassing that gate. Since a `.sentryclirc` shim can inject `env.SENTRY_URL`,
10:  * the bypass also reopened the OAuth-phishing vector that the `auth login`
11:  * gate was added to close (see login-token-rc-poison.test.ts). ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/constants.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for normalizeUrl and getConfiguredSentryUrl.
3:  *
4:  * The primary invariant — bare hostnames get `https://` prepended so that
5:  * downstream URL construction produces valid URLs — is tested via property-based
6:  * tests in constants.property.test.ts. These unit tests cover specific edge
7:  * cases and the env-var integration path.
8:  */
9: 
10: import { afterEach, beforeEach, describe, expect, test } from "vitest";
11: import {
12:   getCliEnvironment,
13:   getConfiguredSentryUrl,
14:   normalizeUrl,
15: } from "../../src/lib/constants.js";
16: import { mintSntrysToken } from "../helpers.js";
17: 
18: describe("normalizeUrl", () => {
19:   test("returns undefined for undefined", () => {
20:     expect(normalizeUrl(undefined)).toBeUndefined();
21:   });
22: 
23:   test("returns ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/auth/login.ts</path>
<type>file</type>
<content>
260:   const urlHint = isSaaSTrustOrigin(effectiveHost)
261:     ? ""
262:     : ` --url ${effectiveHost}`;
263:   return (
264:     `Found a token in .sentryclirc (${rcConfig.sources.token}). ` +
265:     "To import it: sentry cli import | " +
266:     `To pass it directly: sentry auth login --token <token>${urlHint}`
267:   );
268: }
269: 
270: /**
271:  * Persist a non-SaaS `--url` host as the stored default so subsequent CLI
272:  * invocations route correctly without requiring `SENTRY_HOST`. Only writes
273:  * when `--url` was explicitly passed; env/rc-sourced values persist
274:  * through those channels. Non-fatal on DB failure.
275:  */
276: function persistLoginUrlAsDefault(
277:   flagUrl: string | undefined,
278:   effectiveHost: string
279: ): void {
280:   if (!flagUrl || ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/custom-headers.ts</path>
<type>file</type>
<content>
1: /**
2:  * Custom Headers for Self-Hosted Sentry
3:  *
4:  * Parses `SENTRY_CUSTOM_HEADERS` env var (or `defaults.headers` from SQLite)
5:  * and injects user-specified HTTP headers into all requests to self-hosted
6:  * Sentry instances. Designed for environments behind reverse proxies
7:  * (e.g., Google IAP, Cloudflare Access) that require extra headers.
8:  *
9:  * Format: semicolon-separated `Name: Value` pairs (newlines also accepted).
10:  *
11:  * @example
12:  * ```bash
13:  * # Single header
14:  * SENTRY_CUSTOM_HEADERS="X-IAP-Token: abc123"
15:  *
16:  * # Multiple headers
17:  * SENTRY_CUSTOM_HEADERS="X-IAP-Token: abc123; X-Forwarded-For: 10.0.0.1"
18:  *
19:  * # Via defaults command
20:  * sentry cli defaults headers "X-IAP-Token: abc123"
21:  * ```
22:  */
23: 
24: import { ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentryclirc.ts</path>
<type>file</type>
<content>
300:  * 3. Closest file's values win per-field
301:  * 4. Always check global location as fallback:
302:  *    `$SENTRY_CONFIG_DIR/.sentryclirc`, then `~/.sentryclirc`
303:  *
304:  * Results are cached for the process lifetime (keyed by `cwd`).
305:  * Concurrent callers for the same `cwd` share the same promise.
306:  *
307:  * @param cwd - Starting directory for walk-up search
308:  * @returns Merged config (empty fields if no files found)
309:  */
310: export function loadSentryCliRc(cwd: string): Promise<SentryCliRcConfig> {
311:   const cached = cache.get(cwd);
312:   if (cached) {
313:     return cached;
314:   }
315: 
316:   // Evict from cache on failure so subsequent calls retry instead of
317:   // permanently returning a rejected promise.
318:   const promise = doLoad(cwd).catch((error) => {
319:     ...

Found 18 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/feedback/view.ts:
  Line 131:     if (flags.web) {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/trace/view.ts:
  Line 547:     if (flags.web) {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/trace/logs.ts:
  Line 192:     if (flags.web) {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/issue/view.ts:
  Line 234:     if (flags.web) {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/dashboard/view.ts:
  Line 222:     if (flags.web) ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/issue/view.ts</path>
<type>file</type>
<content>
200:       "  numeric         - Numeric ID: 123456789\n" +
201:       "  org/project#ID  - GitHub-style: my-org/my-project#PROJ-123\n\n" +
202:       "In multi-project mode (after 'issue list'), use alias-suffix format (e.g., 'f-g' " +
203:       "where 'f' is the project alias shown in the list).",
204:   },
205:   output: {
206:     human: formatIssueView,
207:     jsonTransform: jsonTransformIssueView,
208:     schema: IssueViewOutputSchema,
209:   },
210:   parameters: {
211:     positional: issueIdPositional,
212:     flags: {
213:       web: {
214:         kind: "boolean",
215:         brief: "Open in browser",
216:         default: false,
217:       },
218:       ...spansFlag,
219:       fresh: FRESH_FLAG,
220:     },
221:     aliases: { ...FRESH_ALIASES, w: "web" },
222:   },
223:   async *func(this: ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/dashboard/list.ts</path>
<type>file</type>
<content>
385:   output: {
386:     human: formatDashboardListHuman,
387:     jsonTransform: jsonTransformDashboardList,
388:   },
389:   parameters: {
390:     positional: {
391:       kind: "array",
392:       parameter: {
393:         placeholder: "org/title-filter",
394:         brief: "[<org/project>] [<name-glob>]",
395:         parse: String,
396:       },
397:     },
398:     flags: {
399:       web: {
400:         kind: "boolean",
401:         brief: "Open in browser",
402:         default: false,
403:       },
404:       limit: buildListLimitFlag("dashboards"),
405:     },
406:     aliases: { w: "web", n: "limit" },
407:   },
408:   async *func(this: SentryContext, flags: ListFlags, ...args: string[]) {
409:     const { cwd } = this;
410: 
411:     const { targetArg, titleFilter } = ...