Dashboard › cli › Session 0om8pjD0q6Q7
0om8pjD0q6Q7tNTHYConduct a fresh independent, read-only security/pentest review of getsentry/cli PR #1558 in /home/byk/Code/getsentry/cli-pr-1558. Two prior reviewer attempts returned empty output, so a substantive report is mandatory. Do not edit files, commit, fetch, switch branches, or mutate VCS state. Immutable target: base bd065083c3b82677747b97a6cc7f5cf57532d3bc, head fc5d50e2324e2b6bb2067976bf1515dab45224fb, expected SHA-256 for git diff base...head is 03c5772e78b393b3979c44754709d7f401bb37a71e5679b34c50a9cc8334c2d0. Verify base/head, clean worktree, and hash before and after; report BLOCKED if any differ.
Inspect every changed file and relevant surrounding code. Threat-model: repository-owned CommandDocumentation.examples through Stricli/native help, CommandInfo JSON, website/skill Markdown generators, generated references, and embedded skill content; escaping of Markdown fences/backticks/template substitutions/control characters; command/shell execution; credential or binary leakage; weakening of fragment validation; docs type widening and runtime behavior. Review agent-conversation input parsing, malformed slash targets, fielded errors, URL/API call prevention, organization scoping. Review .github/workflows/pr-risk.yml under attacker-controlled fork metadata: exact GitHub expression behavior and action input serialization, permissions, secret exposure, code checkout/execution, same-repository labels, fork labels disabled, risk scoring and artifact upload retained, and whether it deterministically fixes the observed 403.
Existing exact-head validation passed: focused 155 tests, full 453 files/9,495 passed/16 skipped, typecheck and generation (112 commands), Biome 1,030 files, no runtime deps, fragment validation except one pre-existing ProGuard warning, property test 10/10. Do not rerun the full suite.
Return findings first by severity. Every item must be PASS, FAIL, CONCERN, MUST-FIX, or BLOCKED, with exact current file:line evidence. ...
/home/byk/Code/getsentry/cli-pr-1558/.lore.md /home/byk/Code/getsentry/cli-pr-1558/.git /home/byk/Code/getsentry/cli-pr-1558/AGENTS.md
<path>/home/byk/Code/getsentry/cli-pr-1558/AGENTS.md</path> <type>file</type> <content> 1: # Jared (Outpost agent) 2: 3: Autonomous GitHub coding agent. Work in `/workspace/repo`. 4: 5: ## Model tiers 6: 7: The primary model is chosen per event (see `src/agents/models.ts`): heavy for 8: code-producing situations, cheaper for lightweight ones. 9: 10: | Role | Subagent | Model | 11: | --- | --- | --- | 12: | Triage / plan / review (heavy) | (primary Jared) | Claude Opus 4.8 | 13: | Triage / plan / review (light) | (primary Jared) | xAI Grok 4.3 | 14: | Explore | `explore` | OpenAI gpt-5-mini | 15: | Implement | `implement` | Moonshot kimi-k2.7-code | 16: | Ship (commit/push/PR) | `ship` | xAI Grok (`grok-build-0.1`) | 17: 18: Pipeline: triage → explore → plan → implement → review → ship. 19: (`worker` is a deprecated alias of `implement`.) 20: 21: Operators also talk to Jared directly from the Outpost dashboard. ...
<path>/home/byk/Code/getsentry/cli-pr-1558/.lore.md</path>
<type>file</type>
<content>
1: <!-- Managed by lore (https://github.com/BYK/loreai) — manual edits are imported on next session. -->
2:
3: ## Long-term Knowledge
4:
5: ### Architecture
6:
7: <!-- lore:01a02357-f0a8-7fdb-9e9d-b0710cfe65c9 -->
8: * **API output binary and HTTP contracts**: Always preserve strict output-mode and binary-safety contracts. `sentry api` must preserve `rawApiRequest()` status text; empty textual non-2xx bodies must produce an HTTP status/request fallback, and JSON mode must expose `{status, statusText, body}` so empty success and error responses are distinguishable. Binary `Uint8Array` successes bypass formatters and remain raw; binary errors emit only status/content-type/byte-count summaries, never bytes or JSON coercion. Prompts must never block scripted runs or interleave with stdout JSON.
9:
10: <!-- lore:019ef480-47f1-7708-80cb-514ac37a3fde -->
11: * **@sentry/symbolic 13.4.0 API surface: ...
fc5d50e2324e2b6bb2067976bf1515dab45224fb bd065083c3b82677747b97a6cc7f5cf57532d3bc fc5d50e2324e2b6bb2067976bf1515dab45224fb bd065083c3b82677747b97a6cc7f5cf57532d3bc 03c5772e78b393b3979c44754709d7f401bb37a71e5679b34c50a9cc8334c2d0 -
M .github/workflows/pr-risk.yml M apps/cli-docs/src/fragments/commands/agent-conversation.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/SKILL.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/agent-conversation.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/alert.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/cli.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/explore.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/feedback.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/init.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/issue.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/monitor.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/org.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/project.md M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/release.md M packages/cli/plugins/sentry-cli/s...
...output truncated...
Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_08776896d001YEkgMVV2t5Q6CI
*
* Similarly, when a command already defines its own `json` flag (e.g. for
* custom brief text), the injected `JSON_FLAG` is skipped. `--fields` is
* always injected when `output: { human: ... }` regardless.
*
* Flag keys use kebab-case because Stricli uses the literal object key as
* the CLI flag name (e.g. `"log-level"` → `--log-level`).
*
* @param builderArgs - Same shape as Stricli's buildCommand arguments,
* plus an optional `output` mode
* @returns A fully-wrapped Stricli Command
*/
/**
* Build the `--fields` flag definition, enriched with available field names
* when a schema is registered on the output config.
*/
// biome-ignore lint/suspicious/noExplicitAny: OutputConfig type is erased at the builder level
function buildFieldsFlag(outputConfig?: OutputConfig<any>) {
if (!outputConfig?.schema) {
return ...
diff --git a/.github/workflows/pr-risk.yml b/.github/workflows/pr-risk.yml
index 2a1bd3c76..dc8359b2d 100644
--- a/.github/workflows/pr-risk.yml
+++ b/.github/workflows/pr-risk.yml
@@ -1,36 +1,36 @@
name: PR Risk Experiment
on:
pull_request:
types: [opened, synchronize, reopened, ready_for_review]
permissions:
contents: read
pull-requests: write
issues: write
concurrency:
group: pr-risk-${{ github.event.pull_request.number }}
cancel-in-progress: true
jobs:
risk:
name: Score PR risk
runs-on: ubuntu-latest
if: github.event.pull_request.draft == false
steps:
- name: Score current PR
uses: getsentry/pr-risk-action@v0
with:
repo: ${{ github.repository }}
pr-number: ${{ github.event.pull_request.number }}
result-path: risk-pr-result.json
skip-reviews: "true"
- apply-label: "true"
+ apply-label: ${{ github.event.pull_request.head.repo.full_name ...
Found 2 matches
/home/byk/Code/getsentry/cli-pr-1558/.github/workflows/pr-risk.yml:
Line 24: uses: getsentry/pr-risk-action@v0
Line 30: apply-label: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
Found 17 matches
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/command.ts:
Line 98: export type CommandExample = {
Line 107: * `customUsage` is present, its first line is the canonical signature suffix;
Line 110: export type CommandDocumentation =
Line 113: readonly examples?: readonly CommandExample[];
Line 154: readonly docs: CommandDocumentation;
Line 421: docs: CommandDocumentation,
Line 424: ): CommandDocumentation {
Line 441: function prepareNativeDocs(
Line 442: docs: CommandDocumentation
Line 459: function attachDocumentationMetadata(
Line 461: docs: CommandDocumentation
Line 464: const primaryUsage = docs.customUsage?.[0];
Line 470: metadata.__examples = docs.examples;
Line 563: const stricliDocs = enrichDocsWithSchema(
Line 564: prepareNativeDocs(builderArgs.docs),
Line 885: docs: stricliDocs,
Line 890: attachDocumentationMetadata(cmd, builderArgs.docs);
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/command.ts</path> <type>file</type> <content> 70: /** 71: * Parse a string input as a number. 72: * Re-exported from Stricli for convenience. 73: */ 74: export const numberParser = stricliNumberParser; 75: 76: /** Base flags type from Stricli */ 77: type BaseFlags = Readonly<Partial<Record<string, unknown>>>; 78: 79: /** Base args type from Stricli */ 80: type BaseArgs = readonly unknown[]; 81: 82: /** 83: * Type-erased Stricli builder arguments. 84: * 85: * At the `stricliCommand()` call site we've modified both `parameters` 86: * (injected hidden flags) and `func` (wrapped with telemetry/output 87: * logic), which breaks the original `FLAGS`/`ARGS` generic alignment 88: * that Stricli's `CommandBuilderArguments` enforces via `NoInfer`. ...
/home/byk/Code/getsentry/cli-pr-1558/AGENTS.md /home/byk/Code/getsentry/cli-pr-1558/packages/cli/CONTRIBUTING.md /home/byk/Code/getsentry/cli-pr-1558/packages/cli/AGENTS.md
No files found
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/CONTRIBUTING.md</path> <type>file</type> <content> 1: # Contributing to Sentry CLI 2: 3: This guide documents the patterns and conventions used in this CLI for consistency. 4: 5: ## Command Patterns 6: 7: We follow [gh CLI](https://cli.github.com/) conventions for best-in-class developer experience. 8: 9: ### List Commands 10: 11: List commands use **optional positional arguments** for context with smart auto-detection. 12: 13: ```bash 14: sentry org list [--limit N] [--json] 15: sentry project list [org] [--limit N] [--json] 16: sentry issue list [<org>/<project>] [--json] 17: ``` 18: 19: **Target syntax**: 20: - `<org>/<project>` - Explicit organization and project (e.g., `my-org/frontend`) 21: - `<org>/` - All projects in the specified organization 22: - `<project>` - Search for project by name across all accessible organizations 23: - *(omit)* - Auto-detect from DSN or config 24: 25: **Rationale**: Positional ...
No files found
No files found
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/node_modules</path> <type>directory</type> <entries> .bin/ .vite-temp/ .vite/ @anthropic-ai/ @biomejs/ @clack/ @hono/ @mastra/ @sentry/ @spotlightjs/ @stricli/ @types/ @vitest/ binpatch/ chalk/ cli-highlight/ consola/ esbuild/ fast-check/ fflate/ fossilize/ hono/ http-cache-semantics/ ignore/ ink-spinner/ ink/ jpeg-js/ marked/ node-sqlite3-wasm/ p-limit/ peggy/ picomatch/ pixelmatch/ pngjs/ pretty-ms/ qrcode-terminal/ react-devtools-core/ react/ semver/ string-width/ tinyglobby/ tsx/ typescript/ ultracite/ uuidv7/ valibot/ vitest/ wrap-ansi/ (48 entries) </entries>
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/node_modules/@stricli</path> <type>directory</type> <entries> auto-complete/ core/ (2 entries) </entries>
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/node_modules/@stricli/core</path> <type>directory</type> <entries> dist/ package.json README.md (3 entries) </entries>
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/node_modules/@stricli/core/package.json</path>
<type>file</type>
<content>
1: {
2: "name": "@stricli/core",
3: "version": "1.2.8",
4: "description": "Build complex CLIs with type safety and no dependencies",
5: "license": "Apache-2.0",
6: "repository": {
7: "type": "git",
8: "url": "https://github.com/bloomberg/stricli/tree/main/packages/core"
9: },
10: "author": "Michael Molisani <mmolisani@bloomberg.net>",
11: "files": [
12: "dist"
13: ],
14: "type": "module",
15: "exports": {
16: "import": "./dist/index.js",
17: "require": "./dist/index.cjs"
18: },
19: "types": "dist/index.d.ts",
20: "scripts": {
21: "format": "prettier --config ../../.prettierrc -w .",
22: "format:check": "prettier --config ../../.prettierrc -c .",
23: "lint": "eslint src tests",
24: "lint:fix": "eslint src tests --fix",
25: ...
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/node_modules/@stricli/core/dist</path> <type>directory</type> <entries> index.cjs index.d.cts index.d.ts index.js (4 entries) </entries>
Found 100 matches (more matches available)
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/node_modules/@stricli/core/dist/index.js:
Line 1070: usage: "USAGE",
Line 1081: help: "Print help information and exit",
Line 1082: helpAll: "Print help information (including hidden commands/flags) and exit",
Line 1268: let helpRequested = false;
Line 1271: // (e.g. `mycli sub --version`). Mirrors `helpRequested`; the app decides how
Line 1284: if (!treatInputsAsArguments && !target && expectTopLevelFlagValue && input !== "--help" && input !== "-h" && input !== "--helpAll" && input !== "--help-all" && input !== "--version") {
Line 1290: if (input === "--help" || input === "-h") {
Line 1291: helpRequested = true;
Line 1296: } else if (input === "--helpAll" || input === "--help-all") {
Line 1297: helpRequested = "all";
Line 1356: if (target.kind === RouteMapSymbol && !helpRequested) {
Line 1368: ...
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/node_modules/@stricli/core/dist/index.js</path>
<type>file</type>
<content>
1980: if (def.optional) {
1981: name = `[${name}]`;
1982: } else if (atLeastOneOptional) {
1983: name = ` ${name}`;
1984: }
1985: if (def.default) {
1986: const defaultKeyword = args.ansiColor ? `\x1B[2m${keywords.default}\x1B[22m` : keywords.default;
1987: suffix = `[${defaultKeyword} ${def.default}]`;
1988: }
1989: return [
1990: args.ansiColor ? `\x1B[1m${name}\x1B[22m` : name,
1991: args.ansiColor ? `\x1B[3m${def.brief}\x1B[23m` : def.brief,
1992: suffix ?? ""
1993: ];
1994: }),
1995: [" ", " "]
1996: );
1997: }
1998:
1999: // src/routing/command/documentation.ts
2000: function* generateCommandHelpLines(parameters, docs, args) {
2001: const { brief, fullDescription, customUsage } = docs;
2002: const { headers } = args.text;
2003: const ...
Found 2 matches
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/node_modules/@stricli/core/dist/index.d.ts:
Line 1411: interface CommandDocumentation {
Line 1423: readonly customUsage?: readonly (string | CustomUsage)[];
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/node_modules/@stricli/core/dist/index.d.ts</path> <type>file</type> <content> 1370: readonly InternalError: -1; 1371: /** 1372: * Command executed successfully. 1373: */ 1374: readonly Success: 0; 1375: /** 1376: * Command module unexpectedly threw an error. 1377: */ 1378: readonly CommandRunError: 1; 1379: }; 1380: 1381: /** 1382: * Parses input strings as booleans. 1383: * Transforms to lowercase and then checks against "true" and "false". 1384: */ 1385: declare const booleanParser: (input: string) => boolean; 1386: /** 1387: * Parses input strings as booleans (loosely). ...
Found 12 matches
/home/byk/Code/getsentry/cli-pr-1558/package.json:
Line 46: "patchedDependencies": {
Line 47: "@stricli/core@1.2.8": "packages/cli/patches/@stricli%2Fcore@1.2.8.patch",
/home/byk/Code/getsentry/cli-pr-1558/pnpm-lock.yaml:
Line 22: patchedDependencies:
Line 29: '@stricli/core@1.2.8':
Line 194: '@stricli/core':
Line 2173: '@stricli/core@1.2.8':
Line 2176: '@stricli/core@1.3.0':
Line 7286: '@stricli/core': 1.3.0
Line 7288: '@stricli/core@1.2.8(patch_hash=892258f886d48063b409e0ac6141260023c396d1ed4f915231701f6a34edffcc)': {}
Line 7290: '@stricli/core@1.3.0': {}
Line 8419: '@stricli/core': 1.2.8(patch_hash=892258f886d48063b409e0ac6141260023c396d1ed4f915231701f6a34edffcc)
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/package.json:
Line 102: "@stricli/core": "1.2.8",
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/patches/@stricli%2Fcore@1.2.8.patch</path>
<type>file</type>
<content>
1: diff --git a/dist/index.cjs b/dist/index.cjs
2: index a9afbc1ab78cad7ba97d53882a80236af62854df..141532779be923b8f3b421b0afc031b5ea209e29 100644
3: --- a/dist/index.cjs
4: +++ b/dist/index.cjs
5: @@ -1277,6 +1277,35 @@ var RouteMapSymbol = Symbol("RouteMap");
6: var CommandSymbol = Symbol("Command");
7:
8: // src/routing/scanner.ts
9: +// PATCH(getsentry/cli): pluggable top-level (global) flags allow-list.
10: +// Stricli only parses flags at the leaf command, so a flag placed before the
11: +// subcommand (e.g. `mycli --verbose sub cmd`) is treated as an unknown route
12: +// segment and fails route resolution. When the host application declares a
13: +// `scanner.topLevelFlags` allow-list, `buildRouteScanner` recognizes those
14: +// flags at any route depth and forwards them (and, for value-taking flags,
15: +// their value) to the leaf command via ...
diff --git a/packages/cli/script/check-fragments.ts b/packages/cli/script/check-fragments.ts
index 36db22e1d..6384a649d 100644
--- a/packages/cli/script/check-fragments.ts
+++ b/packages/cli/script/check-fragments.ts
@@ -166,148 +166,151 @@ function fragmentMentionsSubcommand(
const lower = content.toLowerCase();
// Check 1: Full CLI reference anywhere (code blocks, backticks, prose)
if (lower.includes(fullCliRef.toLowerCase())) {
return true;
}
// Check 2: For default commands, bare `sentry <route>` (not followed by a subcommand) counts.
// Use a regex with word boundary to avoid matching `sentry issue events` as `sentry issue`.
if (isDefaultCommand) {
const bareRouteRe = new RegExp(
`sentry\\s+${routeName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:\\s*$|[^\\w-])`,
"im"
);
if (bareRouteRe.test(lower)) {
return true;
}
}
// Check 3: Heading that mentions the leaf name (outside code blocks)
const proseOnly ...
Found 20 matches
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/script/generate-skill.ts:
Line 22: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
Line 23: import { access, readFile, writeFile } from "node:fs/promises";
Line 28: formatCommandExamples,
Line 43: writeFileSync(
Line 45: "export const SKILL_FILES: ReadonlyMap<string, string> = new Map();\n"
Line 100: const pkg = JSON.parse(await readFile("package.json", "utf-8"));
Line 108: const CODE_BLOCK_REGEX = /```(\w*)\n([\s\S]*?)```/g;
Line 188: const pattern = new RegExp(CODE_BLOCK_REGEX.source, CODE_BLOCK_REGEX.flags);
Line 220: const content = await readFile(fullPath, "utf-8");
Line 283: const rawContent = await readFile(fullPath, "utf-8");
Line 488: const docExamples = await loadCommandExamples(
Line 496: commands: extractRouteGroupCommands(target, routeName, docExamples),
Line 500: const examples = docExamples.get(path) ?? ...
Your first result was empty and cannot satisfy the security merge gate. Complete the read-only security/pentest review now. The immutable target was just reverified: clean worktree; base bd065083c3b82677747b97a6cc7f5cf57532d3bc; head fc5d50e2324e2b6bb2067976bf1515dab45224fb; triple-dot patch SHA-256 03c5772e78b393b3979c44754709d7f401bb37a71e5679b34c50a9cc8334c2d0. Preserve the full prior threat model. Return findings with exact file:line evidence or explicit PASS statements and residual risks. If tools prevent inspection, return BLOCKED with the exact error. Never return empty output. Reverify the immutable target after inspection. End exactly MERGE or DO-NOT-MERGE. Do not modify anything.
fc5d50e2324e2b6bb2067976bf1515dab45224fb bd065083c3b82677747b97a6cc7f5cf57532d3bc 03c5772e78b393b3979c44754709d7f401bb37a71e5679b34c50a9cc8334c2d0 -
diff --git a/packages/cli/src/commands/agent-conversation/list.ts b/packages/cli/src/commands/agent-conversation/list.ts
index 009809093..806842e71 100644
--- a/packages/cli/src/commands/agent-conversation/list.ts
+++ b/packages/cli/src/commands/agent-conversation/list.ts
@@ -1,211 +1,231 @@
/**
* sentry agent-conversation list
*
* List recent agent conversations from Sentry projects.
*/
import type { SentryContext } from "../../context.js";
import { listConversations } from "../../lib/api-client.js";
import { validateLimit } from "../../lib/arg-parsing.js";
import {
advancePaginationState,
buildPaginationContextKey,
hasPreviousPage,
resolveCursor,
} from "../../lib/db/pagination.js";
import { ContextError } from "../../lib/errors.js";
import { formatConversationTable } from "../../lib/formatters/conversation.js";
import { filterFields } from "../../lib/formatters/json.js";
import { CommandOutput } from "../../lib/formatters/output.js";
+import { ...
Found 9 matches
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/api/conversations.ts:
Line 42: * Internal helper used by {@link listConversations} for both single-page and
Line 101: export async function listConversations(
Line 119: export async function getConversationSpans(
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/commands/agent-conversation/view.ts:
Line 8: import { getConversationSpans } from "../../lib/api-client.js";
Line 135: () => getConversationSpans(org, conversationId)
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/commands/agent-conversation/list.ts:
Line 8: import { listConversations } from "../../lib/api-client.js";
Line 195: listConversations(org, {
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/api-client.ts:
Line 42: getConversationSpans,
Line 43: listConversations,
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/api/conversations.ts</path>
<type>file</type>
<content>
1: /**
2: * Agent conversations API functions
3: *
4: * Functions for listing and retrieving agent conversation data from the Sentry
5: * Explore agent conversations endpoints.
6: *
7: * The `/organizations/{org}/agents/conversations/` endpoints are PRIVATE and not
8: * yet in `@sentry/api` (getsentry/sentry-api-schema). Call them via
9: * `apiRequestToRegion` with local Valibot schemas (same pattern as `logs.ts` /
10: * `traces.ts`). Details response shape is documented on
11: * `AgentConversationDetailsSchema`. Pagination uses `parseLinkHeader`. Revisit
12: * once these endpoints land in `@sentry/api`.
13: */
14:
15: import { array } from "valibot";
16:
17: import {
18: type AgentConversationDetails,
19: AgentConversationDetailsSchema,
20: type AgentConversationSpan,
21: type ConversationListItem,
22: ConversationListItemSchema,
23: } from ...
No files found
File not found: /home/byk/Code/getsentry/cli-pr-1558/.agents
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/script/generate-skill.ts</path>
<type>file</type>
<content>
840: if (agentGuidance) {
841: indexSections.push("## Agent Guidance");
842: indexSections.push("");
843: const nestedGuidance = agentGuidance.replace(
844: /^(#{2,6})\s/gm,
845: (_, hashes: string) => `#${hashes} `
846: );
847: indexSections.push(nestedGuidance);
848: indexSections.push("");
849: }
850:
851: // Prerequisites
852: indexSections.push(prerequisites);
853: indexSections.push("");
854:
855: // Compact command reference
856: indexSections.push(
857: generateCompactCommandsSection(routeInfos, referenceFileNames)
858: );
859:
860: // Supplementary sections
861: indexSections.push(supplementary);
862: indexSections.push("");
863:
864: files.set("SKILL.md", indexSections.join("\n"));
865:
866: return files;
867: }
868:
869: /**
870: * Generate the .well-known/skills/index.json discovery ...
name: PR Risk Action
description: Score a pull request as low, medium, or high risk.
inputs:
repo:
description: GitHub repository as owner/name.
required: true
pr-number:
description: Pull request number.
required: true
profile:
description: Profile directory under profiles/. Defaults to owner__repo.
required: false
default: ""
history:
description: Optional raw historical PR JSONL or JSONL.GZ path. Defaults to the selected profile history.
required: false
default: ""
model:
description: Optional saved model JSON path. Defaults to the selected profile model.
required: false
default: ""
result-path:
description: JSON result output path.
required: false
default: risk-pr-result.json
skip-reviews:
description: Skip fetching current PR reviews.
required: false
default: "true"
apply-label:
description: "Apply risk labels to the pull request. Requires issues: write in the caller workflow."
...
Found 2 matches
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/errors.ts:
Line 540: export function validationError(
Line 558: export class ValidationError extends CliError {
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/errors.ts</path>
<type>file</type>
<content>
510: * agent consumers get actionable recovery commands plus diagnostic context in a
511: * predictable shape. Always pass `field` when constructing the error — unfielded
512: * validation errors collapse into one Sentry fingerprint.
513: *
514: * @param headline - What failed validation
515: * @param examples - CLI commands or steps shown under "Try:"
516: * @param note - Optional diagnostic context rendered as "Note:" (not actionable)
517: */
518: export function buildValidationMessage(
519: headline: string,
520: examples: string[],
521: note?: string
522: ): string {
523: const lines = [headline];
524: if (examples.length > 0) {
525: lines.push("", "Try:");
526: for (const example of examples) {
527: lines.push(` ${example}`);
528: }
529: }
530: if (note) {
531: lines.push("", `Note: ${note}`);
532: }
533: return ...
diff --git a/apps/cli-docs/src/fragments/commands/agent-conversation.md b/apps/cli-docs/src/fragments/commands/agent-conversation.md index ca9b2b2e3..e69de29bb 100644 --- a/apps/cli-docs/src/fragments/commands/agent-conversation.md +++ b/apps/cli-docs/src/fragments/commands/agent-conversation.md @@ -1,33 +0,0 @@ - - - -## Examples - -### List conversations - -```bash -# List recent agent conversations -sentry agent-conversation list - -# Explicit organization -sentry agent-conversation list my-org - -# Show more, last 24 hours -sentry agent-conversation list --limit 50 --period 24h - -# Filter conversations -sentry agent-conversation list -q "has:errors" - -# Paginate through results -sentry agent-conversation list my-org -c next -``` - -### View a conversation transcript - -```bash -# View full transcript -sentry agent-conversation view my-org conv-123 - -# JSON output -sentry agent-conversation view my-org conv-123 --json -``` diff --git a/packages/cli/test/lib/command.test.ts ...
{
"sha": "f5126d7a979415ac5124b7c14919482b149382aa",
"url": "https://api.github.com/repos/getsentry/pr-risk-action/git/trees/f5126d7a979415ac5124b7c14919482b149382aa",
"tree": [
{
"path": ".github",
"mode": "040000",
"type": "tree",
"sha": "c9212beabe643036656b55873501db0e6b349f29",
"url": "https://api.github.com/repos/getsentry/pr-risk-action/git/trees/c9212beabe643036656b55873501db0e6b349f29"
},
{
"path": ".github/workflows",
"mode": "040000",
"type": "tree",
"sha": "bd502cb67b3837ce0b0efbf68ab222010b714c3f",
"url": "https://api.github.com/repos/getsentry/pr-risk-action/git/trees/bd502cb67b3837ce0b0efbf68ab222010b714c3f"
},
{
"path": ".github/workflows/test.yml",
"mode": "100644",
"type": "blob",
"sha": "442442ed48660d8e953d4e2c172fe1b528310e10",
"size": 401,
"url": ...
"""Small GitHub REST client for PR backfills."""
from __future__ import annotations
import json
import os
import socket
import time
import gzip
import http.client
import urllib.error
import urllib.parse
import urllib.request
from dataclasses import dataclass
from datetime import datetime, timezone
from typing import Any, Dict, Iterable, Iterator, List, Optional, Sequence
GITHUB_API = "https://api.github.com"
class GitHubError(RuntimeError):
"""Raised when the GitHub API returns an error."""
@dataclass(frozen=True)
class RepoRef:
owner: str
name: str
@classmethod
def parse(cls, value: str) -> "RepoRef":
parts = value.strip().split("/")
if len(parts) != 2 or not all(parts):
raise ValueError(f"repo must look like owner/name, got {value!r}")
return cls(parts[0], parts[1])
@property
def slug(self) -> str:
return f"{self.owner}/{self.name}"
@property
def path_slug(self) -> str:
return ...
"""Command line interface for the PR risk MVP."""
from __future__ import annotations
import argparse
import json
import os
import sys
from datetime import datetime, timedelta, timezone
from pathlib import Path
from typing import Any, Dict, List, Optional, Sequence
from .features import build_feature_rows, load_raw_dataset, write_feature_csv
from .git_history import build_git_pr_rows, collect_git_reverts_by_pr, survey_git_history
from .github import (
GitHubError,
GitHubClient,
RepoRef,
normalize_file,
normalize_pr,
normalize_review,
parse_github_time,
utc_now_iso,
write_jsonl,
)
from .modeling import (
DEFAULT_FEATURE_SET,
apply_serialized_logistic_model,
canonical_feature_set,
logistic_markdown_report,
train_logistic_baseline,
)
from .scoring import evaluate_predictions, markdown_report, score_feature_rows, write_json
DEFAULT_OUTCOMES = ["strong_outcome", "medium_outcome"]
RISK_LABELS = {
"low": {
"name": "risk: ...
Found 100 matches (more matches available)
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/introspect.ts:
Line 37: fullDescription?: string;
Line 46: fullDescription?: string;
Line 55: * reads it to populate {@link CommandInfo.jsonFields}.
Line 63: /** Canonical documentation examples retained by `buildCommand`. */
Line 64: __examples?: readonly CommandExample[];
Line 102: export type CommandInfo = {
Line 105: fullDescription?: string;
Line 111: examples: string[];
Line 131: commands: CommandInfo[];
Line 139: | { kind: "command"; info: CommandInfo }
Line 280: * Build a {@link CommandInfo} from a Stricli Command.
Line 284: * @param examples - Optional usage examples
Line 286: export function buildCommandInfo(
Line 289: examples: string[] = []
Line 290: ): CommandInfo {
Line 298: fullDescription: cmd.fullDescription,
Line 304: examples: cmd.__examples?.length
Line 305: ? ...
Found 42 matches
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/introspect.ts:
Line 286: export function buildCommandInfo(
Line 336: commands.push(buildCommandInfo(subTarget, path, examples));
Line 378: commands: [buildCommandInfo(target, path)],
Line 407: export function resolveCommandPath(
Line 453: info: buildCommandInfo(target, `sentry ${entry.name.original}`),
Line 465: const subResult = resolveCommandPath(target, rest);
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/command.ts:
Line 709: const { introspectCommand, formatHelpHuman } = await import("./help.js");
Line 719: stdout.write(`${formatHelpHuman(result)}\n`);
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/telemetry.ts:
Line 824: return JSON.stringify(value).slice(0, 200);
Line 906: typeof arg === "string" ? arg : JSON.stringify(arg)
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/sentryclirc-import.ts:
...
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/app.ts</path>
<type>file</type>
<content>
400: const prefix = ansiColor ? errorColor("Error:") : "Error:";
401: return `${prefix} ${exc.format()}`;
402: }
403: if (exc instanceof Error) {
404: return `Unexpected error: ${exc.stack ?? exc.message}`;
405: }
406: return `Unexpected error: ${stringifyUnknown(exc)}`;
407: },
408: };
409:
410: export const app = buildApplication(routes, {
411: name: "sentry",
412: versionInfo: {
413: currentVersion: CLI_VERSION,
414: },
415: scanner: {
416: caseStyle: "allow-kebab-for-camel",
417: // Allow `--` to stop flag parsing so wrapper commands (e.g.
418: // `sentry monitor run <slug> -- <command>`) can pass through flags
419: // like `-e` or `--verbose` to the wrapped command unambiguously. ...
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/help.ts</path>
<type>file</type>
<content>
340: }
341:
342: /**
343: * Introspect the full command tree.
344: * Returns all visible routes with all flags included, plus the top-level
345: * environment variables and common flags recognized by the CLI.
346: */
347: export function introspectAllCommands(): {
348: routes: RouteInfo[];
349: envVars: HelpEnvVarInfo[];
350: flags: HelpFlagInfo[];
351: } {
352: const routeMap = routes as unknown as RouteMap;
353: return {
354: routes: extractAllRoutes(routeMap),
355: envVars: buildTopLevelEnvVars(),
356: flags: buildCommonFlags(),
357: };
358: }
359:
360: /**
361: * Introspect a specific command or group.
362: * Returns the resolved command/group info, or an error object
363: * with optional fuzzy suggestions if the path doesn't resolve. ...
diff --git a/packages/cli/plugins/sentry-cli/skills/sentry-cli/SKILL.md b/packages/cli/plugins/sentry-cli/skills/sentry-cli/SKILL.md index f1a71fb6a..85a58de78 100644 --- a/packages/cli/plugins/sentry-cli/skills/sentry-cli/SKILL.md +++ b/packages/cli/plugins/sentry-cli/skills/sentry-cli/SKILL.md @@ -331,164 +331,164 @@ npm install -g sentry ### Authentication ```bash sentry auth sentry auth --token YOUR_SENTRY_API_TOKEN sentry auth status sentry auth logout ``` ## Command Reference ### Auth Authenticate with Sentry - `sentry auth login` — Authenticate with Sentry - `sentry auth logout` — Log out of Sentry - `sentry auth refresh` — Refresh your OAuth access token - `sentry auth status` — View authentication status - `sentry auth token` — Print the stored authentication token - `sentry auth whoami` — Show the currently authenticated identity → Full flags and examples: `references/auth.md` ### Org Work with Sentry organizations - `sentry org list` ...
Found 37 matches
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/arg-parsing.ts:
Line 11: import { validateResourceId } from "./input-validation.js";
Line 705: validateResourceId(np.slug, "project slug");
Line 714: validateResourceId(no.slug, "organization slug");
Line 740: validateResourceId(np.slug, "project slug");
Line 801: validateResourceId(np.slug, "project slug");
Line 1119: * IMPORTANT: this runs BEFORE parseIssueArg's main `validateResourceId` guard
Line 1121: * fragment itself. `validateResourceId` permits `:`, so a `:` mixed with `#`
Line 1153: validateResourceId(fragment, "issue identifier");
Line 1162: // validateResourceId guard, and parseWithSlash doesn't re-validate.
Line 1164: validateResourceId(prefix.replace(/\//g, ""), "issue identifier");
Line 1169: // validateResourceId guard, so validate the project slug here. ...
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/resolve-target.ts</path>
<type>file</type>
<content>
1650: *
1651: * @throws {ContextError} When the target cannot be resolved or chosen.
1652: */
1653: export async function resolveOrgProjectOrGuide(
1654: options: ResolveOptions
1655: ): Promise<ResolvedTarget> {
1656: const resolved = await resolveOrgAndProject(options);
1657: return resolved ?? (await guideOrgProjectFailure(options));
1658: }
1659:
1660: /**
1661: * Resolve organization only from multiple sources.
1662: *
1663: * Resolution priority:
1664: * 1. Positional argument
1665: * 2. SENTRY_ORG / SENTRY_PROJECT env vars
1666: * 3. `.sentryclirc` config file
1667: * 4. Config defaults
1668: * 5. ...
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/region.ts</path>
<type>file</type>
<content>
1: /**
2: * Region resolution for multi-region Sentry support.
3: *
4: * Provides utilities to resolve the correct region URL for an organization,
5: * using cached data when available or fetching from the API when needed.
6: */
7:
8: import { getOrganization } from "@sentry/api";
9: import { getConfiguredSentryUrl } from "./constants.js";
10: import { getOrgByNumericId, getOrgRegion, setOrgRegion } from "./db/regions.js";
11: import { stripDsnOrgPrefix } from "./dsn/index.js";
12: import { withAuthGuard } from "./errors.js";
13: import { getSdkConfig } from "./sentry-client.js";
14: import { getSentryBaseUrl, isSentrySaasUrl } from "./sentry-urls.js";
15:
16: /**
17: * Promise cache for org region resolution, keyed by orgSlug.
18: *
19: * When multiple DSNs share an orgId, concurrent calls to resolveOrgRegion
20: * deduplicate into a single HTTP request. ...
Found 100 matches (more matches available)
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/mutate-command.ts:
Line 192: * `${orgSlug}/${project.slug}`,
Line 193: * `Type '${orgSlug}/${project.slug}' to permanently delete project '${project.name}':`
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/list-command.ts:
Line 724: orgSlugMatchBehavior: "redirect",
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/span-tree.ts:
Line 59: * @param orgSlug - Organization slug for API routing
Line 65: orgSlug: string,
Line 93: const spans = await getDetailedTrace(orgSlug, traceId, timestamp);
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/org-list.ts:
Line 262: * @template TWithOrg Entity with orgSlug attached for display
Line 269: listForOrg: (orgSlug: string) => Promise<TEntity[]>;
Line 276: orgSlug: string,
Line 282: * Typically `{ ...entity, orgSlug }`. ...
Found 2 matches
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/formatters/json.ts:
Line 169: export function formatJson<T>(data: T): string {
/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/formatters/local.ts:
Line 772: function formatJsonObservation(
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/formatters/json.ts</path>
<type>file</type>
<content>
145: *
146: * Handles whitespace around commas and filters out empty segments:
147: * ```ts
148: * parseFieldsList("id, title , status") // → ["id", "title", "status"]
149: * parseFieldsList("id,,title") // → ["id", "title"]
150: * ```
151: *
152: * @param input - Raw `--fields` flag value
153: * @returns Parsed field path list (may be empty if input is all whitespace/commas)
154: */
155: export function parseFieldsList(input: string): string[] {
156: return [
157: ...new Set(
158: input
159: .split(",")
160: .map((f) => f.trim())
161: .filter(Boolean)
162: ),
163: ];
164: }
165:
166: /**
167: * Format data as pretty-printed JSON
168: */
169: export function formatJson<T>(data: T): string {
170: return JSON.stringify(data, null, 2);
171: }
172:
173: /**
174: * Output JSON to a write stream. ...
Found 4 matches /home/byk/Code/getsentry/cli-pr-1558/.gitignore: Line 64: packages/cli/src/generated/ Line 70: !packages/cli/src/generated/banner-sixel.ts /home/byk/Code/getsentry/cli-pr-1558/packages/cli/.gitignore: Line 38: src/generated/ Line 41: !src/generated/banner-sixel.ts
No files found
Found 2 matches /home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/api/infrastructure.ts: Line 489: export async function apiRequestToRegion<T>( Line 646: export async function apiRequestToRegionNoContent(
<path>/home/byk/Code/getsentry/cli-pr-1558/packages/cli/src/lib/api/infrastructure.ts</path>
<type>file</type>
<content>
450: *
451: * Centralizes the two things every list endpoint kept re-deriving by hand and
452: * occasionally got wrong (see #1458): capping `per_page` at
453: * {@link API_MAX_PER_PAGE} and threading `limit` plus the initial cursor into
454: * {@link autoPaginate}. Callers still own region resolution and
455: * endpoint-specific query building inside `fetchPage`.
456: *
457: * @param options - Caller list options; `limit` bounds total rows, `cursor` is the start cursor
458: * @param fetchPage - Fetches one page given the capped `perPage` and a page cursor
459: * @param defaultLimit - Applied when `options.limit` is undefined
460: * @returns Accumulated items with optional nextCursor
461: */
462: export function paginate<T>(
463: options: { limit?: number; cursor?: string },
464: fetchPage: (
465: perPage: number,
466: cursor: string | ...
* 🟡 (23:19) `packages/cli/src/lib/api/infrastructure.ts` lines 462-477 define `paginate<T>(options, fetchPage, defaultLimit = 10)`: computes `limit = options.limit ?? defaultLimit`, caps `perPage` with `Math.min(limit, API_MAX_PER_PAGE)`, and calls `autoPaginate((cursor) => fetchPage(perPage, cursor), limit, options.cursor)`. * 🟡 (23:19) `apiRequestToRegion<T>` at `packages/cli/src/lib/api/infr…
* 🟡 (23:17) A file search returned `No files found`; the search criteria were not included in the result. * 🟡 (23:17) Search found exactly 2 region API request functions in `packages/cli/src/lib/api/infrastructure.ts`: `apiRequestToRegion<T>` at line 489 and `apiRequestToRegionNoContent` at line 646.
* 🟡 (23:16) Repository-wide search for `orgSlug` found 100 displayed matches with additional matches available; results were truncated and suggested using a more specific path or pattern. * 🟡 (23:16) `packages/cli/src/lib/mutate-command.ts:192-193` documents a destructive project-confirmation prompt using `${orgSlug}/${project.slug}` and the exact text `Type '${orgSlug}/${project.slug}' to perm…
* 🟡 (23:16) `packages/cli/src/lib/region.ts:8-14` imports `getOrganization` from `@sentry/api`; `getConfiguredSentryUrl`; `getOrgByNumericId`, `getOrgRegion`, and `setOrgRegion`; `stripDsnOrgPrefix`; `withAuthGuard`; `getSdkConfig`; and `getSentryBaseUrl` plus `isSentrySaasUrl`. * 🟡 (23:16) `packages/cli/src/lib/region.ts:16-26` defines `regionCache` as `new Map<string, Promise<string>>()`, key…
* 🔴 (23:15) User directed switching to nightly builds via `sentry cli upgrade nightly` (replacing the stable build channel); switching back would use `sentry cli upgrade stable`. * 🟡 (23:15) Generated CLI skill documentation in `packages/cli/plugins/sentry-cli/skills/sentry-cli/SKILL.md` changed optional target syntax: `sentry org view [<org>]`, `sentry project list [<org/project>]`, and `sentr…
* 🟡 (23:14) In `packages/cli/src/lib/help.ts:347-358`, `introspectAllCommands()` casts `routes` to `RouteMap` and returns `{ routes: extractAllRoutes(routeMap), envVars: buildTopLevelEnvVars(), flags: buildCommonFlags() }`; its documented contract is all visible routes with all flags plus top-level environment variables and common CLI flags. * 🟡 (23:14) In `packages/cli/src/lib/help.ts:365-381`…
* 🟡 (23:13) User-provided PR-risk CLI artifact defines `DEFAULT_OUTCOMES = ["strong_outcome", "medium_outcome"]` and `RISK_LABELS`: `low` → `{ name: "risk: low", color: "0E8A16", description: "PR risk score: low" }`; `medium` → `{ name: "risk: medium", color: "FBCA04", description: "PR risk score: medium" }`; `high` → `{ name: "risk: high", color: "D93F0B", description: "PR risk score: high" }`.…
Date: Sep 9, 2026 * 🟡 (23:12) Patch deletes the contents of `apps/cli-docs/src/fragments/commands/agent-conversation.md`, leaving the file empty (`e69de29bb`). * 🟡 (23:12) A new `buildCommand()` test, `retains structured examples for introspection`, verifies that command documentation examples remain available through `__examples`; the fixture preserves `{ description: "Select an organization e…
* 🟡 (23:07) User requested completion of a read-only security/pentest review for the security merge gate, preserving the full prior threat model; required findings with exact `file:line` evidence or explicit PASS statements and residual risks, `BLOCKED` with the exact error if tools prevent inspection, immutable-target reverification after inspection, no modifications, and a final line exactly `…
* 🟡 (18:48) Diff for `packages/cli/script/check-fragments.ts` shows `fragmentMentionsSubcommand()` checking fragment coverage in this order: 1. case-insensitive full CLI reference anywhere; 2. for default commands, a bare `sentry <route>` matched with an escaped regex and boundary that avoids treating `sentry issue events` as `sentry issue`; 3. a level 1–4 heading mentioning the escaped leaf nam…
* 🟡 (18:41) `/home/byk/Code/getsentry/cli-pr-1558/packages/cli/CONTRIBUTING.md` states the CLI follows `gh` CLI conventions and uses optional positional context for list commands: `sentry org list [--limit N] [--json]`, `sentry project list [org] [--limit N] [--json]`, and `sentry issue list [<org>/<project>] [--json]`. * 🟡 (18:41) The contribution guide defines target syntax in this order: 1. …
Date: Sep 9, 2026 * 🔴 (18:40) User stated the injected `--log-level` flag is always stripped; flags in `ALWAYS_STRIP` are always removed before command execution, so the command never sees them. * 🔴 (18:40) User stated `--fields` is always injected when `output: { human: ... }`, regardless of whether a command-defined `json` flag causes the injected `JSON_FLAG` to be skipped. * 🔴 (18:40) User …
Date: Sep 9, 2026 * 🔴 (18:38) User stated `--fields` is always injected when `output: { human: ... }`, even when a command already defines its own `json` flag and the injected `JSON_FLAG` is skipped. * 🔴 (18:38) User stated flags in `ALWAYS_STRIP` are always stripped so the command never sees them; `ALWAYS_STRIP` currently contains `LOG_LEVEL_KEY`. * 🔴 (18:38) User directed list-command constr…
🟡 (18:38) Immutable review diff enumerated 35 modified files: `.github/workflows/pr-risk.yml`; `apps/cli-docs/src/fragments/commands/agent-conversation.md`; `packages/cli/plugins/sentry-cli/skills/sentry-cli/SKILL.md`; 16 generated references under `packages/cli/plugins/sentry-cli/skills/sentry-cli/references/`: `agent-conversation.md`, `alert.md`, `cli.md`, `explore.md`, `feedback.md`, `init.md…
## 2026-09-09 🔴 (18:34) [requested-security-review] User requested a fresh, independent, read-only security/pentest review of getsentry/cli PR #1558 in `/home/byk/Code/getsentry/cli-pr-1558`. 🔴 (18:34) User identified the immutable review target as base `bd065083c3b82677747b97a6cc7f5cf57532d3bc` and head `fc5d50e2324e2b6bb2067976bf1515dab45224fb`; expected SHA-256 for `git diff base...head` i…