Session 0cvCFbbhdaJ4

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus</path>
<type>directory</type>
<entries>
.craft.yml
.git
.github/
.gitignore
.lore.md
.nojekyll
.npmrc
.opencode/
.plans/
.ruff_cache/
AGENTS.md
apps/
CHANGELOG.md
codemods/
coverage/
dist-bin/
dist/
docs/
LICENSE.md
node_modules/
package.json
packages/
pnpm-lock.yaml
pnpm-workspace.yaml
README.md
test-results.junit.xml

(26 entries)
</entries>

/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/AGENTS.md
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/package.json
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/package.json
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/AGENTS.md
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/codemods/sentry-v3-to-v4/package.json
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/init-eval/templates/sveltekit-app/package.json
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/init-eval/templates/react-vite-app/package.json
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/AGENTS.md</path>
<type>file</type>
<content>
1: <!-- This section is maintained by the coding agent via lore (https://github.com/BYK/loreai) -->
2: ## Long-term Knowledge
3: 
4: For long-term knowledge entries managed by [lore](https://github.com/BYK/loreai) (gotchas, patterns, decisions, architecture), see [`.lore.md`](.lore.md) in the project root.
5: <!-- End lore-managed section -->

(End of file - total 5 lines)
</content>

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/AGENTS.md</path>
<type>file</type>
<content>
1: # AGENTS.md
2: 
3: Guidelines for AI agents working in this codebase.
4: 
5: ## Project Overview
6: 
7: **Sentry CLI** is a command-line interface for [Sentry](https://sentry.io), built with Node.js, [pnpm](https://pnpm.io), and [Stricli](https://bloomberg.github.io/stricli/). It lives in `packages/cli` of a pnpm workspace; the docs site lives in `apps/cli-docs`. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/CONTRIBUTING.md</path>
<type>file</type>
<content>
1: # Contributing to Sentry CLI
2: 
3: This guide documents the patterns and conventions used in this CLI for consistency.
4: 
5: ## Command Patterns
6: 
7: We follow [gh CLI](https://cli.github.com/) conventions for best-in-class developer experience.
8: 
9: ### List Commands
10: 
11: List commands use **optional positional arguments** for context with smart auto-detection.
12: 
13: ```bash
14: sentry org list [--limit N] [--json]
15: sentry project list [org] [--limit N] [--json]
16: sentry issue list [<org>/<project>] [--json]
17: ```
18: 
19: **Target syntax**:
20: - `<org>/<project>` - Explicit organization and project (e.g., `my-org/frontend`)
21: - `<org>/` - All projects in the specified organization
22: - `<project>` - Search for project by name across all accessible organizations
23: - *(omit)* - Auto-detect ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/package.json</path>
<type>file</type>
<content>
1: {
2:   "name": "sentry",
3:   "version": "0.40.0-dev.0",
4:   "description": "Sentry CLI - A command-line interface for using Sentry built by robots and humans for robots and humans",
5:   "repository": {
6:     "type": "git",
7:     "url": "git+https://github.com/getsentry/cli.git"
8:   },
9:   "main": "./dist/index.cjs",
10:   "type": "module",
11:   "types": "./dist/index.d.cts",
12:   "exports": {
13:     ".": {
14:       "import": {
15:         "types": "./dist/index.d.mts",
16:         "default": "./dist/index.mjs"
17:       },
18:       "require": {
19:         "types": "./dist/index.d.cts",
20:         "default": "./dist/index.cjs"
21:       }
22:     }
23:   },
24:   "bin": {
25:     "sentry": "./dist/bin.cjs"
26:   },
27:   "files": [
28:     "dist/bin.cjs",
29:     "dist/index.cjs",
30:     ...

No files found

 M .lore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/event.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/explore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/feedback.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/issue.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/log.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/replay.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/span.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/trace.md
 M packages/cli/src/commands/org/list.ts
 M packages/cli/src/commands/project/delete.ts
 M packages/cli/src/lib/api/organizations.ts
 M packages/cli/src/lib/api/projects.ts
 M packages/cli/src/lib/constants.ts
 M packages/cli/src/lib/db/regions.ts
 M packages/cli/src/lib/db/schema.ts
 M packages/cli/src/lib/oauth.ts
 M ...

Found 100 matches (more matches available)
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/commands/span/view.test.ts:
  Line 358:     // Pre-populate org region cache to prevent resolveOrgRegion from fetching


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts:
  Line 55:  * token unless `SENTRY_FORCE_ENV_TOKEN` is set.

  Line 57: export function getActiveTokenHost(): string | undefined {

  Line 59:   const forceEnv = hasEnvToken && !!getEnv().SENTRY_FORCE_ENV_TOKEN?.trim();

  Line 132:   const tokenHost = getActiveTokenHost();

  Line 133:   if (!tokenHost) {

  Line 136:   return isOriginTrustedFor(requestInput, tokenHost);

  Line 141:  * url instead of `getActiveTokenHost()`.

  Line 161:   if (getActiveTokenHost()) ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry API Client Configuration
3:  *
4:  * Provides request configuration for @sentry/api SDK functions,
5:  * including authentication, retry logic, timeout, and multi-region support.
6:  *
7:  * Instead of managing client instances, we pass configuration per-request
8:  * through the SDK function options (baseUrl, fetch, headers).
9:  */
10: 
11: import { setTimeout as sleepMs } from "node:timers/promises";
12: import { getTraceData } from "@sentry/node-core/light";
13: import { maybeWarnEnvTokenIgnored } from "./auth-hint.js";
14: import { computeInvalidationPrefixes } from "./cache-keys.js";
15: import {
16:   DEFAULT_SENTRY_URL,
17:   getConfiguredSentryUrl,
18:   getUserAgent,
19: } from "./constants.js";
20: import {
21:   buildTlsErrorDetail,
22:   getCustomTlsOptions,
23:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
600:  * a successful mutation into a caller-visible error. Defense-in-depth
601:  * for future regressions — the helpers we call are already no-throw
602:  * today.
603:  */
604: async function invalidateAfterMutation(
605:   method: string,
606:   fullUrl: string,
607:   response: Response
608: ): Promise<void> {
609:   if (method === "GET" || !response.ok) {
610:     return;
611:   }
612:   try {
613:     const prefixes = computeInvalidationPrefixes(fullUrl, getApiBaseUrl());
614:     await Promise.all(
615:       prefixes.map((prefix) => invalidateCachedResponsesMatching(prefix))
616:     );
617:   } catch (error) {
618:     log.debug("Post-mutation cache invalidation failed", error);
619:   }
620: }
621: 
622: /** Build a `{ authorization }` header map from a bearer token, or `{}` if absent. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Host-Scoped Token Trust Model
3:  *
4:  * Tokens (env or stored OAuth) are bound to a specific Sentry host. The fetch
5:  * layer (and the `.sentryclirc` / URL-arg entry points) check each request's
6:  * destination against the token's recorded host and refuse to attach
7:  * credentials when they don't match — so untrusted routing inputs can't leak
8:  * credentials to an attacker's host.
9:  *
10:  * Host equivalence:
11:  * - Exact origin match (scheme + host + explicit port).
12:  * - SaaS equivalence class: a token scoped to `https://sentry.io` is valid for
13:  *   any `*.sentry.io` subdomain. Non-SaaS hosts match exactly — no subdomain
14:  *   suffix matching (a `sentry.acme.com` token does NOT match
15:  *   `sentry.acme.evil.com`). ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/constants.ts</path>
<type>file</type>
<content>
1: /**
2:  * Runtime constants for the CLI.
3:  */
4: 
5: import { getEnv } from "./env.js";
6: 
7: /** Build-time constant injected by esbuild/bun */
8: declare const SENTRY_CLI_VERSION: string | undefined;
9: 
10: /**
11:  * Build-time debug ID for sourcemap resolution, injected by esbuild.
12:  *
13:  * During the build, esbuild's `define` replaces this identifier with a
14:  * placeholder UUID string literal. After esbuild finishes, the build
15:  * script replaces the placeholder with the real debug ID (derived from
16:  * the minified JS + sourcemap content hash). The same-length swap keeps
17:  * sourcemap character positions valid.
18:  */
19: declare const __SENTRY_DEBUG_ID__: string | undefined;
20: 
21: /** Default Sentry SaaS hostname */
22: export const DEFAULT_SENTRY_HOST = "sentry.io";
23: 
24: /** ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/env-token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Env-Token Host Snapshot
3:  *
4:  * Captures the host an env-var auth token (`SENTRY_AUTH_TOKEN` /
5:  * `SENTRY_TOKEN`) is scoped to, BEFORE any post-boot code path can mutate
6:  * `env.SENTRY_HOST`/`env.SENTRY_URL` (specifically before
7:  * `applySentryCliRcEnvShim` writes from a `.sentryclirc` file).
8:  *
9:  * Trust model for the snapshot source:
10:  *
11:  * - `SENTRY_HOST`/`SENTRY_URL` from env are NOT unconditionally trusted.
12:  *   In layered CI environments (e.g. GitHub Actions `$GITHUB_ENV`), a
13:  *   low-privilege step can write env vars that a later high-privilege step
14:  *   inherits — without having read access to `SENTRY_AUTH_TOKEN`. So
15:  *   env-host and env-token may have different integrity levels. ...

Found 7 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts:
  Line 100: export function getRawEnvToken(): string | undefined {

  Line 158: export function getAuthConfig(): AuthConfig | undefined {

  Line 272: export function getUsableStoredTokenHost(): string | undefined {

  Line 274:     return withDbSpan("getUsableStoredTokenHost", () => {

  Line 386: export function setAuthToken(

  Line 612:     await setAuthToken(

  Line 634: export async function refreshToken(

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
70:     // Non-fatal: if the migration write fails, callers still get a
71:     // well-formed host from this function. The migration will retry
72:     // on the next access.
73:   }
74:   row.host = host;
75:   return host;
76: }
77: 
78: /** Prefix for environment variable auth sources in {@link AuthSource} */
79: export const ENV_SOURCE_PREFIX = "env:";
80: 
81: /** Where the auth token originated */
82: export type AuthSource = "env:SENTRY_AUTH_TOKEN" | "env:SENTRY_TOKEN" | "oauth";
83: 
84: export type AuthConfig = {
85:   token?: string;
86:   refreshToken?: string;
87:   expiresAt?: number;
88:   issuedAt?: number;
89:   source: AuthSource;
90: };
91: 
92: /**
93:  * Read the raw token string from environment variables, ignoring all filters. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
292: /** Memoized token. Wrapper distinguishes "not cached" from "cached as undefined". */
293: let cachedAuthToken: { value: string | undefined } | undefined;
294: 
295: /**
296:  * Get the active auth token.
297:  *
298:  * Default: checks the DB first (stored OAuth wins), then falls back to env vars.
299:  * With `SENTRY_FORCE_ENV_TOKEN=1`: checks env vars first (old behavior).
300:  */
301: export function getAuthToken(): string | undefined {
302:   if (cachedAuthToken !== undefined) {
303:     return cachedAuthToken.value;
304:   }
305:   const value = computeAuthToken();
306:   cachedAuthToken = { value };
307:   return value;
308: }
309: 
310: function computeAuthToken(): string | undefined {
311:   const forceEnv = getEnv().SENTRY_FORCE_ENV_TOKEN?.trim();
312:   if (forceEnv) {
313:     const envToken = ...

{"body":"When only `SENTRY_AUTH_TOKEN` is set (an `sntrys_` org-auth token embedding a custom instance URL, e.g. `http://localhost:8000`) and no `SENTRY_URL`/`SENTRY_HOST`/`--url` is provided, commands such as `sentry debug-files upload` fail with:\n\n```\nError: Credentials: https://sentry.io\nRefusing to route requests here because it doesn't match the host your Sentry credentials are for (http://localhost:8000).\nTo use this host, run: sentry auth login --url https://sentry.io\nTo keep using your current credentials, remove this URL override.\n```\n\nRunning `sentry auth logout` first does not help; the same error persists.\n\nRoot cause (source-verified):\n- `getConfiguredSentryUrl()` in `packages/cli/src/lib/constants.ts` (used by `getApiBaseUrl()`/`getControlSiloUrl()` in `lib/sentry-client.ts`) only reads `SENTRY_HOST`/`SENTRY_URL` and otherwise falls back to `DEFAULT_SENTRY_URL` (`https://sentry.io`). It never consults the `sntrys_` token's embedded `url` claim.\n- Separately, ...

Found 29 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-claims.ts:
  Line 11:  * modify the token bytes). `captureEnvTokenHost` uses the claim as the


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/constants.ts:
  Line 22: export const DEFAULT_SENTRY_HOST = "sentry.io";

  Line 25: export const DEFAULT_SENTRY_URL = `https://${DEFAULT_SENTRY_HOST}`;

  Line 41:  * Users commonly set `SENTRY_HOST=sentry.example.com` without a protocol.


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentryclirc.ts:
  Line 13:  * The env shim ({@link applySentryCliRcEnvShim}) maps `token` → `SENTRY_AUTH_TOKEN`

  Line 340: export async function applySentryCliRcEnvShim(cwd: string): Promise<void> {

  Line 360:     env.SENTRY_URL = ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/cli.ts</path>
<type>file</type>
<content>
1: /**
2:  * CLI runner with fast-path dispatch.
3:  *
4:  * Shell completion (`__complete`) is dispatched before any heavy imports
5:  * to avoid loading `@sentry/node-core` (~280ms). All other commands go through
6:  * the full CLI with telemetry, middleware, and error recovery.
7:  *
8:  * Extracted from `bin.ts` so the logic is testable and reusable without
9:  * top-level side effects. `bin.ts` remains a thin wrapper that registers
10:  * stream error handlers and calls `startCli()`.
11:  */
12: 
13: import { getEnv } from "./lib/env.js";
14: import { CliError } from "./lib/errors.js";
15: import { initTimezone } from "./lib/timezone.js";
16: 
17: /**
18:  * Preload project context: walk up from `cwd` once, finding both the
19:  * project root (for DSN detection) and `.sentryclirc` config (for
20:  * org/project defaults ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/defaults.ts</path>
<type>file</type>
<content>
1: /**
2:  * Persistent CLI defaults stored in the metadata KV table.
3:  *
4:  * All defaults use metadata keys prefixed with `defaults.`:
5:  * - `defaults.org` — default organization slug
6:  * - `defaults.project` — default project slug
7:  * - `defaults.telemetry` — telemetry preference (`"on"` / `"off"`)
8:  * - `defaults.url` — Sentry instance URL (for self-hosted)
9:  */
10: 
11: import { getDatabase } from "./index.js";
12: import { clearMetadata, getMetadata, setMetadata } from "./utils.js";
13: 
14: const DEFAULTS_ORG = "defaults.org";
15: const DEFAULTS_PROJECT = "defaults.project";
16: const DEFAULTS_TELEMETRY = "defaults.telemetry";
17: const DEFAULTS_URL = "defaults.url";
18: const DEFAULTS_HEADERS = "defaults.headers";
19: const DEFAULTS_CA_CERT = "defaults.ca-cert";
20: 
21: /** All metadata keys ...

diff --git a/packages/cli/src/lib/constants.ts b/packages/cli/src/lib/constants.ts
index 4e707773a..843b7dcb1 100644
--- a/packages/cli/src/lib/constants.ts
+++ b/packages/cli/src/lib/constants.ts
@@ -64,15 +64,15 @@ export function normalizeUrl(url: string | undefined): string | undefined {
 }
 
 /**
- * Resolve the Sentry instance URL from environment variables.
- * Checks SENTRY_HOST first, then SENTRY_URL, then falls back to undefined.
+ * Resolve the Sentry instance URL from explicit environment configuration.
+ * Checks `SENTRY_HOST` first, then `SENTRY_URL`, and otherwise returns undefined.
  *
  * Bare hostnames (e.g., `sentry.example.com`) are automatically prefixed
  * with `https://` to prevent invalid URL construction downstream.
  */
 export function getConfiguredSentryUrl(): string | undefined {
-  const raw = getEnv().SENTRY_HOST || getEnv().SENTRY_URL || undefined;
-  return normalizeUrl(raw);
+  const env = getEnv();
+  return normalizeUrl(env.SENTRY_HOST) ?? ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Defense-in-depth: `sntrys_` token claim vs request-origin mismatch.
3:  *
4:  * The fetch-layer guard refuses to attach a `sntrys_` token when its
5:  * embedded `url` claim disagrees with the request origin. Defends users
6:  * with access to multiple Sentry instances against routing one
7:  * instance's token to another. Claim is unsigned (see token-claims.ts),
8:  * so this catches honest misconfigurations more than malicious attacks.
9:  */
10: 
11: import { afterEach, beforeEach, describe, expect, test } from "vitest";
12: import {
13:   extractFetchUrl,
14:   mintSntrysToken,
15:   resetHostScopingState,
16:   useEnvSandbox,
17:   useTestConfigDir,
18: } from "../../helpers.js";
19: 
20: const ENV_KEYS = [
21:   "SENTRY_AUTH_TOKEN",
22:   "SENTRY_TOKEN",
23:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts</path>
<type>file</type>
<content>
481: 
482:   test("forged claim url is captured (claim is NOT a security primitive)", async () => {
483:     // Documents the trust contract: the snapshot picks up whatever the
484:     // claim says, even if forged. This is acceptable because:
485:     // - For a legitimate token, the url is authoritative.
486:     // - For a forged token (user pasted attacker's token), the user
487:     //   has already authorized the attacker server — out of threat
488:     //   model.
489:     process.env.SENTRY_AUTH_TOKEN = mintSntrysToken({
490:       iat: 1_700_000_000,
491:       url: "https://evil.com",
492:       org: "victim",
493:     });
494: 
495:     const { captureEnvTokenHost, getEnvTokenHost } = await import(
496:       "../../../src/lib/env-token-host.js"
497:     );
498:     ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/region.ts</path>
<type>file</type>
<content>
1: /**
2:  * Region resolution for multi-region Sentry support.
3:  *
4:  * Provides utilities to resolve the correct region URL for an organization,
5:  * using cached data when available or fetching from the API when needed.
6:  */
7: 
8: import { getOrganization } from "@sentry/api";
9: import { getConfiguredSentryUrl } from "./constants.js";
10: import { getOrgByNumericId, getOrgRegion, setOrgRegion } from "./db/regions.js";
11: import { stripDsnOrgPrefix } from "./dsn/index.js";
12: import { withAuthGuard } from "./errors.js";
13: import { getApiBaseUrl, getSdkConfig } from "./sentry-client.js";
14: import { isSentrySaasUrl } from "./sentry-urls.js";
15: 
16: /**
17:  * Promise cache for org region resolution, keyed by orgSlug. ...

Found 1 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/region.ts:
  Line 111: export function isMultiRegionEnabled(): boolean {

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/organizations.ts</path>
<type>file</type>
<content>
1: /**
2:  * Organization API functions
3:  *
4:  * CRUD operations and region discovery for Sentry organizations.
5:  */
6: 
7: import {
8:   getOrganization as sdkGetOrganization,
9:   listOrganizations as sdkListOrganizations,
10: } from "@sentry/api";
11: 
12: import {
13:   type Region,
14:   type SentryOrganization,
15:   type UserRegionsResponse,
16:   UserRegionsResponseSchema,
17: } from "../../types/index.js";
18: 
19: import { ApiError } from "../errors.js";
20: import {
21:   getApiBaseUrl,
22:   getControlSiloUrl,
23:   getSdkConfig,
24: } from "../sentry-client.js";
25: 
26: import {
27:   API_MAX_PER_PAGE,
28:   apiRequestToRegion,
29:   autoPaginate,
30:   getOrgSdkConfig,
31:   MAX_PAGINATION_PAGES,
32:   type PaginatedResponse,
33:   unwrapPaginatedResult,
34:   unwrapResult,
35: } from ...

Found 100 matches (more matches available)
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/types/oauth.test.ts:
  Line 13:     access_token: "sntrys_abc123",


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/helpers.ts:
  Line 200:  * Mint a `sntrys_<base64-payload>_<secret>` token shape for tests, matching

  Line 207: export function mintSntrysToken(payload: Record<string, unknown>): string {

  Line 210:   return `sntrys_${b64}_test-secret-tail`;


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/preload.ts:
  Line 106: process.env.SENTRY_AUTH_TOKEN = "sntrys_test-token-for-unit-tests_000000";


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/token-type.property.test.ts:
  Line 15:     test("any string starting with ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-claims.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry Org-Auth-Token (`sntrys_`) Claim Extraction
3:  *
4:  * Format: `sntrys_<base64(JSON{iat, url, region_url, org})>_<random-secret>`
5:  * (server-side: getsentry/sentry `orgauthtoken_token.py`).
6:  *
7:  * The claim is **NOT signed** — anyone can forge a `sntrys_` string with any
8:  * `url`. However, for legitimate tokens the claim IS authoritative: the real
9:  * server wrote it at issuance time, and it's immune to env-injection attacks
10:  * (the attacker who can poison `SENTRY_HOST` via `$GITHUB_ENV` can't read or
11:  * modify the token bytes). `captureEnvTokenHost` uses the claim as the
12:  * primary trust source for `sntrys_` tokens, ahead of env vars. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-urls.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry URL Utilities
3:  *
4:  * Utilities for constructing Sentry web URLs.
5:  * Supports self-hosted instances via SENTRY_URL environment variable.
6:  */
7: 
8: import {
9:   DEFAULT_SENTRY_HOST,
10:   DEFAULT_SENTRY_URL,
11:   getConfiguredSentryUrl,
12:   normalizeUrl,
13: } from "./constants.js";
14: 
15: /**
16:  * Get the Sentry web base URL.
17:  * Supports self-hosted instances via SENTRY_URL env var.
18:  */
19: export function getSentryBaseUrl(): string {
20:   return getConfiguredSentryUrl() ?? DEFAULT_SENTRY_URL;
21: }
22: 
23: /**
24:  * Build the org-scoped base URL using the subdomain pattern.
25:  * E.g. "https://sentry.io" + "my-org" → "https://my-org.sentry.io"
26:  *
27:  * @param orgSlug - Organization slug
28:  * @returns Origin URL with org as subdomain
29:  */
30: export ...

Found 21 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/telemetry.ts:
  Line 709:     Sentry.setTag("is_self_hosted", !isSentrySaasUrl(getSentryBaseUrl()));


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-urls.ts:
  Line 19: export function getSentryBaseUrl(): string {

  Line 31:   const base = getSentryBaseUrl();

  Line 51:   return isSentrySaasUrl(getSentryBaseUrl());

  Line 164:   return `${getSentryBaseUrl()}/organizations/${orgSlug}/`;

  Line 178:   return `${getSentryBaseUrl()}/settings/${orgSlug}/projects/${projectSlug}/`;

  Line 192:   return `${getSentryBaseUrl()}/organizations/${orgSlug}/issues/${issueId}/`;

  Line 207:   return `${getSentryBaseUrl()}/organizations/${orgSlug}/issues/?query=event.id:${eventId}`;

  Line 222:     : `${getSentryBaseUrl()}/settings/${orgSlug}/`;

  Line 236:   return ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
1: /**
2:  * Authentication credential storage (single-row table pattern).
3:  */
4: 
5: import { createHash } from "node:crypto";
6: import { DEFAULT_SENTRY_URL, getConfiguredSentryUrl } from "../constants.js";
7: import { getEnv } from "../env.js";
8: import { getEnvTokenHost } from "../env-token-host.js";
9: import { logger } from "../logger.js";
10: import { normalizeOrigin } from "../sentry-urls.js";
11: import { withDbSpan } from "../telemetry.js";
12: import { getDatabase } from "./index.js";
13: import { clearAllIssueOrgCache } from "./issue-org-cache.js";
14: import { clearTrustedHostState } from "./regions.js";
15: import { runUpsert } from "./utils.js";
16: 
17: /** Refresh when less than 10% of token lifetime remains */
18: export const REFRESH_THRESHOLD = 0.1;
19: 
20: /** Default token lifetime (1 hour) ...

Found 23 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts:
  Line 22: export const CURRENT_SCHEMA_VERSION = 17;

  Line 72:       // Origin URL (scheme://host[:port]) this token was issued against.

  Line 74:       // whose origin matches this host (with SaaS equivalence). Nullable for

  Line 76:       host: { type: "TEXT", addedInVersion: 16 },

  Line 164:   org_regions: {

  Line 584:         CURRENT_SCHEMA_VERSION

  Line 722:       CURRENT_SCHEMA_VERSION

  Line 747:   // Migration 1 -> 2: Add org_regions, user_info, and instance_info tables

  Line 750:       ${EXPECTED_TABLES.org_regions};

  Line 799:   // Migration 7 -> 8: Add org_id column to org_regions for numeric ID lookups

  Line 801:     addColumnIfMissing(db, "org_regions", "org_id", "TEXT");

  Line 804:   // Migration 8 -> 9: Add org_name column to org_regions for cached org listing

  Line 806:     addColumnIfMissing(db, ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
55:   schema_version: {
56:     columns: {
57:       version: { type: "INTEGER", primaryKey: true },
58:     },
59:   },
60:   auth: {
61:     columns: {
62:       id: { type: "INTEGER", primaryKey: true, check: "id = 1" },
63:       token: { type: "TEXT" },
64:       refresh_token: { type: "TEXT" },
65:       expires_at: { type: "INTEGER" },
66:       issued_at: { type: "INTEGER" },
67:       updated_at: {
68:         type: "INTEGER",
69:         notNull: true,
70:         default: "(unixepoch() * 1000)",
71:       },
72:       // Origin URL (scheme://host[:port]) this token was issued against.
73:       // Enforced at the fetch layer: credentials are only attached to requests
74:       // whose origin matches this host (with SaaS equivalence). ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
840:       db.query(
841:         "INSERT OR REPLACE INTO metadata (key, value) VALUES (?, ?)"
842:       ).run("defaults.org", row.organization);
843:     }
844:     if (row?.project) {
845:       db.query(
846:         "INSERT OR REPLACE INTO metadata (key, value) VALUES (?, ?)"
847:       ).run("defaults.project", row.project);
848:     }
849:     db.exec("DROP TABLE defaults");
850:   }
851: 
852:   // Migration 13 -> 14: Add repo_cache table for offline Sentry repository
853:   // lookups (used by `issue resolve --in @commit` to match git origin →
854:   // Sentry-registered repo without an extra API round trip).
855:   if (currentVersion < 14) {
856:     db.exec(EXPECTED_TABLES.repo_cache as string);
857:   }
858: 
859:   // Migration 14 -> 15: Add issue_org_cache table for numeric-id → org
860:   // mappings ...

Found 16 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/commands/auth/logout.test.ts:
  Line 149:   test("OAuth source with env var set: clears stored OAuth (env var still present)", async () => {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts:
  Line 179:   test("stored OAuth host takes precedence over an inactive env token claim", async () => {

  Line 207:   test("forced env token claim takes precedence over stored OAuth", async () => {

  Line 240:   test("forced env token never uses a region cached for stored OAuth", async () => {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/auth-hint.test.ts:
  Line 6:  * - Hint fires when env token + stored OAuth coexist. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/auth.host.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for host-scoped auth: setAuthToken persistence, getStoredAuthHost,
3:  * NULL-host lazy migration, host preservation across refresh-style updates.
4:  */
5: 
6: import { describe, expect, test } from "vitest";
7: import {
8:   getStoredAuthHost,
9:   hasUsableStoredToken,
10:   setAuthToken,
11: } from "../../../src/lib/db/auth.js";
12: import { getDatabase } from "../../../src/lib/db/index.js";
13: import { useTestConfigDir } from "../../helpers.js";
14: 
15: describe("db/auth host scoping", () => {
16:   useTestConfigDir("auth-host-test-");
17: 
18:   test("setAuthToken persists explicit host", () => {
19:     setAuthToken("tok-1", undefined, undefined, {
20:       host: "https://sentry.acme.com",
21:     });
22:     expect(getStoredAuthHost()).toBe("https://sentry.acme.com");
23:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/auth.host.test.ts</path>
<type>file</type>
<content>
143:   test("lazy migration: ignores rc-poisoned current env (uses boot snapshot instead)", async () => {
144:     // Critical regression: previously migration called getConfiguredSentryUrl()
145:     // which reads CURRENT env. If .sentryclirc shim wrote env.SENTRY_URL
146:     // before migration fired, the token would be migrated to the
147:     // rc-sourced (potentially attacker) host. Now migration uses the
148:     // boot snapshot so rc writes don't affect it.
149:     const db = getDatabase();
150:     db.query(
151:       "INSERT OR REPLACE INTO auth (id, token, host, updated_at) VALUES (1, 'legacy-token', NULL, ?)"
152:     ).run(Date.now());
153: 
154:     const { captureEnvTokenHost, resetEnvTokenHostForTesting } = await import(
155:       "../../../src/lib/env-token-host.js"
156:     );
157:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/helpers.ts</path>
<type>file</type>
<content>
90:  * Sets up an isolated test config directory with proper env var lifecycle.
91:  *
92:  * Registers beforeEach/afterEach hooks that create a unique config directory,
93:  * point SENTRY_CONFIG_DIR at it, and restore the original value on teardown.
94:  * This eliminates the fragile pattern of manually managing process.env in
95:  * each test file, which caused cross-file pollution when afterEach hooks
96:  * deleted the env var while other files were still loading.
97:  *
98:  * Must be called at module scope or inside a describe() block.
99:  *
100:  * @param prefix - Directory name prefix for the temp directory
101:  * @param options - Configuration options (e.g., isolateProjectRoot)
102:  * @returns Getter function for the current test's config directory path
103:  */
104: export function useTestConfigDir(
105:   ...

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli


 Test Files  1 passed (1)
      Tests  15 passed (15)
   Start at  16:09:30
   Duration  3.44s (transform 2.08s, setup 90ms, import 1.89s, tests 1.25s, environment 0ms)

Found 63 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/token-host.test.ts:
  Line 7:  * cover well (exact edge strings, malformed inputs).

  Line 43:   test("returns undefined for malformed input", () => {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/token-claims.property.test.ts:
  Line 12:  * 4. Adversarial inputs (random strings, near-prefix matches, malformed


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentryclirc.test.ts:
  Line 292:   test("assertRcUrlTrusted throws when non-SaaS rc url does not match active token's scoped host", async () => {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentry-url-parser.test.ts:
  Line 37:     test("malformed URL", () => {

  Line 504:    ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/constants.test.ts</path>
<type>file</type>
<content>
120:       process.env.SENTRY_HOST = originalHost;
121:     } else {
122:       delete process.env.SENTRY_HOST;
123:     }
124:     if (originalUrl !== undefined) {
125:       process.env.SENTRY_URL = originalUrl;
126:     } else {
127:       delete process.env.SENTRY_URL;
128:     }
129:   });
130: 
131:   test("returns undefined when no env vars set", () => {
132:     delete process.env.SENTRY_HOST;
133:     delete process.env.SENTRY_URL;
134:     expect(getConfiguredSentryUrl()).toBeUndefined();
135:   });
136: 
137:   test("normalizes bare SENTRY_HOST", () => {
138:     process.env.SENTRY_HOST = "sentry.example.com";
139:     delete process.env.SENTRY_URL;
140:     expect(getConfiguredSentryUrl()).toBe("https://sentry.example.com");
141:   });
142: 
143:   test("normalizes bare SENTRY_URL", () => {
144:    ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentryclirc.ts</path>
<type>file</type>
<content>
320:     throw error;
321:   });
322:   cache.set(cwd, promise);
323:   return promise;
324: }
325: 
326: /**
327:  * Apply env shim for `.sentryclirc` token and URL fields.
328:  *
329:  * Maps config file values to environment variables so the existing
330:  * auth and URL resolution code picks them up without changes:
331:  * - `[auth] token` → `SENTRY_AUTH_TOKEN` (if neither `SENTRY_AUTH_TOKEN` nor `SENTRY_TOKEN` is set)
332:  * - `[defaults] url` → `SENTRY_URL` (if both `SENTRY_HOST` and `SENTRY_URL` are unset)
333:  *
334:  * The URL is applied unconditionally at boot — the trust check is deferred
335:  * to {@link assertRcUrlTrusted}, which `buildCommand` calls after Stricli
336:  * identifies the command (so the command can opt out via `skipRcUrlCheck`). ...

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Migrated stored credentials to host-scoped model: https://legacy-configured.example.com
[info] [auth] Migrated stored credentials to host-scoped model: https://sentry.io
[info] [auth] Migrated stored credentials to host-scoped model: https://sentry.io
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  3 passed (3)
      Tests  48 passed (48)
   Start at  16:11:18
   Duration  4.60s (transform 4.35s, setup 193ms, import 4.88s, tests 2.25s, environment 0ms)

 M .lore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/event.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/explore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/feedback.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/issue.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/log.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/replay.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/span.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/trace.md
 M packages/cli/src/commands/org/list.ts
 M packages/cli/src/commands/project/delete.ts
 M packages/cli/src/lib/api/organizations.ts
 M packages/cli/src/lib/api/projects.ts
 M packages/cli/src/lib/constants.ts
 M packages/cli/src/lib/db/regions.ts
 M packages/cli/src/lib/db/schema.ts
 M packages/cli/src/lib/oauth.ts
 M ...