Session 0yIbElBDrDPk

[
  {
    "content": "Inspect issue and affected CLI behavior",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Add regression coverage and implement fix",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run focused and repository checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

                                                                                                                                                               Env org-auth token host claim ignored when picking request base URL · Issue #1568 · getsentry/cli · GitHub                                              

[Skip to content](#start-of-content)    

           

## Navigation Menu

[](/)

[Sign in](/login?return_to=https%3A%2F%2Fgithub.com%2Fgetsentry%2Fcli%2Fissues%2F1568)

Appearance settings

-   Platform
    
    -   AI CODE CREATION
        
        -   [GitHub CopilotWrite better code with AI](https://github.com/features/copilot)
        -   [GitHub Copilot appDirect agents from issue to merge](https://github.com/features/ai/github-app)
        -   [MCP RegistryIntegrate external tools](https://github.com/mcp)
        
    -   DEVELOPER WORKFLOWS
        
        -   [ActionsAutomate any workflow](https://github.com/features/actions)
        -   [CodespacesInstant dev ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus</path>
<type>directory</type>
<entries>
.craft.yml
.git
.github/
.gitignore
.lore.md
.nojekyll
.npmrc
.opencode/
.plans/
.ruff_cache/
AGENTS.md
apps/
CHANGELOG.md
codemods/
coverage/
dist-bin/
dist/
docs/
LICENSE.md
node_modules/
package.json
packages/
pnpm-lock.yaml
pnpm-workspace.yaml
README.md
test-results.junit.xml

(26 entries)
</entries>

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/constants.ts</path>
<type>file</type>
<content>
1: /**
2:  * Runtime constants for the CLI.
3:  */
4: 
5: import { getEnv } from "./env.js";
6: 
7: /** Build-time constant injected by esbuild/bun */
8: declare const SENTRY_CLI_VERSION: string | undefined;
9: 
10: /**
11:  * Build-time debug ID for sourcemap resolution, injected by esbuild.
12:  *
13:  * During the build, esbuild's `define` replaces this identifier with a
14:  * placeholder UUID string literal. After esbuild finishes, the build
15:  * script replaces the placeholder with the real debug ID (derived from
16:  * the minified JS + sourcemap content hash). The same-length swap keeps
17:  * sourcemap character positions valid.
18:  */
19: declare const __SENTRY_DEBUG_ID__: string | undefined;
20: 
21: /** Default Sentry SaaS hostname */
22: export const DEFAULT_SENTRY_HOST = "sentry.io";
23: 
24: /** ...

Found 100 matches (more matches available)
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/helpers.ts:
  Line 190:     import("../src/lib/env-token-host.js"),

  Line 192:     import("../src/lib/token-host.js"),


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/token-host.test.ts:
  Line 2:  * Unit tests for token-host: normalizeOrigin + isHostTrusted.

  Line 5:  * sensitivity) are also covered by test/lib/token-host.property.test.ts.

  Line 12: import { isHostTrusted } from "../../src/lib/token-host.js";


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/token-host.property.test.ts:
  Line 10:  * Unit tests for specific edge cases live in test/lib/token-host.test.ts.

  Line 22: import { isHostTrusted } from ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/env-token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Env-Token Host Snapshot
3:  *
4:  * Captures the host an env-var auth token (`SENTRY_AUTH_TOKEN` /
5:  * `SENTRY_TOKEN`) is scoped to, BEFORE any post-boot code path can mutate
6:  * `env.SENTRY_HOST`/`env.SENTRY_URL` (specifically before
7:  * `applySentryCliRcEnvShim` writes from a `.sentryclirc` file).
8:  *
9:  * Trust model for the snapshot source:
10:  *
11:  * - `SENTRY_HOST`/`SENTRY_URL` from env are NOT unconditionally trusted.
12:  *   In layered CI environments (e.g. GitHub Actions `$GITHUB_ENV`), a
13:  *   low-privilege step can write env vars that a later high-privilege step
14:  *   inherits — without having read access to `SENTRY_AUTH_TOKEN`. So
15:  *   env-host and env-token may have different integrity levels. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Host-Scoped Token Trust Model
3:  *
4:  * Tokens (env or stored OAuth) are bound to a specific Sentry host. The fetch
5:  * layer (and the `.sentryclirc` / URL-arg entry points) check each request's
6:  * destination against the token's recorded host and refuse to attach
7:  * credentials when they don't match — so untrusted routing inputs can't leak
8:  * credentials to an attacker's host.
9:  *
10:  * Host equivalence:
11:  * - Exact origin match (scheme + host + explicit port).
12:  * - SaaS equivalence class: a token scoped to `https://sentry.io` is valid for
13:  *   any `*.sentry.io` subdomain. Non-SaaS hosts match exactly — no subdomain
14:  *   suffix matching (a `sentry.acme.com` token does NOT match
15:  *   `sentry.acme.evil.com`). ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-urls.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry URL Utilities
3:  *
4:  * Utilities for constructing Sentry web URLs.
5:  * Supports self-hosted instances via SENTRY_URL environment variable.
6:  */
7: 
8: import {
9:   DEFAULT_SENTRY_HOST,
10:   DEFAULT_SENTRY_URL,
11:   getConfiguredSentryUrl,
12:   normalizeUrl,
13: } from "./constants.js";
14: 
15: /**
16:  * Get the Sentry web base URL.
17:  * Supports self-hosted instances via SENTRY_URL env var.
18:  */
19: export function getSentryBaseUrl(): string {
20:   return getConfiguredSentryUrl() ?? DEFAULT_SENTRY_URL;
21: }
22: 
23: /**
24:  * Build the org-scoped base URL using the subdomain pattern.
25:  * E.g. "https://sentry.io" + "my-org" → "https://my-org.sentry.io"
26:  *
27:  * @param orgSlug - Organization slug
28:  * @returns Origin URL with org as subdomain
29:  */
30: export ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/constants.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for normalizeUrl and getConfiguredSentryUrl.
3:  *
4:  * The primary invariant — bare hostnames get `https://` prepended so that
5:  * downstream URL construction produces valid URLs — is tested via property-based
6:  * tests in constants.property.test.ts. These unit tests cover specific edge
7:  * cases and the env-var integration path.
8:  */
9: 
10: import { afterEach, beforeEach, describe, expect, test } from "vitest";
11: import {
12:   getCliEnvironment,
13:   getConfiguredSentryUrl,
14:   normalizeUrl,
15: } from "../../src/lib/constants.js";
16: 
17: describe("normalizeUrl", () => {
18:   test("returns undefined for undefined", () => {
19:     expect(normalizeUrl(undefined)).toBeUndefined();
20:   });
21: 
22:   test("returns undefined for empty string", () => {
23:     ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
650:   timeoutMs,
651: }: ExecuteAttemptArgs): Promise<AttemptResult> {
652:   try {
653:     const response = await fetchWithTimeout({
654:       input,
655:       init,
656:       headers,
657:       externalSignal: init?.signal,
658:       timeoutMs,
659:     });
660:     return handleResponse(response, headers, isLastAttempt);
661:   } catch (error) {
662:     return handleFetchError(error, init?.signal, isLastAttempt);
663:   }
664: }
665: 
666: /** Singleton authenticated fetch instance - reused across all requests */
667: let cachedFetch: typeof fetch | null = null;
668: 
669: /**
670:  * Get the shared authenticated fetch instance.
671:  * Cast to `typeof fetch` for compatibility with @sentry/api SDK options.
672:  */
673: function getAuthenticatedFetch(): typeof fetch {
674:   if (!cachedFetch) {
675:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-claims.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry Org-Auth-Token (`sntrys_`) Claim Extraction
3:  *
4:  * Format: `sntrys_<base64(JSON{iat, url, region_url, org})>_<random-secret>`
5:  * (server-side: getsentry/sentry `orgauthtoken_token.py`).
6:  *
7:  * The claim is **NOT signed** — anyone can forge a `sntrys_` string with any
8:  * `url`. However, for legitimate tokens the claim IS authoritative: the real
9:  * server wrote it at issuance time, and it's immune to env-injection attacks
10:  * (the attacker who can poison `SENTRY_HOST` via `$GITHUB_ENV` can't read or
11:  * modify the token bytes). `captureEnvTokenHost` uses the claim as the
12:  * primary trust source for `sntrys_` tokens, ahead of env vars. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Defense-in-depth: `sntrys_` token claim vs request-origin mismatch.
3:  *
4:  * The fetch-layer guard refuses to attach a `sntrys_` token when its
5:  * embedded `url` claim disagrees with the request origin. Defends users
6:  * with access to multiple Sentry instances against routing one
7:  * instance's token to another. Claim is unsigned (see token-claims.ts),
8:  * so this catches honest misconfigurations more than malicious attacks.
9:  */
10: 
11: import { afterEach, beforeEach, describe, expect, test } from "vitest";
12: import {
13:   extractFetchUrl,
14:   mintSntrysToken,
15:   resetHostScopingState,
16:   useEnvSandbox,
17: } from "../../helpers.js";
18: 
19: const ENV_KEYS = [
20:   "SENTRY_AUTH_TOKEN",
21:   "SENTRY_TOKEN",
22:   "SENTRY_HOST",
23:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
1: /**
2:  * Authentication credential storage (single-row table pattern).
3:  */
4: 
5: import { createHash } from "node:crypto";
6: import { DEFAULT_SENTRY_URL, getConfiguredSentryUrl } from "../constants.js";
7: import { getEnv } from "../env.js";
8: import { getEnvTokenHost } from "../env-token-host.js";
9: import { logger } from "../logger.js";
10: import { normalizeOrigin } from "../sentry-urls.js";
11: import { withDbSpan } from "../telemetry.js";
12: import { getDatabase } from "./index.js";
13: import { clearAllIssueOrgCache } from "./issue-org-cache.js";
14: import { clearTrustedHostState } from "./regions.js";
15: import { runUpsert } from "./utils.js";
16: 
17: /** Refresh when less than 10% of token lifetime remains */
18: export const REFRESH_THRESHOLD = 0.1;
19: 
20: /** Default token lifetime (1 hour) ...

 M .lore.md
605e8318d chore: regenerate docs
30ad8b075 ci: organize imports in bundle.ts (biome)
a3921f773 ci: address Seer finding on bundle.ts WASM resolution
12bb0fa77 chore(cli): sync scripts + Bugbot fixes for #1254 (post-feedback rebase)
ab3aa054f chore: address adversarial review findings for monorepo pre-shape
157184517 ci: fix check-generated job paths for monorepo layout
cf165f5ba chore: pre-shape repo into pnpm-workspace monorepo layout
0b43edad4 chore: regenerate docs
f1cc17934 meta: Bump new development version
7f4d217d1 Merge branch 'release/0.40.0'
b0b22fe82 feat(errors): wire up no-silent-catch lint rule, drop ratchet baseline (#1532)
96390e5f6 chore: pre-shape repo into pnpm-workspace monorepo layout (#1254)
cf165f5ba chore: pre-shape repo into pnpm-workspace monorepo layout
e11da2e85 chore: pre-shape repo into pnpm-workspace monorepo layout

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/package.json</path>
<type>file</type>
<content>
1: {
2:   "name": "sentry",
3:   "version": "0.40.0-dev.0",
4:   "description": "Sentry CLI - A command-line interface for using Sentry built by robots and humans for robots and humans",
5:   "repository": {
6:     "type": "git",
7:     "url": "git+https://github.com/getsentry/cli.git"
8:   },
9:   "main": "./dist/index.cjs",
10:   "type": "module",
11:   "types": "./dist/index.d.cts",
12:   "exports": {
13:     ".": {
14:       "import": {
15:         "types": "./dist/index.d.mts",
16:         "default": "./dist/index.mjs"
17:       },
18:       "require": {
19:         "types": "./dist/index.d.cts",
20:         "default": "./dist/index.cjs"
21:       }
22:     }
23:   },
24:   "bin": {
25:     "sentry": "./dist/bin.cjs"
26:   },
27:   "files": [
28:     "dist/bin.cjs",
29:     "dist/index.cjs",
30:     ...

No files found

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/helpers.ts</path>
<type>file</type>
<content>
150:  * Use for security/host-scoping tests where env vars influence the code path
151:  * being tested. Keeps the boilerplate `Object.fromEntries(KEYS.map(...))`
152:  * out of every test file.
153:  *
154:  * Must be called at module scope or inside a `describe()` block.
155:  */
156: export function useEnvSandbox(keys: readonly string[]): void {
157:   let saved: Record<string, string | undefined>;
158: 
159:   beforeEach(() => {
160:     saved = Object.fromEntries(keys.map((k) => [k, process.env[k]]));
161:     for (const k of keys) {
162:       delete process.env[k];
163:     }
164:   });
165: 
166:   afterEach(() => {
167:     for (const k of keys) {
168:       const v = saved[k];
169:       if (v !== undefined) {
170:         process.env[k] = v;
171:       } else {
172:         delete process.env[k];
173:       ...

[
  {
    "content": "Inspect issue and affected CLI behavior",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add regression coverage and implement fix",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Run focused and repository checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

Success. Updated the following files:
M packages/cli/src/lib/constants.ts
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli


 Test Files  1 passed (1)
      Tests  9 passed (9)
   Start at  08:35:13
   Duration  3.61s (transform 2.54s, setup 68ms, import 2.20s, tests 1.14s, environment 0ms)

[
  {
    "content": "Inspect issue and affected CLI behavior",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add regression coverage and implement fix",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run focused and repository checks",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

> sentry@0.40.0-dev.0 typecheck /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:docs && pnpm run generate:sdk && tsc --noEmit


> sentry@0.40.0-dev.0 generate:docs /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:banner && pnpm run generate:parser && pnpm run generate:command-docs && pnpm run generate:skill && pnpm run generate:docs-sections


> sentry@0.40.0-dev.0 generate:banner /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/generate-banner-sixel.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/generate-banner-sixel.ts

.env.local not found. Continuing without ...

...output truncated...

Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_08a7a772c0012ujo1Z4Ii4UltZ

INVOCATION_ID=fd0d560894e2412f992cb6ae08ef3060
npm_package_name=sentry
NODE=/home/byk/.volta/tools/image/node/24.16.0/bin/node
OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS=1
npm_config_frozen_lockfile=
OPENCODE_WATCHER_PATH=/home/byk/.opencode/server/native/watcher.node
LANG=en_US.UTF-8
OPENCODE_PID=878473
npm_lifecycle_script=pnpm run generate:docs && pnpm run generate:sdk && vitest run test/lib test/commands test/types test/script ...

> sentry@0.40.0-dev.0 lint /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> biome check --no-errors-on-unmatched --max-diagnostics=none ./

test/lib/security/sntrys-claim-mismatch.test.ts format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:
  
    132 132 │       });
    133 133 │   
    134     │ - ····const·{·getApiBaseUrl·}·=·await·import(
    135     │ - ······"../../../src/lib/sentry-client.js"
    136     │ - ····);
        134 │ + ····const·{·getApiBaseUrl·}·=·await·import("../../../src/lib/sentry-client.js");
    137 135 │       const { apiRequestToRegion } = await import(
    138 136 │         "../../../src/lib/api/infrastructure.js"
  

Checked 951 files in 86s. No fixes applied.
Found 1 error.
check ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while running checks. ...

Success. Updated the following files:
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli


 Test Files  1 passed (1)
      Tests  9 passed (9)
   Start at  08:46:35
   Duration  10.63s (transform 6.63s, setup 450ms, import 5.84s, tests 3.66s, environment 0ms)

...output truncated...

Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_08a881af3001IfGAI8qc8W4pFM

SHELL=/usr/bin/bash
npm_package_version=0.40.0-dev.0
npm_lifecycle_event=test:unit
npm_config_verify_deps_before_run=false
LORE_GATEWAY_URL=http://127.0.0.1:3207
LORE_ALLOW_REMOTE_MANAGEMENT=1
LORE_WARMUP_PROBE=1
PWD=/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
npm_execpath=/home/byk/.local/share/pnpm/.tools/pnpm/10.11.0_tmp_3945111/node_modules/pnpm/bin/pnpm.cjs
npm_config__jsr_registry=https://npm.jsr.io/
npm_command=run-script
PNPM_SCRIPT_SRC_DIR=/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
LORE_LISTEN_HOST=127.0.0.1,100.69.65.125
AWS_BEARER_TOKEN_BEDROCK=ABSKTWFudGxlQXBpS2V5LW14aW1zeGxkLWF0LTg1NDQ4MTIwMTg4NDpqYmJnbGhQTVlFMDVpT3JQZkxlUmhIdlZpTXpRekhEVFhIVUl6RHJwUjJPeHZtR3FnQ3puM3RhYjNrOD0=
MEMORY_PRESSURE_WRITE=c29tZSAyMDAwMDAgMjAwMDA...

[
  {
    "content": "Inspect issue and affected CLI behavior",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add regression coverage and implement fix",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run focused and repository checks",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

Sourcemap for "/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/dist/index.mjs" points to missing source files
 ❯ test/script/package-exports.test.ts (4 tests | 1 failed) 16044ms
     × built ESM entry exposes createSentrySDK 15705ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  test/script/package-exports.test.ts > package.json exports (dual ESM/CJS) > built ESM entry exposes createSentrySDK
Error: Test timed out in 15000ms.
If this is a long-running test, pass a timeout value as the last argument or configure it globally with "testTimeout".
 ❯ test/script/package-exports.test.ts:41:19
     39|   // Only ...

> sentry@0.40.0-dev.0 lint /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> biome check --no-errors-on-unmatched --max-diagnostics=none ./

Checked 951 files in 49s. No fixes applied.

> sentry@0.40.0-dev.0 check:deps /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/check-no-deps.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/check-no-deps.ts

.env.local not found. Continuing without it.
.env.local not found. Continuing without it.
✓ No runtime dependencies in package.json

> sentry@0.40.0-dev.0 check:errors /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/check-error-patterns.ts


> ...

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

Sourcemap for "/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/dist/index.mjs" points to missing source files

 Test Files  1 passed (1)
      Tests  4 passed (4)
   Start at  09:03:00
   Duration  16.11s (transform 14.11s, setup 106ms, import 50ms, tests 15.66s, environment 0ms)

 M .lore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/event.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/explore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/feedback.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/issue.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/log.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/replay.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/span.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/trace.md
 M packages/cli/src/lib/constants.ts
 M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts
diff --git a/packages/cli/src/lib/constants.ts b/packages/cli/src/lib/constants.ts
index 4e707773a..f86998d9a 100644
--- a/packages/cli/src/lib/constants.ts
+++ b/packages/cli/src/lib/constants.ts
@@ -3,6 +3,7 @@
  */
 
 ...

Success. Updated the following files:
M packages/cli/test/lib/constants.test.ts

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli


 Test Files  2 passed (2)
      Tests  32 passed (32)
   Start at  09:04:37
   Duration  6.66s (transform 7.61s, setup 204ms, import 8.35s, tests 2.08s, environment 0ms)

> sentry@0.40.0-dev.0 typecheck /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:docs && pnpm run generate:sdk && tsc --noEmit


> sentry@0.40.0-dev.0 generate:docs /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:banner && pnpm run generate:parser && pnpm run generate:command-docs && pnpm run generate:skill && pnpm run generate:docs-sections


> sentry@0.40.0-dev.0 generate:banner /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/generate-banner-sixel.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/generate-banner-sixel.ts

.env.local not found. Continuing without ...

<task id="ses_f756de1edffeKDWiwJCIyo7X3C" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f756db152ffeSEN6MYxxAnaITc" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
130:   return;
131: }
132: 
133: /**
134:  * Check if authentication is coming from an environment variable.
135:  * Use this to skip refresh/OAuth logic that doesn't apply to env tokens.
136:  */
137: export function isEnvTokenActive(): boolean {
138:   return getEnvToken() !== undefined;
139: }
140: 
141: /**
142:  * Get the name of the env var providing a token, for error messages.
143:  * Returns the specific variable name (e.g. "SENTRY_AUTH_TOKEN" or "SENTRY_TOKEN")
144:  * by checking which env var {@link getRawEnvToken} would read.
145:  * Falls back to "SENTRY_AUTH_TOKEN" if no env var is set.
146:  */
147: export function getActiveEnvVarName(): string {
148:   // Match getRawEnvToken() priority: SENTRY_AUTH_TOKEN first, then SENTRY_TOKEN
149:   if (getEnv().SENTRY_AUTH_TOKEN?.trim()) {
150:     return ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Host-Scoped Token Trust Model
3:  *
4:  * Tokens (env or stored OAuth) are bound to a specific Sentry host. The fetch
5:  * layer (and the `.sentryclirc` / URL-arg entry points) check each request's
6:  * destination against the token's recorded host and refuse to attach
7:  * credentials when they don't match — so untrusted routing inputs can't leak
8:  * credentials to an attacker's host.
9:  *
10:  * Host equivalence:
11:  * - Exact origin match (scheme + host + explicit port).
12:  * - SaaS equivalence class: a token scoped to `https://sentry.io` is valid for
13:  *   any `*.sentry.io` subdomain. Non-SaaS hosts match exactly — no subdomain
14:  *   suffix matching (a `sentry.acme.com` token does NOT match
15:  *   `sentry.acme.evil.com`). ...

Found 19 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/telemetry.ts:
  Line 472:   const customUrl = getConfiguredSentryUrl();


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-urls.ts:
  Line 20:   return getConfiguredSentryUrl() ?? DEFAULT_SENTRY_URL;


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts:
  Line 685:   return getConfiguredSentryUrl() ?? DEFAULT_SENTRY_URL;

  Line 696:   return getConfiguredSentryUrl() ?? DEFAULT_SENTRY_URL;


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/region.ts:
  Line 109:   const baseUrl = ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
640:   headers: Headers;
641:   isLastAttempt: boolean;
642:   timeoutMs: number;
643: };
644: 
645: async function executeAttempt({
646:   input,
647:   init,
648:   headers,
649:   isLastAttempt,
650:   timeoutMs,
651: }: ExecuteAttemptArgs): Promise<AttemptResult> {
652:   try {
653:     const response = await fetchWithTimeout({
654:       input,
655:       init,
656:       headers,
657:       externalSignal: init?.signal,
658:       timeoutMs,
659:     });
660:     return handleResponse(response, headers, isLastAttempt);
661:   } catch (error) {
662:     return handleFetchError(error, init?.signal, isLastAttempt);
663:   }
664: }
665: 
666: /** Singleton authenticated fetch instance - reused across all requests */
667: let cachedFetch: typeof fetch | null = null;
668: 
669: /**
670:  * Get the shared ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/env-token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Env-Token Host Snapshot
3:  *
4:  * Captures the host an env-var auth token (`SENTRY_AUTH_TOKEN` /
5:  * `SENTRY_TOKEN`) is scoped to, BEFORE any post-boot code path can mutate
6:  * `env.SENTRY_HOST`/`env.SENTRY_URL` (specifically before
7:  * `applySentryCliRcEnvShim` writes from a `.sentryclirc` file).
8:  *
9:  * Trust model for the snapshot source:
10:  *
11:  * - `SENTRY_HOST`/`SENTRY_URL` from env are NOT unconditionally trusted.
12:  *   In layered CI environments (e.g. GitHub Actions `$GITHUB_ENV`), a
13:  *   low-privilege step can write env vars that a later high-privilege step
14:  *   inherits — without having read access to `SENTRY_AUTH_TOKEN`. So
15:  *   env-host and env-token may have different integrity levels. ...

Found 19 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts:
  Line 8: import { getEnvTokenHost } from "../env-token-host.js";

  Line 50:  * Uses the BOOT-TIME env snapshot (`getEnvTokenHost`), captured before the

  Line 60:   const bootHost = getEnvTokenHost();

  Line 95:  * Unlike {@link getEnvToken}, this always returns the env token if set, even

  Line 100: export function getRawEnvToken(): string | undefined {

  Line 121: function getEnvToken(): { token: string; source: AuthSource } | undefined {

  Line 138:   return getEnvToken() !== undefined;

  Line 144:  * by checking which env var {@link getRawEnvToken} would read. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
88:   issuedAt?: number;
89:   source: AuthSource;
90: };
91: 
92: /**
93:  * Read the raw token string from environment variables, ignoring all filters.
94:  *
95:  * Unlike {@link getEnvToken}, this always returns the env token if set, even
96:  * when stored OAuth credentials would normally take priority. Used by the HTTP
97:  * layer to check "was an env token provided?" independent of whether it's being
98:  * used, and by the per-endpoint permission cache.
99:  */
100: export function getRawEnvToken(): string | undefined {
101:   const authToken = getEnv().SENTRY_AUTH_TOKEN?.trim();
102:   if (authToken) {
103:     return authToken;
104:   }
105:   const sentryToken = getEnv().SENTRY_TOKEN?.trim();
106:   if (sentryToken) {
107:     return sentryToken;
108:   }
109:   return;
110: }
111: 
112: /**
113:  * Read ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Defense-in-depth: `sntrys_` token claim vs request-origin mismatch.
3:  *
4:  * The fetch-layer guard refuses to attach a `sntrys_` token when its
5:  * embedded `url` claim disagrees with the request origin. Defends users
6:  * with access to multiple Sentry instances against routing one
7:  * instance's token to another. Claim is unsigned (see token-claims.ts),
8:  * so this catches honest misconfigurations more than malicious attacks.
9:  */
10: 
11: import { afterEach, beforeEach, describe, expect, test } from "vitest";
12: import {
13:   extractFetchUrl,
14:   mintSntrysToken,
15:   resetHostScopingState,
16:   useEnvSandbox,
17: } from "../../helpers.js";
18: 
19: const ENV_KEYS = [
20:   "SENTRY_AUTH_TOKEN",
21:   "SENTRY_TOKEN",
22:   "SENTRY_HOST",
23:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/constants.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for normalizeUrl and getConfiguredSentryUrl.
3:  *
4:  * The primary invariant — bare hostnames get `https://` prepended so that
5:  * downstream URL construction produces valid URLs — is tested via property-based
6:  * tests in constants.property.test.ts. These unit tests cover specific edge
7:  * cases and the env-var integration path.
8:  */
9: 
10: import { afterEach, beforeEach, describe, expect, test } from "vitest";
11: import {
12:   getCliEnvironment,
13:   getConfiguredSentryUrl,
14:   normalizeUrl,
15: } from "../../src/lib/constants.js";
16: import { mintSntrysToken } from "../helpers.js";
17: 
18: describe("normalizeUrl", () => {
19:   test("returns undefined for undefined", () => {
20:     expect(normalizeUrl(undefined)).toBeUndefined();
21:   });
22: 
23:   test("returns ...

Found 100 matches (more matches available)
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/e2e/trace.test.ts:
  Line 63:     await ctx.setAuthToken(TEST_TOKEN);

  Line 75:     await ctx.setAuthToken(TEST_TOKEN);

  Line 92:     await ctx.setAuthToken(TEST_TOKEN);

  Line 106:     await ctx.setAuthToken(TEST_TOKEN);

  Line 122:     await ctx.setAuthToken(TEST_TOKEN);

  Line 144:     await ctx.setAuthToken(TEST_TOKEN);

  Line 153:     await ctx.setAuthToken(TEST_TOKEN);

  Line 167:     await ctx.setAuthToken(TEST_TOKEN);

  Line 185:     await ctx.setAuthToken(TEST_TOKEN);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/e2e/project.test.ts:
  Line 59:     await ctx.setAuthToken(TEST_TOKEN);

  Line 69:     await ctx.setAuthToken(TEST_TOKEN);

  Line 92:       await ctx.setAuthToken(TEST_TOKEN);

  Line 108:     await ctx.setAuthToken(TEST_TOKEN);

 ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
380:  *   currently-configured host (`SENTRY_HOST`/`SENTRY_URL`) or `DEFAULT_SENTRY_URL`.
381:  */
382: export type SetAuthTokenOptions = {
383:   host?: string;
384: };
385: 
386: export function setAuthToken(
387:   token: string,
388:   expiresIn?: number,
389:   newRefreshToken?: string,
390:   options?: SetAuthTokenOptions
391: ): void {
392:   withDbSpan("setAuthToken", () => {
393:     const db = getDatabase();
394:     const now = Date.now();
395:     const expiresAt = expiresIn ? now + expiresIn * 1000 : null;
396:     const issuedAt = expiresIn ? now : null;
397: 
398:     // Host resolution precedence:
399:     //   1. Explicit `options.host` (login command, tests)
400:     //   2. Existing row's `host` (refresh flow preserves the original scope)
401:     //   3. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/auth.host.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for host-scoped auth: setAuthToken persistence, getStoredAuthHost,
3:  * NULL-host lazy migration, host preservation across refresh-style updates.
4:  */
5: 
6: import { describe, expect, test } from "vitest";
7: import {
8:   getStoredAuthHost,
9:   hasUsableStoredToken,
10:   setAuthToken,
11: } from "../../../src/lib/db/auth.js";
12: import { getDatabase } from "../../../src/lib/db/index.js";
13: import { useTestConfigDir } from "../../helpers.js";
14: 
15: describe("db/auth host scoping", () => {
16:   useTestConfigDir("auth-host-test-");
17: 
18:   test("setAuthToken persists explicit host", () => {
19:     setAuthToken("tok-1", undefined, undefined, {
20:       host: "https://sentry.acme.com",
21:     });
22:     expect(getStoredAuthHost()).toBe("https://sentry.acme.com");
23:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-urls.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry URL Utilities
3:  *
4:  * Utilities for constructing Sentry web URLs.
5:  * Supports self-hosted instances via SENTRY_URL environment variable.
6:  */
7: 
8: import {
9:   DEFAULT_SENTRY_HOST,
10:   DEFAULT_SENTRY_URL,
11:   getConfiguredSentryUrl,
12:   normalizeUrl,
13: } from "./constants.js";
14: 
15: /**
16:  * Get the Sentry web base URL.
17:  * Supports self-hosted instances via SENTRY_URL env var.
18:  */
19: export function getSentryBaseUrl(): string {
20:   return getConfiguredSentryUrl() ?? DEFAULT_SENTRY_URL;
21: }
22: 
23: /**
24:  * Build the org-scoped base URL using the subdomain pattern.
25:  * E.g. "https://sentry.io" + "my-org" → "https://my-org.sentry.io"
26:  *
27:  * @param orgSlug - Organization slug
28:  * @returns Origin URL with org as subdomain
29:  */
30: export ...

Found 2 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts:
  Line 439: export async function clearAuth(): Promise<void> {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/helpers.ts:
  Line 104: export function useTestConfigDir(

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/helpers.ts</path>
<type>file</type>
<content>
85: export function mockFetch(fn: FetchMockFn): typeof fetch {
86:   return fn as unknown as typeof fetch;
87: }
88: 
89: /**
90:  * Sets up an isolated test config directory with proper env var lifecycle.
91:  *
92:  * Registers beforeEach/afterEach hooks that create a unique config directory,
93:  * point SENTRY_CONFIG_DIR at it, and restore the original value on teardown.
94:  * This eliminates the fragile pattern of manually managing process.env in
95:  * each test file, which caused cross-file pollution when afterEach hooks
96:  * deleted the env var while other files were still loading.
97:  *
98:  * Must be called at module scope or inside a describe() block.
99:  *
100:  * @param prefix - Directory name prefix for the temp directory
101:  * @param options - Configuration options (e.g., isolateProjectRoot)
102:  * ...

/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentry-client.test.ts
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentry-client.invalidation.test.ts

Found 4 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentry-client.test.ts:
  Line 7: import { setAuthToken } from "../../src/lib/db/auth.js";

  Line 15: import { mockFetch, useTestConfigDir } from "../helpers.js";

  Line 17: useTestConfigDir("sentry-client-");

  Line 25:   await setAuthToken("test-token");

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentry-client.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for the authenticated fetch retry + timeout behavior — CLI-1D6
3:  * regression coverage.
4:  */
5: 
6: import { afterEach, beforeEach, describe, expect, test } from "vitest";
7: import { setAuthToken } from "../../src/lib/db/auth.js";
8: import { TimeoutError } from "../../src/lib/errors.js";
9: import {
10:   __injectTimeoutOverrideForTests,
11:   __resolveRequestTimeoutMsForTests,
12:   getSdkConfig,
13:   resetAuthenticatedFetch,
14: } from "../../src/lib/sentry-client.js";
15: import { mockFetch, useTestConfigDir } from "../helpers.js";
16: 
17: useTestConfigDir("sentry-client-");
18: 
19: let originalFetch: typeof globalThis.fetch;
20: const REGION_URL = "https://us.sentry.io";
21: 
22: beforeEach(async () => {
23:   originalFetch = globalThis.fetch;
24:   // Non-expiring token — ...

Success. Updated the following files:
M packages/cli/src/lib/constants.ts
M packages/cli/src/lib/sentry-client.ts
M packages/cli/test/lib/constants.test.ts
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

 ❯ test/lib/security/sntrys-claim-mismatch.test.ts (9 tests | 1 failed) 1102ms
     × claim URL routes requests when no explicit URL is configured 8ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  test/lib/security/sntrys-claim-mismatch.test.ts > CVE defense-in-depth: sntrys_ claim vs request mismatch > claim URL routes requests when no explicit URL is configured
Error: Calling the test function inside another test function is not allowed. Please put it inside "describe" or "suite" so it can be properly collected.
 ❯ test/lib/security/sntrys-claim-mismatch.test.ts:137:2
    135|  });
    136|
    137|  test("stored OAuth host takes precedence over an inactive env token c…
   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts</path>
<type>file</type>
<content>
115:     );
116:     captureEnvTokenHost();
117: 
118:     // Request to the host the claim agrees with → bearer attaches.
119:     const { apiRequestToRegion } = await import(
120:       "../../../src/lib/api/infrastructure.js"
121:     );
122:     await apiRequestToRegion("https://sentry.acme.com", "/organizations/", {
123:       method: "GET",
124:     });
125: 
126:     expect(fetchCalls).toHaveLength(1);
127:     expect(fetchCalls[0]?.auth).toContain("Bearer ");
128:   });
129: 
130: 	test("claim URL routes requests when no explicit URL is configured", async () => {
131:     process.env.SENTRY_AUTH_TOKEN = mintSntrysToken({
132:       iat: 1_700_000_000,
133:       url: "http://localhost:8000",
134:       org: "x",
135: 	});
136: 
137: 	test("stored OAuth host takes precedence over an ...

Success. Updated the following files:
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  2 passed (2)
      Tests  33 passed (33)
   Start at  09:21:41
   Duration  3.53s (transform 2.37s, setup 159ms, import 2.14s, tests 1.24s, environment 0ms)

> sentry@0.40.0-dev.0 typecheck /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:docs && pnpm run generate:sdk && tsc --noEmit


> sentry@0.40.0-dev.0 generate:docs /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:banner && pnpm run generate:parser && pnpm run generate:command-docs && pnpm run generate:skill && pnpm run generate:docs-sections


> sentry@0.40.0-dev.0 generate:banner /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/generate-banner-sixel.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/generate-banner-sixel.ts

.env.local not found. Continuing without ...

Formatted 4 files in 20ms. Fixed 4 files.
 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  2 passed (2)
      Tests  33 passed (33)
   Start at  09:23:17
   Duration  3.71s (transform 2.59s, setup 175ms, import 2.24s, tests 1.36s, environment 0ms)


> sentry@0.40.0-dev.0 typecheck /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:docs && pnpm run generate:sdk && tsc --noEmit


> sentry@0.40.0-dev.0 generate:docs ...

...output truncated...

Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_08aa5ba17001qMEMpKbgc5VOC4

[info] No server detected, starting one in the background...
[info] Background server listening on http://127.0.0.1:19879
[info] Starting: nonexistent-command-that-does-not-exist
[info] SENTRY_SPOTLIGHT=http://127.0.0.1:19879/stream
[info] Stopping background server...
[info] No server detected, starting one in the background...
[info] Background server listening on http://127.0.0.1:19880
[info] Starting: true
[info] SENTRY_SPOTLIGHT=http://127.0.0.1:19880/stream
[info] Stopping background server...
[info] No server detected, starting one in the background...
[info] Background server listening on http://127.0.0.1:19881
[info] Starting: printenv
[info] SENTRY_SPOTLIGHT=http://127.0.0.1:19881/stream
[info] Stopping background server...
OPENCODE_DISABLE_CHANNEL_DB=1
USER=byk
npm_config_user_agent=pnpm/10.11.0 npm/? node/v24.16.0 linux ...

[
  {
    "content": "Inspect issue and affected CLI behavior",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add regression coverage and implement fix",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run focused and repository checks",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "in_progress",
    "priority": "medium"
  }
]

> sentry@0.40.0-dev.0 check:deps /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/check-no-deps.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/check-no-deps.ts

.env.local not found. Continuing without it.
.env.local not found. Continuing without it.
✓ No runtime dependencies in package.json

> sentry@0.40.0-dev.0 check:errors /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/check-error-patterns.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/check-error-patterns.ts

.env.local not found. ...

<task id="ses_f75566a54ffezgWSWXjMJrPrN1" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f75564b8cffeuB7Nyp76Re1IuM" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/region.ts</path>
<type>file</type>
<content>
1: /**
2:  * Region resolution for multi-region Sentry support.
3:  *
4:  * Provides utilities to resolve the correct region URL for an organization,
5:  * using cached data when available or fetching from the API when needed.
6:  */
7: 
8: import { getOrganization } from "@sentry/api";
9: import { getConfiguredSentryUrl } from "./constants.js";
10: import { getOrgByNumericId, getOrgRegion, setOrgRegion } from "./db/regions.js";
11: import { stripDsnOrgPrefix } from "./dsn/index.js";
12: import { withAuthGuard } from "./errors.js";
13: import { getSdkConfig } from "./sentry-client.js";
14: import { getSentryBaseUrl, isSentrySaasUrl } from "./sentry-urls.js";
15: 
16: /**
17:  * Promise cache for org region resolution, keyed by orgSlug. ...

/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/region.test.ts
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/api-client.multiregion.test.ts

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/region.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Region Resolution Tests
3:  *
4:  * Tests for resolving organization regions in multi-region Sentry support.
5:  */
6: 
7: import { setTimeout as sleep } from "node:timers/promises";
8: import { afterEach, beforeEach, describe, expect, test } from "vitest";
9: import { setAuthToken } from "../../src/lib/db/auth.js";
10: import { setOrgRegion } from "../../src/lib/db/regions.js";
11: import {
12:   isMultiRegionEnabled,
13:   resolveOrgRegion,
14: } from "../../src/lib/region.js";
15: import { getSentryBaseUrl } from "../../src/lib/sentry-urls.js";
16: import { useTestConfigDir } from "../helpers.js";
17: 
18: useTestConfigDir("region-resolve-");
19: 
20: beforeEach(async () => {
21:   // Clear any SENTRY_HOST/SENTRY_URL override for most tests
22:   delete process.env.SENTRY_HOST;
23:   delete ...

Found 1 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/region.ts:
  Line 107: export function isMultiRegionEnabled(): boolean {

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/region.test.ts</path>
<type>file</type>
<content>
170:   });
171: 
172:   test("uses default URL as region when org has no links.regionUrl", async () => {
173:     // Mock fetch to return org without links
174:     const originalFetch = globalThis.fetch;
175:     globalThis.fetch = async (input: RequestInfo | URL, init?: RequestInit) => {
176:       const req = new Request(input, init);
177:       if (req.url.includes("/organizations/no-links-org/")) {
178:         return new Response(
179:           JSON.stringify({
180:             id: "456",
181:             slug: "no-links-org",
182:             name: "Org Without Links",
183:             // No links field
184:           }),
185:           {
186:             status: 200,
187:             headers: { "Content-Type": "application/json" },
188:           }
189:         );
190:       }
191:       return new ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Host-Scoped Token Trust Model
3:  *
4:  * Tokens (env or stored OAuth) are bound to a specific Sentry host. The fetch
5:  * layer (and the `.sentryclirc` / URL-arg entry points) check each request's
6:  * destination against the token's recorded host and refuse to attach
7:  * credentials when they don't match — so untrusted routing inputs can't leak
8:  * credentials to an attacker's host.
9:  *
10:  * Host equivalence:
11:  * - Exact origin match (scheme + host + explicit port).
12:  * - SaaS equivalence class: a token scoped to `https://sentry.io` is valid for
13:  *   any `*.sentry.io` subdomain. Non-SaaS hosts match exactly — no subdomain
14:  *   suffix matching (a `sentry.acme.com` token does NOT match
15:  *   `sentry.acme.evil.com`). ...

No files found

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/env-token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Env-Token Host Snapshot
3:  *
4:  * Captures the host an env-var auth token (`SENTRY_AUTH_TOKEN` /
5:  * `SENTRY_TOKEN`) is scoped to, BEFORE any post-boot code path can mutate
6:  * `env.SENTRY_HOST`/`env.SENTRY_URL` (specifically before
7:  * `applySentryCliRcEnvShim` writes from a `.sentryclirc` file).
8:  *
9:  * Trust model for the snapshot source:
10:  *
11:  * - `SENTRY_HOST`/`SENTRY_URL` from env are NOT unconditionally trusted.
12:  *   In layered CI environments (e.g. GitHub Actions `$GITHUB_ENV`), a
13:  *   low-privilege step can write env vars that a later high-privilege step
14:  *   inherits — without having read access to `SENTRY_AUTH_TOKEN`. So
15:  *   env-host and env-token may have different integrity levels. ...

Found 22 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/telemetry.ts:
  Line 709:     Sentry.setTag("is_self_hosted", !isSentrySaasUrl(getSentryBaseUrl()));


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/region.ts:
  Line 73:   const baseUrl = getSentryBaseUrl();


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/resolve-team.ts:
  Line 234:     const teamsUrl = `${getSentryBaseUrl()}/settings/${orgSlug}/teams/`;

  Line 271:         `Create a team manually at ${getSentryBaseUrl()}/settings/${orgSlug}/teams/` +


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-urls.ts:
  Line 19: export function getSentryBaseUrl(): string {

  Line 31:   const base = getSentryBaseUrl();

  Line 51:   return ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Defense-in-depth: `sntrys_` token claim vs request-origin mismatch.
3:  *
4:  * The fetch-layer guard refuses to attach a `sntrys_` token when its
5:  * embedded `url` claim disagrees with the request origin. Defends users
6:  * with access to multiple Sentry instances against routing one
7:  * instance's token to another. Claim is unsigned (see token-claims.ts),
8:  * so this catches honest misconfigurations more than malicious attacks.
9:  */
10: 
11: import { afterEach, beforeEach, describe, expect, test } from "vitest";
12: import {
13:   extractFetchUrl,
14:   mintSntrysToken,
15:   resetHostScopingState,
16:   useEnvSandbox,
17:   useTestConfigDir,
18: } from "../../helpers.js";
19: 
20: const ENV_KEYS = [
21:   "SENTRY_AUTH_TOKEN",
22:   "SENTRY_TOKEN",
23:   ...

Success. Updated the following files:
M packages/cli/src/lib/region.ts
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

Formatted 2 files in 17ms. No fixes applied.
 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  3 passed (3)
      Tests  57 passed (57)
   Start at  09:45:11
   Duration  14.93s (transform 9.43s, setup 511ms, import 11.88s, tests 9.99s, environment 0ms)

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
100:  * - apiRequestToRegion always sends JSON and sets it explicitly
101:  * - rawApiRequest may or may not want Content-Type (e.g., string bodies)
102:  *
103:  * When `init` is undefined (the SDK passes only a Request object), headers are
104:  * read from the Request object to preserve Content-Type and other headers set
105:  * by the SDK. Without this, fetch(Request, {headers}) would override the
106:  * Request's headers with our empty headers, stripping Content-Type and causing
107:  * HTTP 415 errors on Node.js (which strictly follows the spec).
108:  *
109:  * The returned Headers instance is intentionally shared and mutated across
110:  * retry attempts (e.g., handleUnauthorized updates the Authorization header
111:  * and sets the retry marker). Do not clone before passing to retry logic. ...

Success. Updated the following files:
M packages/cli/src/lib/region.ts
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

Formatted 2 files in 12ms. No fixes applied.
 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  3 passed (3)
      Tests  58 passed (58)
   Start at  09:46:27
   Duration  11.56s (transform 6.24s, setup 340ms, import 7.27s, tests 8.57s, environment 0ms)

[
  {
    "content": "Inspect issue and affected CLI behavior",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add regression coverage and implement fix",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run focused and repository checks",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

...output truncated...

Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_08abc0f79001UysArZWBo4Z8c9

INVOCATION_ID=fd0d560894e2412f992cb6ae08ef3060
npm_package_name=sentry
NODE=/home/byk/.volta/tools/image/node/24.16.0/bin/node
OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS=1
npm_config_frozen_lockfile=
OPENCODE_WATCHER_PATH=/home/byk/.opencode/server/native/watcher.node
LANG=en_US.UTF-8
OPENCODE_PID=878473
npm_lifecycle_script=pnpm run generate:docs && pnpm run generate:sdk && vitest run test/lib test/commands test/types test/script ...

> sentry@0.40.0-dev.0 typecheck /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:docs && pnpm run generate:sdk && tsc --noEmit


> sentry@0.40.0-dev.0 generate:docs /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:banner && pnpm run generate:parser && pnpm run generate:command-docs && pnpm run generate:skill && pnpm run generate:docs-sections


> sentry@0.40.0-dev.0 generate:banner /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/generate-banner-sixel.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/generate-banner-sixel.ts

.env.local not found. Continuing without ...

> sentry@0.40.0-dev.0 lint /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> biome check --no-errors-on-unmatched --max-diagnostics=none ./

Checked 951 files in 50s. No fixes applied.

> sentry@0.40.0-dev.0 check:deps /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/check-no-deps.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/check-no-deps.ts

.env.local not found. Continuing without it.
.env.local not found. Continuing without it.
✓ No runtime dependencies in package.json

> sentry@0.40.0-dev.0 check:errors /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/check-error-patterns.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/check-error-patterns.ts

.env.local not found. ...

 M .lore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/event.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/explore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/feedback.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/issue.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/log.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/replay.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/span.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/trace.md
 M packages/cli/src/lib/constants.ts
 M packages/cli/src/lib/region.ts
 M packages/cli/src/lib/sentry-client.ts
 M packages/cli/test/lib/constants.test.ts
 M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts
 .lore.md                                           | 700 ++++++++++++---------
 ...

<task id="ses_f753cd272ffez6j5NRjoqzR2Pi" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f753ca80effePf1HrxePj0PnQk" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts</path>
<type>file</type>
<content>
1: /**
2:  * Organization region cache for multi-region support.
3:  *
4:  * Sentry has multiple regions (US, EU, etc.) and organizations are bound
5:  * to a specific region. This module caches the organization-to-region
6:  * mapping to avoid repeated lookups.
7:  *
8:  * The `org_id` column (added in schema v8) enables offline resolution
9:  * of numeric org IDs extracted from DSN hosts (e.g., `o1081365` →
10:  * look up by `org_id = '1081365'` → get the slug).
11:  */
12: 
13: import { normalizeOrigin } from "../sentry-urls.js";
14: import { recordCacheHit } from "../telemetry.js";
15: import { getDatabase } from "./index.js";
16: import { runUpsert } from "./utils.js";
17: 
18: const TABLE = "org_regions";
19: 
20: /**
21:  * Process-local trust extension: origins that were vouched for by the
22:  * active ...

Found 11 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/projects.ts:
  Line 75:   // Mirrors how listOrganizations() calls setOrgRegions().


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/organizations.ts:
  Line 165:   setOrgRegions(regionEntries);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts:
  Line 52:     // setOrgRegion(s) or registerTrustedRegionUrls.

  Line 64: export function registerTrustedRegionUrls(urls: readonly string[]): void {

  Line 182: export function setOrgRegion(orgSlug: string, regionUrl: string): void {

  Line 192:   registerTrustedRegionUrls([regionUrl]);

  Line 197:  * More efficient than calling setOrgRegion() multiple times. ...

Found 13 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts:
  Line 164:   org_regions: {

  Line 744:   // Migration 1 -> 2: Add org_regions, user_info, and instance_info tables

  Line 747:       ${EXPECTED_TABLES.org_regions};

  Line 796:   // Migration 7 -> 8: Add org_id column to org_regions for numeric ID lookups

  Line 798:     addColumnIfMissing(db, "org_regions", "org_id", "TEXT");

  Line 801:   // Migration 8 -> 9: Add org_name column to org_regions for cached org listing

  Line 803:     addColumnIfMissing(db, "org_regions", "org_name", "TEXT");

  Line 806:   // Migration 9 -> 10: Add org_role column to org_regions for cached role lookups

  Line 808:     addColumnIfMissing(db, "org_regions", "org_role", "TEXT");


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts:
  Line 18: const TABLE = ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
145:       },
146:     },
147:   },
148:   pagination_cursors: {
149:     columns: {
150:       command_key: { type: "TEXT", notNull: true },
151:       context: { type: "TEXT", notNull: true },
152:       cursor_stack: { type: "TEXT", notNull: true },
153:       page_index: { type: "INTEGER", notNull: true, default: "0" },
154:       expires_at: { type: "INTEGER", notNull: true },
155:     },
156:     compositePrimaryKey: ["command_key", "context"],
157:   },
158:   metadata: {
159:     columns: {
160:       key: { type: "TEXT", primaryKey: true },
161:       value: { type: "TEXT", notNull: true },
162:     },
163:   },
164:   org_regions: {
165:     columns: {
166:       org_slug: { type: "TEXT", primaryKey: true },
167:       org_id: { type: "TEXT", addedInVersion: 8 },
168:       org_name: { type: "TEXT", ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
650:  * 2. Runs repairSchema() to fix missing tables/columns
651:  * 3. Retries the original operation
652:  *
653:  * @param operation - The failed operation to retry after repair
654:  * @param error - The error that triggered the repair attempt
655:  * @returns An object indicating whether repair was attempted and the result.
656:  *          When `attempted` is false, the caller should re-throw the original error.
657:  *          When `attempted` is true, use `result` (which may be undefined for queries
658:  *          like stmt.get() that legitimately return undefined). ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
824:     db.exec(EXPECTED_TABLES.pagination_cursors as string);
825:   }
826: 
827:   // Migration 12 -> 13: Consolidate defaults into metadata KV table.
828:   // The single-row `defaults` table was never written by production code.
829:   // Move any data (from JSON migration or manual DB edits) to metadata,
830:   // then drop the table. New defaults use metadata keys: defaults.org,
831:   // defaults.project, defaults.telemetry, defaults.url.
832:   if (currentVersion < 13 && tableExists(db, "defaults")) {
833:     const row = db
834:       .query("SELECT organization, project FROM defaults WHERE id = 1")
835:       .get() as { organization: string | null; project: string | null } | null;
836:     if (row?.organization) {
837:       db.query(
838:         "INSERT OR REPLACE INTO metadata (key, value) VALUES (?, ...

Found 3 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/region.ts:
  Line 67:   const cached = getOrgRegion(orgSlug);

  Line 127:   const cached = getOrgRegion(orgSlug);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts:
  Line 141: export function getOrgRegion(orgSlug: string): string | undefined {

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/organizations.ts</path>
<type>file</type>
<content>
100:  * any HTTP requests. This avoids the org listing API round-trip
101:  * (~200-400ms) on every command.
102:  *
103:  * Callers that need guaranteed-fresh data (e.g., `org list`, `auth status`)
104:  * should use {@link listOrganizationsUncached} instead.
105:  */
106: export async function listOrganizations(): Promise<SentryOrganization[]> {
107:   const { getCachedOrganizations } = await import("../db/regions.js");
108: 
109:   const cached = getCachedOrganizations();
110:   if (cached.length > 0) {
111:     return cached.map((org) => ({
112:       id: org.id,
113:       slug: org.slug,
114:       name: org.name,
115:       ...(org.orgRole ? { orgRole: org.orgRole } : {}),
116:     }));
117:   }
118: 
119:   // Cache miss — fetch from API (also populates cache for next time)
120:   return ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts</path>
<type>file</type>
<content>
195: /**
196:  * Cache region URLs for multiple organizations in a single transaction.
197:  * More efficient than calling setOrgRegion() multiple times.
198:  *
199:  * Each entry includes the org slug, region URL, and optionally the
200:  * numeric org ID for offline ID→slug lookups.
201:  *
202:  * @param entries - Array of org region entries
203:  */
204: export function setOrgRegions(entries: OrgRegionEntry[]): void {
205:   if (entries.length === 0) {
206:     return;
207:   }
208: 
209:   const db = getDatabase();
210:   const now = Date.now();
211: 
212:   db.transaction(() => {
213:     for (const entry of entries) {
214:       const row: Record<string, string | number | null> = {
215:         org_slug: entry.slug,
216:         region_url: entry.regionUrl,
217:         updated_at: now,
218:       };
219:   ...

Found 100 matches (more matches available)
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/api-client.test.ts:
  Line 852:     setOrgRegions([

  Line 1110:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1187:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1244:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1437:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1574:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1753:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1868:     setOrgRegions([

  Line 1919:     setOrgRegions([

  Line 1971:     setOrgRegions([


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/api-client.seer.test.ts:
  Line 27:   setOrgRegion("test-org", ...

Found 2 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/org/list.ts:
  Line 144:     const orgRegions = getAllOrgRegions();


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts:
  Line 250: export function getAllOrgRegions(): Map<string, string> {

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
240:  * Execute a single fetch attempt with timeout. If the timeout fires, the
241:  * thrown error is tagged with {@link INTERNAL_TIMEOUT_MARKER} so the retry
242:  * loop can distinguish it from a user abort or network error.
243:  */
244: async function fetchWithTimeout({
245:   input,
246:   init,
247:   headers,
248:   externalSignal,
249:   timeoutMs,
250: }: FetchWithTimeoutArgs): Promise<Response> {
251:   const controller = new AbortController();
252:   let timedOut = false;
253:   const timeout = setTimeout(() => {
254:     timedOut = true;
255:     controller.abort();
256:   }, timeoutMs);
257:   linkAbortSignal(externalSignal, controller);
258: 
259:   try {
260:     // Spread custom TLS options (CA certs for corporate proxies). ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry API Client Configuration
3:  *
4:  * Provides request configuration for @sentry/api SDK functions,
5:  * including authentication, retry logic, timeout, and multi-region support.
6:  *
7:  * Instead of managing client instances, we pass configuration per-request
8:  * through the SDK function options (baseUrl, fetch, headers).
9:  */
10: 
11: import { setTimeout as sleepMs } from "node:timers/promises";
12: import { getTraceData } from "@sentry/node-core/light";
13: import { maybeWarnEnvTokenIgnored } from "./auth-hint.js";
14: import { computeInvalidationPrefixes } from "./cache-keys.js";
15: import {
16:   DEFAULT_SENTRY_URL,
17:   getConfiguredSentryUrl,
18:   getUserAgent,
19: } from "./constants.js";
20: import {
21:   buildTlsErrorDetail,
22:   getCustomTlsOptions,
23:   ...

Found 26 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/completions.ts:
  Line 23: export type CompletionLocation = {

  Line 628:  * @returns Location info if installed, null if shell not supported or path not writable

  Line 634: ): Promise<CompletionLocation | null> {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/ghcr.ts:
  Line 348:       redirect: "manual",

  Line 365:     blobResponse.status === 301 ||

  Line 366:     blobResponse.status === 302 ||

  Line 367:     blobResponse.status === 307 ||

  Line 368:     blobResponse.status === 308

  Line 374:         `GHCR blob redirect (${blobResponse.status}) had no Location header`


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/agent-skills.ts:
  Line 19: export type AgentSkillLocation = {

  Line 107: ): ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/ghcr.ts</path>
<type>file</type>
<content>
315:   return layer;
316: }
317: 
318: /**
319:  * Download a nightly binary blob from GHCR and write it to disk.
320:  *
321:  * The blob endpoint returns a 307 redirect to a signed Azure Blob Storage URL.
322:  * `fetch` with `redirect: "follow"` would forward the Authorization header
323:  * to Azure, which returns 404. We must:
324:  * 1. Fetch the blob URL without following redirects to get the redirect URL.
325:  * 2. Follow the redirect URL without the Authorization header.
326:  *
327:  * @param token - Anonymous bearer token from {@link getAnonymousToken}
328:  * @param digest - Layer digest to download (e.g., "sha256:abc123...")
329:  * @returns Raw response body (gzip-compressed binary)
330:  * @throws {UpgradeError} On network failure or bad response
331:  */
332: export async function ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/region.ts</path>
<type>file</type>
<content>
115: 
116: /**
117:  * Try to resolve an org identifier from the local org cache.
118:  *
119:  * Checks the slug directly first, then falls back to DSN-style numeric ID
120:  * lookup (stripping the `o` prefix and querying by `org_id`).
121:  *
122:  * @param orgSlug - Raw org identifier (may be a slug or `oNNNNN` DSN form)
123:  * @returns The resolved slug if found in cache, `undefined` on cache miss
124:  */
125: function resolveOrgFromCache(orgSlug: string): string | undefined {
126:   // Check if slug is directly cached
127:   const cached = getOrgRegion(orgSlug);
128:   if (cached) {
129:     return orgSlug;
130:   }
131: 
132:   // Try DSN-style numeric ID lookup (e.g., `o1081365` → `1081365` → slug)
133:   const numericId = stripDsnOrgPrefix(orgSlug);
134:   if (numericId !== orgSlug) {
135:     const match = ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
390:   method: string,
391:   fullUrl: string,
392:   requestHeaders: Record<string, string>
393: ): Promise<Response | undefined> {
394:   if (method !== "GET") {
395:     return;
396:   }
397:   return await getCachedResponse(method, fullUrl, requestHeaders);
398: }
399: 
400: /**
401:  * Store a successful GET response in the cache (fire-and-forget).
402:  * Clones the response so the original body stream is preserved for the caller.
403:  *
404:  * @param requestHeaders - Headers sent with the request, stored in CachePolicy
405:  *   for future `Vary`-aware freshness checks.
406:  */
407: function cacheResponse(
408:   method: string,
409:   fullUrl: string,
410:   requestHeaders: Record<string, string>,
411:   response: Response
412: ): void {
413:   if (method !== "GET" || !response.ok) {
414:     ...

No files found

Found 53 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/teams.ts:
  Line 21:   getOrgSdkConfig,

  Line 32:   const config = await getOrgSdkConfig(orgSlug);

  Line 54:   const config = await getOrgSdkConfig(orgSlug);

  Line 82:   const config = await getOrgSdkConfig(orgSlug);

  Line 109:   const config = await getOrgSdkConfig(orgSlug);

  Line 144:   const config = await getOrgSdkConfig(orgSlug);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/repositories.ts:
  Line 16:   getOrgSdkConfig,

  Line 35:   const config = await getOrgSdkConfig(orgSlug);

  Line 60:   const config = await getOrgSdkConfig(orgSlug);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/replays.ts:
  Line 31:   getOrgSdkConfig,

  Line 306:   const config = await ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/infrastructure.ts</path>
<type>file</type>
<content>
320:  * @internal Exported for testing
321:  */
322: export function buildSearchParams(
323:   params?: Record<string, string | number | boolean | string[] | undefined>
324: ): URLSearchParams | undefined {
325:   if (!params) {
326:     return;
327:   }
328: 
329:   const searchParams = new URLSearchParams();
330:   for (const [key, value] of Object.entries(params)) {
331:     if (value === undefined) {
332:       continue;
333:     }
334:     if (Array.isArray(value)) {
335:       for (const item of value) {
336:         searchParams.append(key, item);
337:       }
338:     } else {
339:       searchParams.set(key, String(value));
340:     }
341:   }
342: 
343:   return searchParams.toString() ? searchParams : undefined;
344: }
345: 
346: /**
347:  * Get SDK config for an organization's region. ...

No files found

Found 5 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts:
  Line 22: export const CURRENT_SCHEMA_VERSION = 16;

  Line 581:         CURRENT_SCHEMA_VERSION

  Line 719:       CURRENT_SCHEMA_VERSION

  Line 872:   if (currentVersion < CURRENT_SCHEMA_VERSION) {

  Line 874:       CURRENT_SCHEMA_VERSION

Found 1 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/errors.ts:
  Line 175: export class ApiError extends CliError {

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/errors.ts</path>
<type>file</type>
<content>
155:       super(
156:         `${sourceOrMessage}: ${destinationUrl}\n` +
157:           `Refusing to route requests here because it doesn't match the host your Sentry credentials are for (${tokenHost}).\n` +
158:           `To use this host, run: sentry auth login --url ${destinationUrl}\n` +
159:           "To keep using your current credentials, remove this URL override.",
160:         EXIT.AUTH_HOST_SCOPE
161:       );
162:     }
163:     this.name = "HostScopeError";
164:   }
165: }
166: 
167: /**
168:  * API request errors from Sentry. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/org/list.ts</path>
<type>file</type>
<content>
1: /**
2:  * sentry org list
3:  *
4:  * List organizations the user has access to.
5:  */
6: 
7: import type { SentryContext } from "../../context.js";
8: import { listOrganizationsUncached } from "../../lib/api-client.js";
9: import { buildCommand } from "../../lib/command.js";
10: import { DEFAULT_SENTRY_HOST } from "../../lib/constants.js";
11: import { getAllOrgRegions } from "../../lib/db/regions.js";
12: import { escapeMarkdownCell } from "../../lib/formatters/markdown.js";
13: import { CommandOutput } from "../../lib/formatters/output.js";
14: import { type Column, writeTable } from "../../lib/formatters/table.js";
15: import {
16:   applyFreshFlag,
17:   buildListLimitFlag,
18:   FRESH_ALIASES,
19:   FRESH_FLAG,
20: } from "../../lib/list-command.js";
21: import { withProgress } from ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/custom-headers.ts</path>
<type>file</type>
<content>
160: 
161:   return;
162: }
163: 
164: /**
165:  * Get the parsed custom headers for the current session.
166:  *
167:  * Returns an empty array when:
168:  * - No custom headers are configured (env var or defaults)
169:  * - The target is not a self-hosted instance (warns once if headers are set)
170:  *
171:  * Parsed results are cached; the self-hosted guard is re-evaluated per call
172:  * because `SENTRY_HOST` can be set dynamically by URL argument parsing.
173:  */
174: export function getCustomHeaders(): readonly [string, string][] {
175:   const raw = resolveRawHeaders();
176:   if (!raw) {
177:     return [];
178:   }
179: 
180:   // Self-hosted guard: warn once and skip on SaaS
181:   if (!isSelfHosted()) {
182:     if (!saasWarningLogged) {
183:       saasWarningLogged = true;
184:       ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
1: /**
2:  * Database schema DDL and version management.
3:  *
4:  * This module defines the canonical schema for the CLI's SQLite database,
5:  * handles migrations between versions, and provides repair utilities for
6:  * fixing schema inconsistencies.
7:  *
8:  * Schema is defined once in TABLE_SCHEMAS and used to generate:
9:  * - DDL statements for table creation
10:  * - Column lists for schema repair
11:  * - Migration checks
12:  */
13: 
14: import { createRequire } from "node:module";
15: import { getEnv } from "../env.js";
16: import { stringifyUnknown } from "../errors.js";
17: import { logger } from "../logger.js";
18: import type { Database } from "./sqlite.js";
19: 
20: const _require = createRequire(import.meta.url);
21: 
22: export const CURRENT_SCHEMA_VERSION = 16;
23: 
24: /** Environment variable ...

Found 17 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts:
  Line 164:   org_regions: {

  Line 745:   if (currentVersion < 2) {

  Line 754:   if (currentVersion < 3) {

  Line 759:   if (currentVersion < 4) {

  Line 771:   if (currentVersion < 5) {

  Line 780:     currentVersion < 6 &&

  Line 792:   if (currentVersion < 7) {

  Line 797:   if (currentVersion < 8) {

  Line 802:   if (currentVersion < 9) {

  Line 807:   if (currentVersion < 10) {

  Line 812:   if (currentVersion < 11) {

  Line 820:   if (currentVersion < 12) {

  Line 832:   if (currentVersion < 13 && tableExists(db, "defaults")) {

  Line 852:   if (currentVersion < 14) {

  Line 859:   if (currentVersion < 15) {

  Line 868:   if (currentVersion < 16) {

  Line 872:   if (currentVersion < CURRENT_SCHEMA_VERSION) {

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
145:       },
146:     },
147:   },
148:   pagination_cursors: {
149:     columns: {
150:       command_key: { type: "TEXT", notNull: true },
151:       context: { type: "TEXT", notNull: true },
152:       cursor_stack: { type: "TEXT", notNull: true },
153:       page_index: { type: "INTEGER", notNull: true, default: "0" },
154:       expires_at: { type: "INTEGER", notNull: true },
155:     },
156:     compositePrimaryKey: ["command_key", "context"],
157:   },
158:   metadata: {
159:     columns: {
160:       key: { type: "TEXT", primaryKey: true },
161:       value: { type: "TEXT", notNull: true },
162:     },
163:   },
164:   org_regions: {
165:     columns: {
166:       org_slug: { type: "TEXT", primaryKey: true },
167:       org_id: { type: "TEXT", addedInVersion: 8 },
168:       org_name: { type: "TEXT", ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
720:     );
721:   }
722: }
723: 
724: function getSchemaVersion(db: Database): number {
725:   const row = db.query("SELECT version FROM schema_version LIMIT 1").get() as {
726:     version: number;
727:   } | null;
728:   return row?.version ?? 0;
729: }
730: 
731: /**
732:  * Run migrations for schema changes between versions.
733:  *
734:  * Note: Auto-repair handles missing tables/columns as a safety net, but explicit
735:  * migrations are still needed for:
736:  * - Data transformations (e.g., splitting a column)
737:  * - Column renames (requires data copy in SQLite)
738:  * - Complex constraints
739:  */
740: // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: sequential migration steps are inherently linear
741: export function runMigrations(db: Database): void {
742:   const currentVersion = ...

[
  {
    "content": "Inspect issue and affected CLI behavior",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add regression coverage and implement fix",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Close redirect and region-trust review findings",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Run focused and repository checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

No files found

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Defense-in-depth: `sntrys_` token claim vs request-origin mismatch.
3:  *
4:  * The fetch-layer guard refuses to attach a `sntrys_` token when its
5:  * embedded `url` claim disagrees with the request origin. Defends users
6:  * with access to multiple Sentry instances against routing one
7:  * instance's token to another. Claim is unsigned (see token-claims.ts),
8:  * so this catches honest misconfigurations more than malicious attacks.
9:  */
10: 
11: import { afterEach, beforeEach, describe, expect, test } from "vitest";
12: import {
13:   extractFetchUrl,
14:   mintSntrysToken,
15:   resetHostScopingState,
16:   useEnvSandbox,
17:   useTestConfigDir,
18: } from "../../helpers.js";
19: 
20: const ENV_KEYS = [
21:   "SENTRY_AUTH_TOKEN",
22:   "SENTRY_TOKEN",
23:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
90:     Boolean(signal?.aborted)
91:   );
92: }
93: 
94: /**
95:  * Prepare request headers with auth token and default headers.
96:  *
97:  * Only sets Authorization and User-Agent. Content-Type is intentionally NOT
98:  * set here — callers are responsible for setting it based on their needs:
99:  * - SDK functions set their own Content-Type
100:  * - apiRequestToRegion always sends JSON and sets it explicitly
101:  * - rawApiRequest may or may not want Content-Type (e.g., string bodies)
102:  *
103:  * When `init` is undefined (the SDK passes only a Request object), headers are
104:  * read from the Request object to preserve Content-Type and other headers set
105:  * by the SDK. ...

 M .lore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/event.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/explore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/feedback.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/issue.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/log.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/replay.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/span.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/trace.md
 M packages/cli/src/lib/constants.ts
 M packages/cli/src/lib/region.ts
 M packages/cli/src/lib/sentry-client.ts
 M packages/cli/test/lib/constants.test.ts
 M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts
diff --git a/packages/cli/src/lib/constants.ts b/packages/cli/src/lib/constants.ts
index ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/region.ts</path>
<type>file</type>
<content>
1: /**
2:  * Region resolution for multi-region Sentry support.
3:  *
4:  * Provides utilities to resolve the correct region URL for an organization,
5:  * using cached data when available or fetching from the API when needed.
6:  */
7: 
8: import { getOrganization } from "@sentry/api";
9: import { getConfiguredSentryUrl } from "./constants.js";
10: import { getOrgByNumericId, getOrgRegion, setOrgRegion } from "./db/regions.js";
11: import { stripDsnOrgPrefix } from "./dsn/index.js";
12: import { withAuthGuard } from "./errors.js";
13: import { getApiBaseUrl, getSdkConfig } from "./sentry-client.js";
14: import { isSentrySaasUrl } from "./sentry-urls.js";
15: 
16: /**
17:  * Promise cache for org region resolution, keyed by orgSlug. ...

Found 100 matches (more matches available)
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/arg-parsing.test.ts:
  Line 263:     test("@latest throws with redirect to issue view", () => {

  Line 272:     test("@most_frequent throws with redirect to issue view", () => {

  Line 297:     test("/@latest (leading slash) throws with redirect", () => {

  Line 303:     test("sentry/@latest (org/selector) throws with redirect", () => {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/api-client.test.ts:
  Line 501:   test("sends request with custom headers", async () => {

  Line 521:   test("custom headers merged with string body (no default Content-Type)", async () => {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/api-client.coverage.test.ts:
  Line 2093:     test("includes ...

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts
M packages/cli/src/lib/sentry-client.ts
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
 ❯ test/lib/security/sntrys-claim-mismatch.test.ts (14 tests | 7 failed) 1550ms
     × token whose claim matches the request proceeds normally 62ms
     × claim URL routes requests when no explicit URL is configured 35ms
     × stored OAuth host takes precedence over an inactive env token claim 31ms
     × forced env token claim takes precedence over stored OAuth 27ms
     × refuses a cross-origin redirect before forwarding custom headers 35ms
     × self-hosted multi-region: claim check honors region URL extension 28ms
   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
230: 
231: type FetchWithTimeoutArgs = {
232:   input: Request | string | URL;
233:   init: RequestInit | undefined;
234:   headers: Headers;
235:   externalSignal: AbortSignal | undefined | null;
236:   timeoutMs: number;
237: };
238: 
239: /**
240:  * Execute a single fetch attempt with timeout. If the timeout fires, the
241:  * thrown error is tagged with {@link INTERNAL_TIMEOUT_MARKER} so the retry
242:  * loop can distinguish it from a user abort or network error.
243:  */
244: async function fetchWithTimeout({
245:   input,
246:   init,
247:   headers,
248:   externalSignal,
249:   timeoutMs,
250: }: FetchWithTimeoutArgs): Promise<Response> {
251:   const controller = new AbortController();
252:   let timedOut = false;
253:   const timeout = setTimeout(() => {
254:     timedOut = true;
255:     ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry API Client Configuration
3:  *
4:  * Provides request configuration for @sentry/api SDK functions,
5:  * including authentication, retry logic, timeout, and multi-region support.
6:  *
7:  * Instead of managing client instances, we pass configuration per-request
8:  * through the SDK function options (baseUrl, fetch, headers).
9:  */
10: 
11: import { setTimeout as sleepMs } from "node:timers/promises";
12: import { getTraceData } from "@sentry/node-core/light";
13: import { maybeWarnEnvTokenIgnored } from "./auth-hint.js";
14: import { computeInvalidationPrefixes } from "./cache-keys.js";
15: import {
16:   DEFAULT_SENTRY_URL,
17:   getConfiguredSentryUrl,
18:   getUserAgent,
19: } from "./constants.js";
20: import {
21:   buildTlsErrorDetail,
22:   getCustomTlsOptions,
23:   ...

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
55:   pattern: RegExp;
56:   timeoutMs: number;
57: };
58: 
59: const ENDPOINT_TIMEOUT_OVERRIDES: TimeoutOverride[] = [
60:   // Seer autofix POSTs trigger server-side root-cause analysis /
61:   // solution planning and can take up to ~2 minutes (see CLI-1D6).
62:   { pattern: /\/autofix\/?(?:\?|$)/, timeoutMs: 120_000 },
63: ];
64: 
65: /** Maximum retry attempts for failed requests */
66: const MAX_RETRIES = 2;
67: 
68: /** Maximum redirects to follow for one request. Matches native fetch. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
371: /** Result of a single fetch attempt - drives the retry loop */
372: type AttemptResult =
373:   | { action: "done"; response: Response }
374:   | { action: "retry"; token?: string }
375:   | { action: "throw"; error: unknown };
376: 
377: /**
378:  * Decide what to do with a successful HTTP response.
379:  * Returns 'done' for final responses, 'retry' for retryable errors and 401s.
380:  */
381: async function handleResponse(
382:   response: Response,
383:   headers: Headers,
384:   isLastAttempt: boolean
385: ): Promise<AttemptResult> {
386:   if (response.status === 401) {
387:     const refreshedToken = await handleUnauthorized(headers);
388:     return refreshedToken
389:       ? ...

diff --git a/packages/cli/src/lib/sentry-client.ts b/packages/cli/src/lib/sentry-client.ts
index 53dd0cea1..11e427074 100644
--- a/packages/cli/src/lib/sentry-client.ts
+++ b/packages/cli/src/lib/sentry-client.ts
@@ -65,6 +65,9 @@ const ENDPOINT_TIMEOUT_OVERRIDES: TimeoutOverride[] = [
 /** Maximum retry attempts for failed requests */
 const MAX_RETRIES = 2;
 
+/** Maximum redirects to follow for one request. Matches native fetch. */
+const MAX_REDIRECTS = 20;
+
 /** Maximum backoff delay between retries in milliseconds */
 const MAX_BACKOFF_MS = 10_000;
 
@@ -232,22 +235,75 @@ type FetchWithTimeoutArgs = {
   input: Request | string | URL;
   init: RequestInit | undefined;
   headers: Headers;
+  token: string;
   externalSignal: AbortSignal | undefined | null;
   timeoutMs: number;
 };
 
+type FetchWithTimeoutResult = {
+  response: Response;
+  headers: Headers;
+};
+
+function isRedirect(response: Response): boolean {
+  return [301, 302, 303, 307, ...

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  1 passed (1)
      Tests  14 passed (14)
   Start at  10:27:34
   Duration  6.64s (transform 4.38s, setup 170ms, import 3.90s, tests 2.17s, environment 3ms)

Found 4 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts:
  Line 113:  * retry attempts (e.g., handleUnauthorized updates the Authorization header

  Line 179: async function handleUnauthorized(headers: Headers): Promise<boolean> {

  Line 401:     const refreshed = await handleUnauthorized(headers);

  Line 630:       // handleUnauthorized stores a new token in the DB

Found 3 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentry-client.test.ts:
  Line 2:  * Tests for the authenticated fetch retry + timeout behavior — CLI-1D6

  Line 38: describe("fetchWithRetry / buildAttemptFactory", () => {

  Line 186:         return new Response("retry me", { status: 503 });

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentry-client.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for the authenticated fetch retry + timeout behavior — CLI-1D6
3:  * regression coverage.
4:  */
5: 
6: import { afterEach, beforeEach, describe, expect, test } from "vitest";
7: import { setAuthToken } from "../../src/lib/db/auth.js";
8: import { TimeoutError } from "../../src/lib/errors.js";
9: import {
10:   __injectTimeoutOverrideForTests,
11:   __resolveRequestTimeoutMsForTests,
12:   getSdkConfig,
13:   resetAuthenticatedFetch,
14: } from "../../src/lib/sentry-client.js";
15: import { mockFetch, useTestConfigDir } from "../helpers.js";
16: 
17: useTestConfigDir("sentry-client-");
18: 
19: let originalFetch: typeof globalThis.fetch;
20: const REGION_URL = "https://us.sentry.io";
21: 
22: beforeEach(async () => {
23:   originalFetch = globalThis.fetch;
24:   // Non-expiring token — ...

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
 ❯ test/lib/sentry-client.test.ts (8 tests | 2 failed) 7474ms
     × retries a POST with a string body without re-consuming the body 1128ms
     × retries with a ReadableStream body by materializing once 1019ms

 Test Files  1 failed | 1 passed (2)
      Tests  2 failed | 20 passed (22)
   Start at  10:29:15
   Duration  10.28s (transform 4.50s, setup 123ms, import 4.85s, ...

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  2 passed (2)
      Tests  22 passed (22)
   Start at  10:30:04
   Duration  10.33s (transform 4.22s, setup 230ms, import 5.01s, tests 8.61s, environment 0ms)

 M .lore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/event.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/explore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/feedback.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/issue.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/log.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/replay.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/span.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/trace.md
 M packages/cli/src/lib/constants.ts
 M packages/cli/src/lib/region.ts
 M packages/cli/src/lib/sentry-client.ts
 M packages/cli/test/lib/constants.test.ts
 M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts
 .lore.md                                           | 700 ++++++++++++---------
 ...

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts
M packages/cli/test/lib/sentry-client.test.ts

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  2 passed (2)
      Tests  23 passed (23)
   Start at  10:31:38
   Duration  11.02s (transform 5.41s, setup 218ms, import 6.26s, tests 8.99s, environment 0ms)

> sentry@0.40.0-dev.0 lint /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> biome check --no-errors-on-unmatched --max-diagnostics=none ./

src/lib/sentry-client.ts:306:16 lint/complexity/noExcessiveCognitiveComplexity ━━━━━━━━━━━━━━━━━━━━━

  × Excessive complexity of 23 detected (max: 15).
  
    304 │  * user abort or network error.
    305 │  */
  > 306 │ async function fetchWithTimeout({
        │                ^^^^^^^^^^^^^^^^
    307 │   input,
    308 │   init,
  
  i Please refactor this function to reduce its complexity score from 23 to the max allowed complexity 15.
  

src/lib/sentry-client.ts format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:
  
    329 329 │       for (let redirects = 0; ; redirects++) {
    330 330 │         if (customTls) {
    331     │ - ········warnIfSaasWithEnvCa(
    332     │ - ...

apply_patch verification failed: Error: Failed to find expected lines in /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts:
    for (let redirects = 0; ; redirects++) {
      if (customTls) {
        warnIfSaasWithEnvCa(request?.url ?? extractFullUrl(input));
      }

      // Keep the initial fetch call shape unchanged. Several callers and
      // runtimes consume `init.body` directly, while only redirects need a
      // concrete Request to preserve method and body semantics.
      const fetchInput = request ?? input;
      const fetchInit = request
        ? {
            headers: requestHeaders,
            signal: controller.signal,
            redirect: "manual" as const,
            ...customTls,
          }
        : {
            ...init,
            headers: requestHeaders,
            signal: controller.signal,
            redirect: "manual" as const,
            ...customTls,
          ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
240: };
241: 
242: type FetchWithTimeoutResult = {
243:   response: Response;
244:   headers: Headers;
245: };
246: 
247: function isRedirect(response: Response): boolean {
248:   return [301, 302, 303, 307, 308].includes(response.status);
249: }
250: 
251: function getRedirectUrl(response: Response, request: Request): URL {
252:   const location = response.headers.get("location");
253:   if (!location) {
254:     throw new ApiError(
255:       `Redirect (${response.status}) had no Location header`,
256:       response.status,
257:       undefined,
258:       request.url
259:     );
260:   }
261: 
262:   try {
263:     return new URL(location, request.url);
264:   } catch {
265:     throw new ApiError(
266:       `Redirect (${response.status}) had an invalid Location header`,
267:       response.status,
268:     ...

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts

Success. Updated the following files:
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

> sentry@0.40.0-dev.0 lint /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> biome check --no-errors-on-unmatched --max-diagnostics=none ./

src/lib/sentry-client.ts:311:27 lint/nursery/useMaxParams ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Function has 6 parameters, but only 4 are allowed.
  
    309 │ }
    310 │ 
  > 311 │ function getFetchArguments(
        │                           ^
  > 312 │   input: Request | string | URL,
         ...
  > 317 │   customTls: RequestInit
  > 318 │ ): [Request | string | URL, RequestInit] {
        │ ^
    319 │   if (request) {
    320 │     return [
  
  i Functions with many parameters are hard to read and maintain.
  
  i Consider using an options object, splitting into smaller functions, or grouping related parameters.
  

src/lib/sentry-client.ts:358:16 lint/complexity/noExcessiveCognitiveComplexity ━━━━━━━━━━━━━━━━━━━━━

  × Excessive complexity of 17 detected (max: ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
280:     response.status === 303
281:       ? request.method !== "GET" && request.method !== "HEAD"
282:       : (response.status === 301 || response.status === 302) &&
283:         request.method === "POST";
284:   if (becomesGet) {
285:     return new Request(destination, { method: "GET" });
286:   }
287: 
288:   return new Request(destination, request);
289: }
290: 
291: function getBearerToken(headers: Headers): string {
292:   const authorization = headers.get("Authorization");
293:   if (!authorization?.startsWith("Bearer ")) {
294:     throw new ApiError("Authenticated request is missing a bearer token", 0);
295:   }
296:   return authorization.slice("Bearer ".length);
297: }
298: 
299: type RedirectRequest = {
300:   request: Request;
301:   headers: Headers;
302: };
303: 
304: function ...

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
300:   request: Request;
301:   headers: Headers;
302: };
303: 
304: type FetchArguments = {
305:   input: Request | string | URL;
306:   init: RequestInit | undefined;
307:   request: Request | undefined;
308:   headers: Headers;
309:   signal: AbortSignal;
310:   customTls: RequestInit;
311: };
312: 
313: function getInitialRedirectRequest(
314:   input: Request | string | URL,
315:   init: RequestInit | undefined
316: ): Request {
317:   return input instanceof Request ? input.clone() : new Request(input, init);
318: }
319: 
320: function getFetchArguments({
321:   input,
322:   init,
323:   request,
324:   headers,
325:   signal,
326:   customTls,
327: }: FetchArguments): [Request | string | URL, RequestInit] {
328:   if (request) {
329:     return [request, { headers, signal, redirect: "manual", ...

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts

> sentry@0.40.0-dev.0 lint /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> biome check --no-errors-on-unmatched --max-diagnostics=none ./

Checked 951 files in 42s. No fixes applied.

> sentry@0.40.0-dev.0 typecheck /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:docs && pnpm run generate:sdk && tsc --noEmit


> sentry@0.40.0-dev.0 generate:docs /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:banner && pnpm run generate:parser && pnpm run generate:command-docs && pnpm run generate:skill && pnpm run generate:docs-sections


> sentry@0.40.0-dev.0 generate:banner /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/generate-banner-sixel.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/generate-banner-sixel.ts

.env.local not found. Continuing without ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/custom-ca.ts</path>
<type>file</type>
<content>
1: /**
2:  * Custom CA certificate loading for corporate TLS proxies.
3:  *
4:  * Reads CA bundles from (in priority order):
5:  * 1. `sentry cli defaults ca-cert` (stored path in SQLite)
6:  * 2. `NODE_EXTRA_CA_CERTS` env var
7:  *
8:  * Returns a `tls` options object for Bun's `fetch()`. On the Node.js npm
9:  * distribution, Node natively honors `NODE_EXTRA_CA_CERTS` so the extra
10:  * `tls.ca` option is harmless (ignored by Node's fetch).
11:  *
12:  * Security model: When the CA source is an env var (not a stored default)
13:  * AND the target is SaaS (`*.sentry.io`), a one-time warning is logged.
14:  * `sentry cli defaults ca-cert` silences the warning — the user has
15:  * explicitly acknowledged the custom CA. See CLI-1K6 plan for the full
16:  * threat model discussion. ...

Success. Updated the following files:
M packages/cli/src/lib/sentry-client.ts

> sentry@0.40.0-dev.0 typecheck /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:docs && pnpm run generate:sdk && tsc --noEmit


> sentry@0.40.0-dev.0 generate:docs /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:banner && pnpm run generate:parser && pnpm run generate:command-docs && pnpm run generate:skill && pnpm run generate:docs-sections


> sentry@0.40.0-dev.0 generate:banner /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/generate-banner-sixel.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs script/generate-banner-sixel.ts

.env.local not found. Continuing without ...

[
  {
    "content": "Inspect issue and affected CLI behavior",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Implement active-credential routing and redirect guards",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run focused and repository checks",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

> sentry@0.40.0-dev.0 test:unit /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:docs && pnpm run generate:sdk && vitest run test/lib test/commands test/types test/script --coverage -- --printConsoleTrace


> sentry@0.40.0-dev.0 generate:docs /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm run generate:banner && pnpm run generate:parser && pnpm run generate:command-docs && pnpm run generate:skill && pnpm run generate:docs-sections


> sentry@0.40.0-dev.0 generate:banner /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> pnpm tsx script/generate-banner-sixel.ts


> sentry@0.40.0-dev.0 tsx /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> tsx --env-file-if-exists=.env.local --import ./script/require-shim.mjs ...

...output truncated...

Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_08aec35310015nfFIgvoXUZ0aG

npm_package_engines_node=>=18.0
SYSTEMD_EXEC_PID=878473
OPENCODE_EXPERIMENTAL_PLAN_MODE=1
VOLTA_HOME=/home/byk/.volta
_VOLTA_TOOL_RECURSION=1
LOGNAME=byk
JOURNAL_STREAM=8:377524516
_=/home/byk/.volta/bin/pnpm
MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/system.slice/opencode.service/memory.pressure
npm_config_registry=https://registry.npmjs.org/
npm_config_node_linker=isolated
OPENCODE=1
SENTRY_ENABLED=1
npm_config_node_gyp=/home/byk/.opencode/server/opencode-server
PATH=/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/node_modules/.bin:/home/byk/.local/share/pnpm/.tools/pnpm/10.11.0_tmp_3945111/node_modules/pnpm/dist/node-gyp-bin:/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/node_modules/.bin:/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a...

<task id="ses_f75102ecbffemmfn06hnHH59uB" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f750ffe9bffedUKF8qzSkyFYfq" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
1: /**
2:  * Sentry API Client Configuration
3:  *
4:  * Provides request configuration for @sentry/api SDK functions,
5:  * including authentication, retry logic, timeout, and multi-region support.
6:  *
7:  * Instead of managing client instances, we pass configuration per-request
8:  * through the SDK function options (baseUrl, fetch, headers).
9:  */
10: 
11: import { setTimeout as sleepMs } from "node:timers/promises";
12: import { getTraceData } from "@sentry/node-core/light";
13: import { maybeWarnEnvTokenIgnored } from "./auth-hint.js";
14: import { computeInvalidationPrefixes } from "./cache-keys.js";
15: import {
16:   DEFAULT_SENTRY_URL,
17:   getConfiguredSentryUrl,
18:   getUserAgent,
19: } from "./constants.js";
20: import {
21:   buildTlsErrorDetail,
22:   getCustomTlsOptions,
23:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Host-Scoped Token Trust Model
3:  *
4:  * Tokens (env or stored OAuth) are bound to a specific Sentry host. The fetch
5:  * layer (and the `.sentryclirc` / URL-arg entry points) check each request's
6:  * destination against the token's recorded host and refuse to attach
7:  * credentials when they don't match — so untrusted routing inputs can't leak
8:  * credentials to an attacker's host.
9:  *
10:  * Host equivalence:
11:  * - Exact origin match (scheme + host + explicit port).
12:  * - SaaS equivalence class: a token scoped to `https://sentry.io` is valid for
13:  *   any `*.sentry.io` subdomain. Non-SaaS hosts match exactly — no subdomain
14:  *   suffix matching (a `sentry.acme.com` token does NOT match
15:  *   `sentry.acme.evil.com`). ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
520:   }
521:   if (isLastAttempt) {
522:     return { action: "throw", error };
523:   }
524:   return { action: "retry" };
525: }
526: 
527: /** Extract the full URL string from a fetch input */
528: function extractFullUrl(input: Request | string | URL): string {
529:   if (typeof input === "string") {
530:     return input;
531:   }
532:   if (input instanceof URL) {
533:     return input.href;
534:   }
535:   return input.url;
536: }
537: 
538: /** Extract the URL pathname for span naming */
539: function extractUrlPath(input: Request | string | URL): string {
540:   const raw = extractFullUrl(input);
541:   try {
542:     return new URL(raw).pathname;
543:   } catch {
544:     return raw;
545:   }
546: }
547: 
548: /**
549:  * Attempt to serve a GET request from the response cache. ...

Found 3 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts:
  Line 116: function prepareHeaders(

  Line 359:   const nextHeaders = prepareHeaders(

  Line 679:   let headers = prepareHeaders(input, init, token);

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/oauth.ts</path>
<type>file</type>
<content>
175:   return out.join(" ");
176: }
177: 
178: type DeviceFlowCallbacks = {
179:   onUserCode: (
180:     userCode: string,
181:     verificationUri: string,
182:     verificationUriComplete: string
183:   ) => void | Promise<void>;
184: };
185: 
186: function sleep(ms: number): Promise<void> {
187:   return new Promise((resolve) => setTimeout(resolve, ms));
188: }
189: 
190: /**
191:  * Wrap a fetch call with connection error handling.
192:  * Converts network errors into user-friendly ApiError messages.
193:  */
194: async function fetchWithConnectionError(
195:   url: string,
196:   init: RequestInit
197: ): Promise<Response> {
198:   // Inject custom headers for self-hosted proxies (IAP, mTLS, etc.) —
199:   // URL-scoped so they don't leak to untrusted hosts.
200:   const merged = new Headers(init.headers);
201:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentry-client.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for the authenticated fetch retry + timeout behavior — CLI-1D6
3:  * regression coverage.
4:  */
5: 
6: import { afterEach, beforeEach, describe, expect, test } from "vitest";
7: import { setAuthToken } from "../../src/lib/db/auth.js";
8: import { TimeoutError } from "../../src/lib/errors.js";
9: import {
10:   __injectTimeoutOverrideForTests,
11:   __resolveRequestTimeoutMsForTests,
12:   getSdkConfig,
13:   resetAuthenticatedFetch,
14: } from "../../src/lib/sentry-client.js";
15: import { mockFetch, useTestConfigDir } from "../helpers.js";
16: 
17: useTestConfigDir("sentry-client-");
18: 
19: let originalFetch: typeof globalThis.fetch;
20: const REGION_URL = "https://us.sentry.io";
21: 
22: beforeEach(async () => {
23:   originalFetch = globalThis.fetch;
24:   // Non-expiring token — ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/oauth.ts</path>
<type>file</type>
<content>
1: /**
2:  * OAuth Authentication
3:  *
4:  * Implements RFC 8628 Device Authorization Grant for Sentry OAuth.
5:  * https://datatracker.ietf.org/doc/html/rfc8628
6:  */
7: 
8: import type { TokenResponse } from "../types/index.js";
9: import {
10:   DeviceCodeResponseSchema,
11:   TokenErrorResponseSchema,
12:   TokenResponseSchema,
13: } from "../types/index.js";
14: import { SENTRY_SCOPES } from "./api-scope.js";
15: import { DEFAULT_SENTRY_URL, getConfiguredSentryUrl } from "./constants.js";
16: import {
17:   buildTlsErrorDetail,
18:   getCustomTlsOptions,
19:   isTlsCertError,
20:   warnIfSaasWithEnvCa,
21: } from "./custom-ca.js";
22: import { applyCustomHeaders } from "./custom-headers.js";
23: import { setAuthToken } from "./db/auth.js";
24: import { getEnv } from "./env.js";
25: import {
26:   ApiError,
27:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/custom-headers.ts</path>
<type>file</type>
<content>
1: /**
2:  * Custom Headers for Self-Hosted Sentry
3:  *
4:  * Parses `SENTRY_CUSTOM_HEADERS` env var (or `defaults.headers` from SQLite)
5:  * and injects user-specified HTTP headers into all requests to self-hosted
6:  * Sentry instances. Designed for environments behind reverse proxies
7:  * (e.g., Google IAP, Cloudflare Access) that require extra headers.
8:  *
9:  * Format: semicolon-separated `Name: Value` pairs (newlines also accepted).
10:  *
11:  * @example
12:  * ```bash
13:  * # Single header
14:  * SENTRY_CUSTOM_HEADERS="X-IAP-Token: abc123"
15:  *
16:  * # Multiple headers
17:  * SENTRY_CUSTOM_HEADERS="X-IAP-Token: abc123; X-Forwarded-For: 10.0.0.1"
18:  *
19:  * # Via defaults command
20:  * sentry cli defaults headers "X-IAP-Token: abc123"
21:  * ```
22:  */
23: 
24: import { ...

Found 1 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts:
  Line 634: export async function refreshToken(

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
614:       tokenResponse.expires_in,
615:       tokenResponse.refresh_token ?? storedRefreshToken
616:     );
617: 
618:     return {
619:       token: tokenResponse.access_token,
620:       refreshed: true,
621:       expiresAt,
622:       expiresIn: tokenResponse.expires_in,
623:     };
624:   } catch (error) {
625:     // Only clear auth on explicit rejection, not network errors
626:     if (error instanceof AuthError) {
627:       await clearAuth();
628:     }
629:     throw error;
630:   }
631: }
632: 
633: /** Get a valid token, refreshing if needed. Use force=true after 401 responses. */
634: export async function refreshToken(
635:   options: RefreshTokenOptions = {}
636: ): Promise<RefreshTokenResult> {
637:   // With SENTRY_FORCE_ENV_TOKEN, env token takes priority (no refresh needed). ...

Found 1 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/errors.ts:
  Line 139: export class HostScopeError extends CliError {

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/errors.ts</path>
<type>file</type>
<content>
110:   constructor(message: string, exitCode: number = EXIT.GENERAL) {
111:     super(message);
112:     this.name = "CliError";
113:     this.exitCode = exitCode;
114:   }
115: 
116:   /**
117:    * Format error for user display. Override in subclasses to add details.
118:    */
119:   format(): string {
120:     return this.message;
121:   }
122: }
123: 
124: /**
125:  * Host-scoping trust violation — thrown by the fetch-layer and entry-point
126:  * guards when a request's destination doesn't match the active token's
127:  * scoped host.
128:  *
129:  * Distinct from plain `CliError` so that `withAuthGuard` can re-throw these
130:  * (like `AuthError`) while still swallowing `ApiError` and other transient
131:  * failures. ...

/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/oauth.test.ts

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/oauth.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for `resolveOAuthScopeString` — the helper that maps `auth login`
3:  * scope-selection flags (--read-only / --scope) to the space-joined scope
4:  * string sent in the OAuth device-code request.
5:  *
6:  * Core invariants (default = full set, read-only subset, explicit-scope
7:  * round-trips) are covered with property-based tests; the remaining cases
8:  * document specific error behavior and edge cases.
9:  */
10: 
11: import {
12:   constantFrom,
13:   assert as fcAssert,
14:   property,
15:   uniqueArray,
16: } from "fast-check";
17: import { describe, expect, test } from "vitest";
18: import { SENTRY_SCOPES } from "../../src/lib/api-scope.js";
19: import { ValidationError } from "../../src/lib/errors.js";
20: import { OAUTH_SCOPES, resolveOAuthScopeString } from ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Defense-in-depth: `sntrys_` token claim vs request-origin mismatch.
3:  *
4:  * The fetch-layer guard refuses to attach a `sntrys_` token when its
5:  * embedded `url` claim disagrees with the request origin. Defends users
6:  * with access to multiple Sentry instances against routing one
7:  * instance's token to another. Claim is unsigned (see token-claims.ts),
8:  * so this catches honest misconfigurations more than malicious attacks.
9:  */
10: 
11: import { afterEach, beforeEach, describe, expect, test } from "vitest";
12: import {
13:   extractFetchUrl,
14:   mintSntrysToken,
15:   resetHostScopingState,
16:   useEnvSandbox,
17:   useTestConfigDir,
18: } from "../../helpers.js";
19: 
20: const ENV_KEYS = [
21:   "SENTRY_AUTH_TOKEN",
22:   "SENTRY_TOKEN",
23:   ...

Found 2 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts:
  Line 84: export type AuthConfig = {

  Line 158: export function getAuthConfig(): AuthConfig | undefined {

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
75:   return host;
76: }
77: 
78: /** Prefix for environment variable auth sources in {@link AuthSource} */
79: export const ENV_SOURCE_PREFIX = "env:";
80: 
81: /** Where the auth token originated */
82: export type AuthSource = "env:SENTRY_AUTH_TOKEN" | "env:SENTRY_TOKEN" | "oauth";
83: 
84: export type AuthConfig = {
85:   token?: string;
86:   refreshToken?: string;
87:   expiresAt?: number;
88:   issuedAt?: number;
89:   source: AuthSource;
90: };
91: 
92: /**
93:  * Read the raw token string from environment variables, ignoring all filters.
94:  *
95:  * Unlike {@link getEnvToken}, this always returns the env token if set, even
96:  * when stored OAuth credentials would normally take priority. Used by the HTTP
97:  * layer to check "was an env token provided?" independent of whether it's being
98:  * used, and ...

Found 1 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts:
  Line 439: export async function clearAuth(): Promise<void> {

Found 5 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/telemetry/zstd-transport.test.ts:
  Line 16: import type { ClientRequest, IncomingHttpHeaders } from "node:http";


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/telemetry/zstd-transport.e2e.test.ts:
  Line 4:  * Spins up a real `http.createServer` on `127.0.0.1:0`, points the

  Line 10: import { createServer, type IncomingMessage, type Server } from "node:http";

  Line 48:   const server = createServer((req, res) => {

  Line 61:     server.listen(0, "127.0.0.1", () => {

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/telemetry/zstd-transport.e2e.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * E2E tests for the zstd transport.
3:  *
4:  * Spins up a real `http.createServer` on `127.0.0.1:0`, points the
5:  * transport at it, and verifies the wire-level behavior: the request
6:  * body is zstd-compressed, the `Content-Encoding` header is correct,
7:  * and the body decompresses back to a valid envelope.
8:  */
9: 
10: import { createServer, type IncomingMessage, type Server } from "node:http";
11: import type { AddressInfo } from "node:net";
12: import { promisify } from "node:util";
13: import { zstdDecompress } from "node:zlib";
14: import { createEnvelope } from "@sentry/core";
15: import { afterEach, describe, expect, test } from "vitest";
16: import {
17:   hasZstdSupport,
18:   makeCompressedTransport,
19: } from ...

No files found

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/auth.ts</path>
<type>file</type>
<content>
430:   });
431:   // Auth row changed — drop memoized fingerprint, token, row, and
432:   // stored-credentials flag so the next read reflects the new row.
433:   resetIdentityFingerprintCache();
434:   resetAuthTokenCache();
435:   resetAuthRowCache();
436:   resetHasStoredCredsCache();
437: }
438: 
439: export async function clearAuth(): Promise<void> {
440:   withDbSpan("clearAuth", () => {
441:     const db = getDatabase();
442:     db.query("DELETE FROM auth WHERE id = 1").run();
443:     // Also clear user info, org region cache, pagination cursors, and the
444:     // issue-id → org cache (scoped to the current user's permissions) when
445:     // logging out.
446:     db.query("DELETE FROM user_info WHERE id = 1").run();
447:     db.query("DELETE FROM org_regions").run();
448:     db.query("DELETE FROM ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/helpers.ts</path>
<type>file</type>
<content>
80:  * This casts the mock function to handle Bun's extended fetch type.
81:  *
82:  * @param fn - Fetch mock implementation
83:  * @returns Properly typed fetch function
84:  */
85: export function mockFetch(fn: FetchMockFn): typeof fetch {
86:   return fn as unknown as typeof fetch;
87: }
88: 
89: /**
90:  * Sets up an isolated test config directory with proper env var lifecycle.
91:  *
92:  * Registers beforeEach/afterEach hooks that create a unique config directory,
93:  * point SENTRY_CONFIG_DIR at it, and restore the original value on teardown.
94:  * This eliminates the fragile pattern of manually managing process.env in
95:  * each test file, which caused cross-file pollution when afterEach hooks
96:  * deleted the env var while other files were still loading. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts</path>
<type>file</type>
<content>
1: /**
2:  * Organization region cache for multi-region support.
3:  *
4:  * Sentry has multiple regions (US, EU, etc.) and organizations are bound
5:  * to a specific region. This module caches the organization-to-region
6:  * mapping to avoid repeated lookups.
7:  *
8:  * The `org_id` column (added in schema v8) enables offline resolution
9:  * of numeric org IDs extracted from DSN hosts (e.g., `o1081365` →
10:  * look up by `org_id = '1081365'` → get the slug).
11:  */
12: 
13: import { normalizeOrigin } from "../sentry-urls.js";
14: import { recordCacheHit } from "../telemetry.js";
15: import { getDatabase } from "./index.js";
16: import { runUpsert } from "./utils.js";
17: 
18: const TABLE = "org_regions";
19: 
20: /**
21:  * Process-local trust extension: origins that were vouched for by the
22:  * active ...

Found 11 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts:
  Line 19: import { isTrustedRegionOrigin } from "./db/regions.js";

  Line 119:   return requestOrigin !== undefined && isTrustedRegionOrigin(requestOrigin);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts:
  Line 52:     // setOrgRegion(s) or registerTrustedRegionUrls.

  Line 64: export function registerTrustedRegionUrls(urls: readonly string[]): void {

  Line 77: export function isTrustedRegionOrigin(origin: string): boolean {

  Line 90: export function clearTrustedHostState(): void {

  Line 192:   registerTrustedRegionUrls([regionUrl]);

  Line 231:   registerTrustedRegionUrls(entries.map((e) => e.regionUrl));

  Line 241:   ...

Found 71 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/repo-cache.test.ts:
  Line 33:   // Each test starts fresh — useTestConfigDir resets the DB.


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/auth.test.ts:
  Line 23:   resetAuthRowCache,

  Line 24:   resetAuthTokenCache,

  Line 25:   resetHasStoredCredsCache,

  Line 26:   resetIdentityFingerprintCache,

  Line 42:   resetIdentityFingerprintCache();

  Line 43:   resetAuthTokenCache();

  Line 44:   resetAuthRowCache();

  Line 249:     resetIdentityFingerprintCache();

  Line 261:     resetIdentityFingerprintCache();

  Line 290:       resetIdentityFingerprintCache();

  Line 315:     resetIdentityFingerprintCache();

  Line 320:     resetIdentityFingerprintCache();

  Line 347:     // After reset, the new value is read

  Line 348:     resetAuthTokenCache();

  Line ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/model-based.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Model-Based Testing for SQLite Database Layer
3:  *
4:  * Uses fast-check to generate random sequences of database operations
5:  * and verify the system behaves correctly against a simplified model.
6:  *
7:  * This catches edge cases that handwritten tests miss, such as:
8:  * - Unexpected state transitions
9:  * - Race conditions in caching logic
10:  * - Invariant violations (e.g., clearAuth also clears regions)
11:  */
12: 
13: // biome-ignore-all lint/suspicious/noMisplacedAssertion: Model-based testing uses expect() inside command classes, not directly in test() functions. This is the standard fast-check pattern for stateful testing. ...

[
  {
    "content": "Trace redirect and OAuth refresh authentication paths",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Fix redirect trust pinning and OAuth redirect handling",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Add deterministic redirect security regressions",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run focused and package validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Repeat independent final-diff reviews",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

Found 9 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/logs.ts:
  Line 423:  * apiRequestToRegion following the same pattern as listTraceLogs.


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/teams.ts:
  Line 97:  * so we follow up with an `addMemberToTeam("me")` call. The member-add


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/infrastructure.ts:
  Line 356:  * Maximum number of pages to follow when auto-paginating.


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/repositories.ts:
  Line 113:  * already succeeded — following the project's established ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/infrastructure.ts</path>
<type>file</type>
<content>
1: /**
2:  * API Client Infrastructure
3:  *
4:  * Shared helpers, types, constants, and raw request functions used by
5:  * all domain-specific API modules. This is the foundation layer that
6:  * other modules in `src/lib/api/` import from.
7:  */
8: 
9: import { promisify } from "node:util";
10: import { zstdCompress as zstdCompressCb } from "node:zlib";
11: import { parseSentryLinkHeader } from "@sentry/api";
12: // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
13: import * as Sentry from "@sentry/node-core/light";
14: import type { z } from "zod";
15: 
16: import { extractRequiredScopes } from "../api-scope.js";
17: import { getActiveEnvVarName, isEnvTokenActive } from "../db/auth.js";
18: import { getEnv } from "../env.js";
19: import { ApiError, AuthError, ...

Found 97 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts:
  Line 103:  * - apiRequestToRegion always sends JSON and sets it explicitly

  Line 116: function prepareHeaders(

  Line 359:   const nextHeaders = prepareHeaders(

  Line 679:   let headers = prepareHeaders(input, init, token);

  Line 747:   return function authenticatedFetch(

  Line 842: function getAuthenticatedFetch(): typeof fetch {

  Line 895:     fetch: getAuthenticatedFetch(),


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/response-cache.ts:
  Line 331:  * `authenticatedFetch` call in `sentry-client.ts`. Commands read it via

  Line 347:  * Clear the last cache-hit age. Called at the top of each `authenticatedFetch`


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/users.ts:
  ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
90:   return (
91:     error instanceof DOMException &&
92:     error.name === "AbortError" &&
93:     Boolean(signal?.aborted)
94:   );
95: }
96: 
97: /**
98:  * Prepare request headers with auth token and default headers.
99:  *
100:  * Only sets Authorization and User-Agent. Content-Type is intentionally NOT
101:  * set here — callers are responsible for setting it based on their needs:
102:  * - SDK functions set their own Content-Type
103:  * - apiRequestToRegion always sends JSON and sets it explicitly
104:  * - rawApiRequest may or may not want Content-Type (e.g., string bodies)
105:  *
106:  * When `init` is undefined (the SDK passes only a Request object), headers are
107:  * read from the Request object to preserve Content-Type and other headers set
108:  * by the SDK. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
370: /**
371:  * Execute a single fetch attempt with timeout and manual redirects. Each
372:  * redirect rebuilds headers only after the destination passes host scoping.
373:  * If the timeout fires, the thrown error is tagged with
374:  * {@link INTERNAL_TIMEOUT_MARKER} so the retry loop can distinguish it from a
375:  * user abort or network error.
376:  */
377: async function fetchWithTimeout({
378:   input,
379:   init,
380:   headers,
381:   externalSignal,
382:   timeoutMs,
383: }: FetchWithTimeoutArgs): Promise<FetchWithTimeoutResult> {
384:   const controller = new AbortController();
385:   let timedOut = false;
386:   const timeout = setTimeout(() => {
387:     timedOut = true;
388:     controller.abort();
389:   }, timeoutMs);
390:   linkAbortSignal(externalSignal, controller);
391: 
392:   try {
393:  ...

Found 64 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-type.ts:
  Line 22:   | "oauth-or-legacy";

  Line 39:   return "oauth-or-legacy";


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/oauth.ts:
  Line 265:   return withHttpSpan("POST", "/oauth/device/code/", async () => {

  Line 267:       `${getSentryUrl()}/oauth/device/code/`,

  Line 284:         "/oauth/device/code/"

  Line 297:         "/oauth/device/code/"

  Line 307:         "/oauth/device/code/"

  Line 319:   return withHttpSpan("POST", "/oauth/token/", async () => {

  Line 321:       `${getSentryUrl()}/oauth/token/`,

  Line 328:           grant_type: "urn:ietf:params:oauth:grant-type:device_code",

  Line 342:         "/oauth/token/"

  Line 366:       "/oauth/token/"

  Line 492:     tokenResponse.refresh_token,

  Line 510:   refreshToken: string

  Line 515:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/oauth.ts</path>
<type>file</type>
<content>
230:     if (isConnectionError) {
231:       throw new ApiError(
232:         `Cannot connect to Sentry at ${getSentryUrl()}`,
233:         0,
234:         "Check your network connection and SENTRY_URL configuration"
235:       );
236:     }
237:     throw error;
238:   }
239: }
240: 
241: /**
242:  * Refuse to POST a refresh token to a host that doesn't match the active
243:  * token's scope. Defense-in-depth for the rare case where SENTRY_HOST/URL
244:  * was mutated without going through the URL-arg / rc-shim guards.
245:  */
246: function assertRefreshHostTrusted(): void {
247:   const refreshUrl = getSentryUrl();
248:   if (!isRequestOriginTrusted(refreshUrl)) {
249:     throw new HostScopeError(
250:       "OAuth refresh token",
251:       normalizeOrigin(refreshUrl) ?? ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/oauth.ts</path>
<type>file</type>
<content>
1: /**
2:  * OAuth Authentication
3:  *
4:  * Implements RFC 8628 Device Authorization Grant for Sentry OAuth.
5:  * https://datatracker.ietf.org/doc/html/rfc8628
6:  */
7: 
8: import type { TokenResponse } from "../types/index.js";
9: import {
10:   DeviceCodeResponseSchema,
11:   TokenErrorResponseSchema,
12:   TokenResponseSchema,
13: } from "../types/index.js";
14: import { SENTRY_SCOPES } from "./api-scope.js";
15: import { DEFAULT_SENTRY_URL, getConfiguredSentryUrl } from "./constants.js";
16: import {
17:   buildTlsErrorDetail,
18:   getCustomTlsOptions,
19:   isTlsCertError,
20:   warnIfSaasWithEnvCa,
21: } from "./custom-ca.js";
22: import { applyCustomHeaders } from "./custom-headers.js";
23: import { setAuthToken } from "./db/auth.js";
24: import { getEnv } from "./env.js";
25: import {
26:   ApiError,
27:   ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Host-Scoped Token Trust Model
3:  *
4:  * Tokens (env or stored OAuth) are bound to a specific Sentry host. The fetch
5:  * layer (and the `.sentryclirc` / URL-arg entry points) check each request's
6:  * destination against the token's recorded host and refuse to attach
7:  * credentials when they don't match — so untrusted routing inputs can't leak
8:  * credentials to an attacker's host.
9:  *
10:  * Host equivalence:
11:  * - Exact origin match (scheme + host + explicit port).
12:  * - SaaS equivalence class: a token scoped to `https://sentry.io` is valid for
13:  *   any `*.sentry.io` subdomain. Non-SaaS hosts match exactly — no subdomain
14:  *   suffix matching (a `sentry.acme.com` token does NOT match
15:  *   `sentry.acme.evil.com`). ...

[
  {
    "content": "Trace redirect and OAuth refresh authentication paths",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Fix redirect trust pinning and OAuth redirect handling",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Add deterministic redirect security regressions",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run focused and package validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Repeat independent final-diff reviews",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

No files found

Found 76 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/upgrade.test.ts:
  Line 1626:         // Return gzipped blob directly (no redirect needed for test)


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentryclirc.test.ts:
  Line 295:     // the CVE where a committed .sentryclirc could redirect requests +


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentry-client.test.ts:
  Line 119:   test("follows a trusted 307 redirect without consuming a Request body", async () => {

  Line 120:     const marker = "__test_redirect_request_body__";

  Line 121:     const destination = `${REGION_URL}/api/0/${marker}/redirected/`;

  Line 137:         return Response.redirect(destination, 307);

  Line 142:     const payload = JSON.stringify({ redirect: "preserve-body" ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/sentry-client.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for the authenticated fetch retry + timeout behavior — CLI-1D6
3:  * regression coverage.
4:  */
5: 
6: import { afterEach, beforeEach, describe, expect, test } from "vitest";
7: import { setAuthToken } from "../../src/lib/db/auth.js";
8: import { TimeoutError } from "../../src/lib/errors.js";
9: import {
10:   __injectTimeoutOverrideForTests,
11:   __resolveRequestTimeoutMsForTests,
12:   getSdkConfig,
13:   resetAuthenticatedFetch,
14: } from "../../src/lib/sentry-client.js";
15: import { mockFetch, useTestConfigDir } from "../helpers.js";
16: 
17: useTestConfigDir("sentry-client-");
18: 
19: let originalFetch: typeof globalThis.fetch;
20: const REGION_URL = "https://us.sentry.io";
21: 
22: beforeEach(async () => {
23:   originalFetch = globalThis.fetch;
24:   // Non-expiring token — ...

 M .lore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/event.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/explore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/feedback.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/issue.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/log.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/replay.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/span.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/trace.md
 M packages/cli/src/lib/constants.ts
 M packages/cli/src/lib/region.ts
 M packages/cli/src/lib/sentry-client.ts
 M packages/cli/test/lib/constants.test.ts
 M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts
 M packages/cli/test/lib/sentry-client.test.ts

diff --git a/packages/cli/src/lib/sentry-client.ts b/packages/cli/src/lib/sentry-client.ts
index 53dd0cea1..4bdc8a686 100644
--- a/packages/cli/src/lib/sentry-client.ts
+++ b/packages/cli/src/lib/sentry-client.ts
@@ -65,6 +65,9 @@ const ENDPOINT_TIMEOUT_OVERRIDES: TimeoutOverride[] = [
 /** Maximum retry attempts for failed requests */
 const MAX_RETRIES = 2;
 
+/** Maximum redirects to follow for one request. Matches native fetch. */
+const MAX_REDIRECTS = 20;
+
 /** Maximum backoff delay between retries in milliseconds */
 const MAX_BACKOFF_MS = 10_000;
 
@@ -236,10 +239,140 @@ type FetchWithTimeoutArgs = {
   timeoutMs: number;
 };
 
+type FetchWithTimeoutResult = {
+  response: Response;
+  headers: Headers;
+};
+
+function isRedirect(response: Response): boolean {
+  return [301, 302, 303, 307, 308].includes(response.status);
+}
+
+function getRedirectUrl(response: Response, request: Request): URL {
+  const location = response.headers.get("location");
+  if (!location) {
+    ...

/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/oauth.test.ts
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/types/oauth.test.ts

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/oauth.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for `resolveOAuthScopeString` — the helper that maps `auth login`
3:  * scope-selection flags (--read-only / --scope) to the space-joined scope
4:  * string sent in the OAuth device-code request.
5:  *
6:  * Core invariants (default = full set, read-only subset, explicit-scope
7:  * round-trips) are covered with property-based tests; the remaining cases
8:  * document specific error behavior and edge cases.
9:  */
10: 
11: import {
12:   constantFrom,
13:   assert as fcAssert,
14:   property,
15:   uniqueArray,
16: } from "fast-check";
17: import { describe, expect, test } from "vitest";
18: import { SENTRY_SCOPES } from "../../src/lib/api-scope.js";
19: import { ValidationError } from "../../src/lib/errors.js";
20: import { OAUTH_SCOPES, resolveOAuthScopeString } from ...

Found 11 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/projects.ts:
  Line 75:   // Mirrors how listOrganizations() calls setOrgRegions().


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/organizations.ts:
  Line 165:   setOrgRegions(regionEntries);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts:
  Line 52:     // setOrgRegion(s) or registerTrustedRegionUrls.

  Line 64: export function registerTrustedRegionUrls(urls: readonly string[]): void {

  Line 182: export function setOrgRegion(orgSlug: string, regionUrl: string): void {

  Line 192:   registerTrustedRegionUrls([regionUrl]);

  Line 197:  * More efficient than calling setOrgRegion() multiple times. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/refresh-token-poison.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * CVE defense-in-depth: OAuth refresh-token credential exfiltration.
3:  *
4:  * Attack: if something bypasses the entry-point guards and poisons
5:  * `env.SENTRY_URL` before the next OAuth refresh fires, the refresh token
6:  * would previously be POSTed to the attacker's `/oauth/token/` endpoint.
7:  *
8:  * Fix: `refreshAccessToken` calls `assertRefreshHostTrusted()` before
9:  * building the request body, which throws `CliError` on mismatch.
10:  */
11: 
12: import { afterEach, beforeEach, describe, expect, test } from "vitest";
13: import {
14:   captureEnvTokenHost,
15:   resetEnvTokenHostForTesting,
16: } from "../../../src/lib/env-token-host.js";
17: import { refreshAccessToken } from "../../../src/lib/oauth.js";
18: import { extractFetchUrl, useEnvSandbox } from ...

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  3 passed (3)
      Tests  25 passed (25)
   Start at  11:36:59
   Duration  10.84s (transform 7.03s, setup 320ms, import 8.96s, tests 9.10s, environment 0ms)

Success. Updated the following files:
M packages/cli/src/lib/oauth.ts
M packages/cli/test/lib/security/refresh-token-poison.test.ts

Formatted 2 files in 13ms. Fixed 1 file.
 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
 ❯ test/lib/security/refresh-token-poison.test.ts (3 tests | 1 failed) 165ms
     × refreshAccessToken throws before fetch when env.SENTRY_URL is poisoned after boot 87ms
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  test/lib/security/refresh-token-poison.test.ts > CVE defense-in-depth: refresh token > refreshAccessToken throws before fetch ...

Success. Updated the following files:
M packages/cli/test/lib/security/refresh-token-poison.test.ts

Formatted 1 file in 10ms. No fixes applied.
 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  3 passed (3)
      Tests  26 passed (26)
   Start at  11:40:06
   Duration  11.01s (transform 7.46s, setup 218ms, import 10.09s, tests 8.68s, environment 0ms)

[
  {
    "content": "Trace redirect and OAuth refresh authentication paths",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Fix redirect trust pinning and OAuth redirect handling",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add deterministic redirect security regressions",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Scope persisted region cache and trust to credential host",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Run focused and package validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Repeat independent final-diff reviews",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts</path>
<type>file</type>
<content>
220:         row.org_id = entry.orgId;
221:       }
222:       if (entry.orgName) {
223:         row.org_name = entry.orgName;
224:       }
225:       if (entry.orgRole) {
226:         row.org_role = entry.orgRole;
227:       }
228:       runUpsert(db, TABLE, row, ["org_slug"]);
229:     }
230:   })();
231:   registerTrustedRegionUrls(entries.map((e) => e.regionUrl));
232: }
233: 
234: /**
235:  * Clear all cached organization regions.
236:  * Should be called when the user logs out.
237:  */
238: export function clearOrgRegions(): void {
239:   const db = getDatabase();
240:   db.query(`DELETE FROM ${TABLE}`).run();
241:   clearTrustedHostState();
242: }
243: 
244: /**
245:  * Get all cached organization regions.
246:  * Used for determining if user has orgs in multiple regions. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
1: /**
2:  * Database schema DDL and version management.
3:  *
4:  * This module defines the canonical schema for the CLI's SQLite database,
5:  * handles migrations between versions, and provides repair utilities for
6:  * fixing schema inconsistencies.
7:  *
8:  * Schema is defined once in TABLE_SCHEMAS and used to generate:
9:  * - DDL statements for table creation
10:  * - Column lists for schema repair
11:  * - Migration checks
12:  */
13: 
14: import { createRequire } from "node:module";
15: import { getEnv } from "../env.js";
16: import { stringifyUnknown } from "../errors.js";
17: import { logger } from "../logger.js";
18: import type { Database } from "./sqlite.js";
19: 
20: const _require = createRequire(import.meta.url);
21: 
22: export const CURRENT_SCHEMA_VERSION = 16;
23: 
24: /** Environment variable ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
180:       id: { type: "INTEGER", primaryKey: true, check: "id = 1" },
181:       user_id: { type: "TEXT", notNull: true },
182:       email: { type: "TEXT" },
183:       username: { type: "TEXT" },
184:       name: { type: "TEXT", addedInVersion: 3 },
185:       updated_at: {
186:         type: "INTEGER",
187:         notNull: true,
188:         default: "(unixepoch() * 1000)",
189:       },
190:     },
191:   },
192:   instance_info: {
193:     columns: {
194:       id: { type: "INTEGER", primaryKey: true, check: "id = 1" },
195:       instance_id: { type: "TEXT", notNull: true },
196:       created_at: {
197:         type: "INTEGER",
198:         notNull: true,
199:         default: "(unixepoch() * 1000)",
200:       },
201:     },
202:   },
203:   repo_cache: {
204:     columns: {
205:       // Composite PK ...

Found 13 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts:
  Line 164:   org_regions: {

  Line 744:   // Migration 1 -> 2: Add org_regions, user_info, and instance_info tables

  Line 747:       ${EXPECTED_TABLES.org_regions};

  Line 796:   // Migration 7 -> 8: Add org_id column to org_regions for numeric ID lookups

  Line 798:     addColumnIfMissing(db, "org_regions", "org_id", "TEXT");

  Line 801:   // Migration 8 -> 9: Add org_name column to org_regions for cached org listing

  Line 803:     addColumnIfMissing(db, "org_regions", "org_name", "TEXT");

  Line 806:   // Migration 9 -> 10: Add org_role column to org_regions for cached role lookups

  Line 808:     addColumnIfMissing(db, "org_regions", "org_role", "TEXT");


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts:
  Line 18: const TABLE = ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
148:   pagination_cursors: {
149:     columns: {
150:       command_key: { type: "TEXT", notNull: true },
151:       context: { type: "TEXT", notNull: true },
152:       cursor_stack: { type: "TEXT", notNull: true },
153:       page_index: { type: "INTEGER", notNull: true, default: "0" },
154:       expires_at: { type: "INTEGER", notNull: true },
155:     },
156:     compositePrimaryKey: ["command_key", "context"],
157:   },
158:   metadata: {
159:     columns: {
160:       key: { type: "TEXT", primaryKey: true },
161:       value: { type: "TEXT", notNull: true },
162:     },
163:   },
164:   org_regions: {
165:     columns: {
166:       org_slug: { type: "TEXT", primaryKey: true },
167:       org_id: { type: "TEXT", addedInVersion: 8 },
168:       org_name: { type: "TEXT", addedInVersion: 9 },
169:       org_role: ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/organizations.ts</path>
<type>file</type>
<content>
120:   return listOrganizationsUncached();
121: }
122: 
123: /**
124:  * List all organizations by fetching from the API, bypassing the cache.
125:  *
126:  * Makes a single call to the control silo's org listing endpoint
127:  * (`GET /organizations/`), which returns every organization the user
128:  * belongs to across all regions in one paginated response — no more
129:  * discovering regions via `/users/me/regions/` and fanning out to each
130:  * one. Self-hosted/monolith deployments serve the same endpoint from the
131:  * same base URL, so no special-casing is needed there either.
132:  *
133:  * Populates the org_regions cache using each org's own `links.regionUrl`,
134:  * so subsequent org-scoped commands still route to the right region. ...

Found 4 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts:
  Line 338:     registerTrustedRegionUrls(["https://us.sentry.acme.com"]);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/auth.host.test.ts:
  Line 220:     registerTrustedRegionUrls(["https://us.host-a.com"]);

  Line 222:     expect(isTrustedRegionOrigin("https://us.host-a.com")).toBe(true);

  Line 228:     expect(isTrustedRegionOrigin("https://us.host-a.com")).toBe(false);

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/auth.host.test.ts</path>
<type>file</type>
<content>
190:   test("hasUsableStoredToken reflects stored row status", () => {
191:     expect(hasUsableStoredToken()).toBe(false);
192: 
193:     setAuthToken("tok-usable", 3600, "refresh", {
194:       host: "https://sentry.io",
195:     });
196:     expect(hasUsableStoredToken()).toBe(true);
197:   });
198: 
199:   test("clearAuth evicts region-URL allow-list but PRESERVES login trust anchor", async () => {
200:     // The login anchor is set by `applyLoginUrl` at the start of the
201:     // `auth login` command lifecycle. When the user runs `auth login
202:     // --url <new-host>` while already authenticated, the flow is:
203:     //   1. applyLoginUrl — registers the new login trust anchor
204:     //   2. handleExistingAuth — calls clearAuth() if user confirms
205:     //   3. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/utils.ts</path>
<type>file</type>
<content>
1: /**
2:  * SQL builder utilities for common database operations.
3:  * Reduces boilerplate for UPSERT and other repetitive patterns.
4:  */
5: 
6: import { getDatabase } from "./index.js";
7: import type { SQLQueryBindings } from "./sqlite.js";
8: 
9: /** Valid SQLite binding value (re-exported from sqlite.ts adapter) */
10: export type SqlValue = SQLQueryBindings;
11: 
12: /**
13:  * Result of building an SQL query with parameterized values.
14:  */
15: export type SqlQuery = {
16:   /** The SQL string with ? placeholders */
17:   sql: string;
18:   /** The values to bind to the placeholders */
19:   values: SqlValue[];
20: };
21: 
22: /**
23:  * Options for the upsert function.
24:  */
25: export type UpsertOptions<T> = {
26:   /** Columns to exclude from the UPDATE SET clause */
27:   excludeFromUpdate?: (keyof ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
700:   // Retry operation AFTER try-catch so any new error from operation() propagates
701:   // instead of being swallowed and replaced with the original error
702:   if (repairSucceeded) {
703:     return { attempted: true, result: operation() };
704:   }
705: 
706:   return { attempted: false };
707: }
708: 
709: export function initSchema(db: Database): void {
710:   const ddlStatements = Object.values(EXPECTED_TABLES).join(";\n\n");
711:   db.exec(ddlStatements);
712: 
713:   const versionRow = db
714:     .query("SELECT version FROM schema_version LIMIT 1")
715:     .get() as { version: number } | null;
716: 
717:   if (!versionRow) {
718:     db.query("INSERT OR IGNORE INTO schema_version (version) VALUES (?)").run(
719:       CURRENT_SCHEMA_VERSION
720:     );
721:   }
722: }
723: 
724: function ...

Found 19 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/project/delete.ts:
  Line 71:   let orgRole = getCachedOrgRole(orgSlug);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/org/list.ts:
  Line 144:     const orgRegions = getAllOrgRegions();


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts:
  Line 103: /** When true, getCachedOrganizations() returns empty (forces API fetch). */

  Line 141: export function getOrgRegion(orgSlug: string): string | undefined {

  Line 160: export function getOrgByNumericId(

  Line 250: export function getAllOrgRegions(): Map<string, string> {

  Line 289: export function getCachedOrganizations(): CachedOrg[] {

  Line 323: export function getCachedOrgRole(orgSlug: string): string | undefined ...

Found 9 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/oauth.ts:
  Line 235:       if (!isHostTrusted(destination, url)) {


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/login-host-guard.ts:
  Line 75:     isHostTrusted(host, getStoredAuthHost()) ||

  Line 76:     isHostTrusted(host, getDefaultUrl())


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts:
  Line 31: export function isHostTrusted(

  Line 99:   return isHostTrusted(host, loginTrustAnchor);

  Line 115:   if (isHostTrusted(requestInput, anchorHost)) {

  Line 162:     return isHostTrusted(requestInput, loginTrustAnchor);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentryclirc.ts:
  Line 385:   if (tokenHost && ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/region.ts</path>
<type>file</type>
<content>
1: /**
2:  * Region resolution for multi-region Sentry support.
3:  *
4:  * Provides utilities to resolve the correct region URL for an organization,
5:  * using cached data when available or fetching from the API when needed.
6:  */
7: 
8: import { getOrganization } from "@sentry/api";
9: import { getConfiguredSentryUrl } from "./constants.js";
10: import { getOrgByNumericId, getOrgRegion, setOrgRegion } from "./db/regions.js";
11: import { stripDsnOrgPrefix } from "./dsn/index.js";
12: import { withAuthGuard } from "./errors.js";
13: import { getApiBaseUrl, getSdkConfig } from "./sentry-client.js";
14: import { isSentrySaasUrl } from "./sentry-urls.js";
15: 
16: /**
17:  * Promise cache for org region resolution, keyed by orgSlug. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/projects.ts</path>
<type>file</type>
<content>
50:  * Automatically paginates through all API pages to return the complete list.
51:  * Uses region-aware routing for multi-region support.
52:  *
53:  * @param orgSlug - Organization slug
54:  * @returns All projects in the organization
55:  */
56: export async function listProjects(orgSlug: string): Promise<SentryProject[]> {
57:   const config = await getOrgSdkConfig(orgSlug);
58: 
59:   const { data: allResults } = await autoPaginate(async (cursor) => {
60:     const result = await listOrganizationProjects({
61:       ...config,
62:       path: { organization_id_or_slug: orgSlug },
63:       query: { cursor, per_page: API_MAX_PER_PAGE } as {
64:         cursor?: string;
65:         per_page?: number;
66:       },
67:     });
68:     return unwrapPaginatedResult<SentryProject[]>(
69:       result,
70:       ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Defense-in-depth: `sntrys_` token claim vs request-origin mismatch.
3:  *
4:  * The fetch-layer guard refuses to attach a `sntrys_` token when its
5:  * embedded `url` claim disagrees with the request origin. Defends users
6:  * with access to multiple Sentry instances against routing one
7:  * instance's token to another. Claim is unsigned (see token-claims.ts),
8:  * so this catches honest misconfigurations more than malicious attacks.
9:  */
10: 
11: import { afterEach, beforeEach, describe, expect, test } from "vitest";
12: import {
13:   extractFetchUrl,
14:   mintSntrysToken,
15:   resetHostScopingState,
16:   useEnvSandbox,
17:   useTestConfigDir,
18: } from "../../helpers.js";
19: 
20: const ENV_KEYS = [
21:   "SENTRY_AUTH_TOKEN",
22:   "SENTRY_TOKEN",
23:   ...

Found 100 matches (more matches available)
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/api-client.coverage.test.ts:
  Line 58:   setOrgRegion("test-org", "https://sentry.io");


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/api-client.test.ts:
  Line 852:     setOrgRegions([

  Line 1110:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1187:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1244:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1437:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1574:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1753:     setOrgRegion("my-org", DEFAULT_SENTRY_URL);

  Line 1868:     setOrgRegions([

  Line 1919:     setOrgRegions([

  Line 1971:     ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/chunk-upload.ts</path>
<type>file</type>
<content>
115: /**
116:  * Codecs the CLI knows how to emit, in order of preference.
117:  *
118:  * `zstd` is the forward-looking codec: advertised only by servers that
119:  * implement `Content-Encoding`-based detection. `gzip` is the legacy
120:  * codec supported by every Sentry server since forever; we still send
121:  * it under the original `file_gzip` multipart field name so that
122:  * pre-zstd servers -- which ignore `Content-Encoding` -- keep working.
123:  */
124: const UPLOAD_CODECS = ["zstd", "gzip"] as const;
125: export type UploadEncoding = (typeof UPLOAD_CODECS)[number];
126: 
127: // ── API Functions ───────────────────────────────────────────────────
128: 
129: /**
130:  * Get chunk upload configuration for an organization. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/chunk-upload.ts</path>
<type>file</type>
<content>
50:   url: z.string(),
51:   /** Maximum size of a single chunk in bytes. */
52:   chunkSize: z.number(),
53:   /** Maximum number of chunks per upload request. */
54:   chunksPerRequest: z.number(),
55:   /** Maximum total request body size in bytes. */
56:   maxRequestSize: z.number(),
57:   /**
58:    * Maximum size of a single uploaded file in bytes. Omitted or `0` means the
59:    * server advertises no per-file cap, in which case the client falls back to
60:    * {@link DEFAULT_MAX_DIF_SIZE}.
61:    */
62:   maxFileSize: z.number().optional(),
63:   /**
64:    * Maximum time, in seconds, the server is willing to spend assembling an
65:    * upload. Omitted or `0` means no server-imposed cap; a non-zero value clamps
66:    * the caller's requested wait. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/chunk-upload.ts</path>
<type>file</type>
<content>
1: /**
2:  * Shared chunk-upload protocol infrastructure.
3:  *
4:  * Implements the Sentry chunk-upload + assemble protocol used by
5:  * artifact bundle (sourcemap) and DIF (proguard) uploads. Callers
6:  * build their own ZIP and choose the appropriate assemble endpoint;
7:  * this module handles chunking, hashing, codec selection, chunk
8:  * upload, and assembly polling.
9:  *
10:  * Protocol overview:
11:  * 1. GET  chunk-upload options (chunk size, concurrency, compression)
12:  * 2. (Caller builds the ZIP)
13:  * 3. Split ZIP into chunks, compute SHA-1 checksums
14:  * 4. POST assemble request -> server reports missing chunks
15:  * 5. Upload missing chunks in parallel as multipart/form-data
16:  * 6. ...

Success. Updated the following files:
M packages/cli/src/lib/db/schema.ts
M packages/cli/src/lib/db/regions.ts
M packages/cli/src/lib/token-host.ts
M packages/cli/src/lib/region.ts
M packages/cli/src/lib/api/organizations.ts

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts</path>
<type>file</type>
<content>
1: /**
2:  * Organization region cache for multi-region support.
3:  *
4:  * Sentry has multiple regions (US, EU, etc.) and organizations are bound
5:  * to a specific region. This module caches the organization-to-region
6:  * mapping to avoid repeated lookups.
7:  *
8:  * The `org_id` column (added in schema v8) enables offline resolution
9:  * of numeric org IDs extracted from DSN hosts (e.g., `o1081365` →
10:  * look up by `org_id = '1081365'` → get the slug).
11:  */
12: 
13: import { normalizeOrigin } from "../sentry-urls.js";
14: import { recordCacheHit } from "../telemetry.js";
15: import { getDatabase } from "./index.js";
16: import { runUpsert } from "./utils.js";
17: 
18: const TABLE = "org_regions";
19: 
20: /**
21:  * Process-local regional origins, grouped by the control-silo origin that
22:  * ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts</path>
<type>file</type>
<content>
265:   })();
266:   for (const entry of entries) {
267:     registerTrustedRegionUrls(entry.sourceOrigin, [entry.regionUrl]);
268:   }
269: }
270: 
271: /**
272:  * Clear all cached organization regions.
273:  * Should be called when the user logs out.
274:  */
275: export function clearOrgRegions(): void {
276:   const db = getDatabase();
277:   db.query(`DELETE FROM ${TABLE}`).run();
278:   clearTrustedHostState();
279: }
280: 
281: /**
282:  * Get all cached organization regions.
283:  * Used for determining if user has orgs in multiple regions.
284:  *
285:  * @returns Map of org slug to region URL
286:  */
287: export function getAllOrgRegions(): Map<string, string> {
288:   const db = getDatabase();
289:   const rows = db
290:     .query(`SELECT org_slug, region_url FROM ${TABLE}`)
291:     .all() as ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/token-host.ts</path>
<type>file</type>
<content>
1: /**
2:  * Host-Scoped Token Trust Model
3:  *
4:  * Tokens (env or stored OAuth) are bound to a specific Sentry host. The fetch
5:  * layer (and the `.sentryclirc` / URL-arg entry points) check each request's
6:  * destination against the token's recorded host and refuse to attach
7:  * credentials when they don't match — so untrusted routing inputs can't leak
8:  * credentials to an attacker's host.
9:  *
10:  * Host equivalence:
11:  * - Exact origin match (scheme + host + explicit port).
12:  * - SaaS equivalence class: a token scoped to `https://sentry.io` is valid for
13:  *   any `*.sentry.io` subdomain. Non-SaaS hosts match exactly — no subdomain
14:  *   suffix matching (a `sentry.acme.com` token does NOT match
15:  *   `sentry.acme.evil.com`). ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/resolve-target.ts</path>
<type>file</type>
<content>
275:   }
276: 
277:   // Fall back to numeric org ID (API accepts both slug and numeric ID)
278:   return {
279:     org: dsn.orgId,
280:     detectedFrom,
281:   };
282: }
283: 
284: /**
285:  * Normalize a bare numeric org ID to an org slug.
286:  *
287:  * When the project cache is cold, resolveOrgFromDsn returns the raw numeric
288:  * org ID from the DSN host (e.g., "1169445"). Many API endpoints reject
289:  * numeric IDs (dashboards return 404/403). This resolves them:
290:  *
291:  * 1. Local DB cache lookup (getOrgByNumericId — fast, no API call)
292:  * 2. Refresh org list via listOrganizationsUncached to populate mapping
293:  * 3. Falls back to original ID if resolution fails
294:  *
295:  * Non-numeric identifiers (already slugs) are returned unchanged. ...

Success. Updated the following files:
M packages/cli/src/lib/db/regions.ts
M packages/cli/src/lib/resolve-target.ts
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

src/lib/db/regions.ts format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:
  
     56  56 │         .query(`SELECT DISTINCT region_url FROM ${TABLE} WHERE source_origin = ?`)
     57  57 │         .all(source) as Pick<OrgRegionRow, "region_url">[];
     58     │ - ····registerTrustedRegionOrigins(source,·rows.map((row)·=>·row.region_url));
         58 │ + ····registerTrustedRegionOrigins(
         59 │ + ······source,
         60 │ + ······rows.map((row)·=>·row.region_url)
         61 │ + ····);
     59  62 │     } catch {
     60  63 │       // No DB / no table yet — first-run callers populate through the explicit
    ······· │ 
     92  95 │     seedTrustedRegionOriginsIfNeeded(source);
     93  96 │     const regionOrigin = normalizeOrigin(origin);
     94     │ - ··return·!!regionOrigin·&&·(trustedRegionOrigins.get(source)?.has(regionOrigin)·??·false);
         97 │ + ··return·(
         98 │ + ...

Checked 8 files in 3s. Fixed 4 files.
 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Migrated stored credentials to host-scoped model: https://legacy-configured.example.com
[info] [auth] Migrated stored credentials to host-scoped model: https://sentry.io
[info] [auth] Migrated stored credentials to host-scoped model: https://sentry.io
 ❯ test/lib/db/auth.host.test.ts (11 tests | 1 failed) 281ms
     × clearAuth evicts region-URL allow-list but PRESERVES login trust anchor 41ms
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var. ...

Found 8 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/schema.test.ts:
  Line 8:   CURRENT_SCHEMA_VERSION,

  Line 38:     CURRENT_SCHEMA_VERSION

  Line 60:     CURRENT_SCHEMA_VERSION

  Line 205:   test("updates schema version after repair", () => {

  Line 217:     expect(version).toBe(CURRENT_SCHEMA_VERSION);

  Line 311:     expect(version).toBe(CURRENT_SCHEMA_VERSION);

  Line 342:     expect(version).toBe(CURRENT_SCHEMA_VERSION);

  Line 474:     expect(version).toBe(CURRENT_SCHEMA_VERSION);

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/region.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Region Resolution Tests
3:  *
4:  * Tests for resolving organization regions in multi-region Sentry support.
5:  */
6: 
7: import { setTimeout as sleep } from "node:timers/promises";
8: import { afterEach, beforeEach, describe, expect, test } from "vitest";
9: import { setAuthToken } from "../../src/lib/db/auth.js";
10: import { setOrgRegion } from "../../src/lib/db/regions.js";
11: import {
12:   isMultiRegionEnabled,
13:   resolveOrgRegion,
14: } from "../../src/lib/region.js";
15: import { getSentryBaseUrl } from "../../src/lib/sentry-urls.js";
16: import { useTestConfigDir } from "../helpers.js";
17: 
18: useTestConfigDir("region-resolve-");
19: 
20: beforeEach(async () => {
21:   // Clear any SENTRY_HOST/SENTRY_URL override for most tests
22:   delete process.env.SENTRY_HOST;
23:   delete ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/region.test.ts</path>
<type>file</type>
<content>
150:           }
151:         );
152:       }
153:       return new Response(JSON.stringify({ detail: "Not found" }), {
154:         status: 404,
155:       });
156:     };
157: 
158:     try {
159:       const regionUrl = await resolveOrgRegion("new-org");
160: 
161:       // Should return the region from API
162:       expect(regionUrl).toBe("https://de.sentry.io");
163: 
164:       // Should have cached the region
165:       const after = getOrgRegion("new-org");
166:       expect(after).toBe("https://de.sentry.io");
167:     } finally {
168:       globalThis.fetch = originalFetch;
169:     }
170:   });
171: 
172:   test("uses default URL as region when org has no links.regionUrl", async () => {
173:     // Mock fetch to return org without links
174:     const originalFetch = globalThis.fetch;
175:     ...

Success. Updated the following files:
M packages/cli/test/lib/db/auth.host.test.ts
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

Checked 9 files in 3s. Fixed 1 file.
 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Migrated stored credentials to host-scoped model: https://legacy-configured.example.com
[info] [auth] Migrated stored credentials to host-scoped model: https://sentry.io
[info] [auth] Migrated stored credentials to host-scoped model: https://sentry.io
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
 ❯ test/lib/security/sntrys-claim-mismatch.test.ts (15 tests | 1 failed) ...

Success. Updated the following files:
M packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts

Checked 1 file in 1516ms. No fixes applied.

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework
[info] [auth] Migrated stored credentials to host-scoped model: https://legacy-configured.example.com
[info] [auth] Migrated stored credentials to host-scoped model: https://sentry.io
[info] [auth] Migrated stored credentials to host-scoped model: https://sentry.io
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts</path>
<type>file</type>
<content>
240:  * Each entry includes the org slug, region URL, and optionally the
241:  * numeric org ID for offline ID→slug lookups.
242:  *
243:  * @param entries - Array of org region entries
244:  */
245: export function setOrgRegions(entries: OrgRegionEntry[]): void {
246:   if (entries.length === 0) {
247:     return;
248:   }
249: 
250:   const db = getDatabase();
251:   const now = Date.now();
252: 
253:   db.transaction(() => {
254:     for (const entry of entries) {
255:       const row: Record<string, string | number | null> = {
256:         org_slug: entry.slug,
257:         region_url: entry.regionUrl,
258:         source_origin: normalizeOrigin(
259:           entry.sourceOrigin ?? DEFAULT_SENTRY_URL
260:         ),
261:         updated_at: now,
262:       };
263:       if (entry.orgId) {
264:         ...

Success. Updated the following files:
M packages/cli/src/lib/db/regions.ts

Checked 1 file in 1269ms. Fixed 1 file.
 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Migrated stored credentials to host-scoped model: https://legacy-configured.example.com
[info] [auth] Migrated stored credentials to host-scoped model: https://sentry.io
[info] ...

 M .lore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/dashboard.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/event.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/explore.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/feedback.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/issue.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/log.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/replay.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/span.md
 M packages/cli/plugins/sentry-cli/skills/sentry-cli/references/trace.md
 M packages/cli/src/lib/api/organizations.ts
 M packages/cli/src/lib/constants.ts
 M packages/cli/src/lib/db/regions.ts
 M packages/cli/src/lib/db/schema.ts
 M packages/cli/src/lib/oauth.ts
 M packages/cli/src/lib/region.ts
 M packages/cli/src/lib/resolve-target.ts
 M packages/cli/src/lib/sentry-client.ts
 M ...

Found 12 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/complete.ts:
  Line 190:   const orgs = getCachedOrganizations();

  Line 295:   const orgs = getCachedOrganizations();


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/projects.ts:
  Line 77:     const orgs = getCachedOrganizations();

  Line 575:   const cached = getCachedOrganizations().find((o) => o.slug === orgSlug);


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/organizations.ts:
  Line 109:   const cached = getCachedOrganizations();


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/org-list.ts:
  Line 1054:   const cachedOrgs = ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/sentry-client.ts</path>
<type>file</type>
<content>
80: /** Stamped on thrown errors caused by our own per-request timeout. */
81: const INTERNAL_TIMEOUT_MARKER = Symbol("sentry-cli:internal-timeout");
82: 
83: /** Calculate exponential backoff delay, capped at MAX_BACKOFF_MS */
84: function backoffDelay(attempt: number): number {
85:   return Math.min(1000 * 2 ** attempt, MAX_BACKOFF_MS);
86: }
87: 
88: /** Check if an error is a user-initiated abort */
89: function isUserAbort(error: unknown, signal?: AbortSignal | null): boolean {
90:   return (
91:     error instanceof DOMException &&
92:     error.name === "AbortError" &&
93:     Boolean(signal?.aborted)
94:   );
95: }
96: 
97: /**
98:  * Prepare request headers with auth token and default headers.
99:  *
100:  * Only sets Authorization and User-Agent. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/oauth.ts</path>
<type>file</type>
<content>
175:       out.push(scope);
176:     }
177:   }
178:   if (out.length === 0) {
179:     throw new ValidationError("No scopes provided to --scope", "scope");
180:   }
181:   return out.join(" ");
182: }
183: 
184: type DeviceFlowCallbacks = {
185:   onUserCode: (
186:     userCode: string,
187:     verificationUri: string,
188:     verificationUriComplete: string
189:   ) => void | Promise<void>;
190: };
191: 
192: function sleep(ms: number): Promise<void> {
193:   return new Promise((resolve) => setTimeout(resolve, ms));
194: }
195: 
196: /**
197:  * Wrap a fetch call with connection error handling.
198:  * Converts network errors into user-friendly ApiError messages. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/schema.ts</path>
<type>file</type>
<content>
130:   project_aliases: {
131:     columns: {
132:       alias: { type: "TEXT", primaryKey: true },
133:       org_slug: { type: "TEXT", notNull: true },
134:       project_slug: { type: "TEXT", notNull: true },
135:       dsn_fingerprint: { type: "TEXT" },
136:       cached_at: {
137:         type: "INTEGER",
138:         notNull: true,
139:         default: "(unixepoch() * 1000)",
140:       },
141:       last_accessed: {
142:         type: "INTEGER",
143:         notNull: true,
144:         default: "(unixepoch() * 1000)",
145:       },
146:     },
147:   },
148:   pagination_cursors: {
149:     columns: {
150:       command_key: { type: "TEXT", notNull: true },
151:       context: { type: "TEXT", notNull: true },
152:       cursor_stack: { type: "TEXT", notNull: true },
153:       page_index: { type: "INTEGER", ...

apply_patch verification failed: Error: Failed to find expected lines in /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/projects.ts:
import { getSdkConfig } from "../sentry-client.js";

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/organizations.ts</path>
<type>file</type>
<content>
1: /**
2:  * Organization API functions
3:  *
4:  * CRUD operations and region discovery for Sentry organizations.
5:  */
6: 
7: import {
8:   getOrganization as sdkGetOrganization,
9:   listOrganizations as sdkListOrganizations,
10: } from "@sentry/api";
11: 
12: import {
13:   type Region,
14:   type SentryOrganization,
15:   type UserRegionsResponse,
16:   UserRegionsResponseSchema,
17: } from "../../types/index.js";
18: 
19: import { ApiError } from "../errors.js";
20: import { getControlSiloUrl, getSdkConfig } from "../sentry-client.js";
21: 
22: import {
23:   API_MAX_PER_PAGE,
24:   apiRequestToRegion,
25:   autoPaginate,
26:   getOrgSdkConfig,
27:   MAX_PAGINATION_PAGES,
28:   type PaginatedResponse,
29:   unwrapPaginatedResult,
30:   unwrapResult,
31: } from "./infrastructure.js";
32: 
33: /**
34:  ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/api/projects.ts</path>
<type>file</type>
<content>
1: /**
2:  * Project API functions
3:  *
4:  * CRUD operations, search, and DSN key retrieval for Sentry projects.
5:  */
6: 
7: import {
8:   createTeamProject,
9:   listOrganizationProjects,
10:   listProjectKeys,
11:   deleteProject as sdkDeleteProject,
12:   getProject as sdkGetProject,
13: } from "@sentry/api";
14: 
15: import pLimit from "p-limit";
16: 
17: import type {
18:   ProjectKey,
19:   Region,
20:   SentryOrganization,
21:   SentryProject,
22: } from "../../types/index.js";
23: 
24: import {
25:   cacheProjectsForOrg,
26:   setCachedProjectByDsnKey,
27: } from "../db/project-cache.js";
28: import { getCachedOrganizations } from "../db/regions.js";
29: import { type AuthGuardSuccess, withAuthGuard } from "../errors.js";
30: import { resolveOrgRegion } from "../region.js";
31: import { getApiBaseUrl ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/commands/project/delete.ts</path>
<type>file</type>
<content>
1: /**
2:  * sentry project delete
3:  *
4:  * Permanently delete a Sentry project.
5:  *
6:  * ## Flow
7:  *
8:  * 1. Parse target arg → extract org/project (e.g., "acme/my-app" or "my-app")
9:  * 2. Verify the project exists via `getProject` (also displays its name)
10:  * 3. Prompt for confirmation by typing `org/project` (unless --yes is passed)
11:  * 4. Call `deleteProject` API
12:  * 5. Display result
13:  *
14:  * Safety measures:
15:  * - Uses `buildDeleteCommand` — auto-injects `--yes`/`--force`/`--dry-run`
16:  *   flags and enforces the non-interactive guard before `func()` runs
17:  * - No auto-detect mode: `requireExplicitTarget` blocks accidental deletion
18:  * - Type-out confirmation via `confirmByTyping` (unless --yes/--force)
19:  */
20: 
21: import type { SentryContext } from ...

Found 5 matches
/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts:
  Line 380:     registerTrustedRegionUrls("https://sentry.acme.com", [


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/auth.host.test.ts:
  Line 220:     registerTrustedRegionUrls("https://sentry.host-a.com", [


/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/src/lib/db/regions.ts:
  Line 76: export function registerTrustedRegionUrls(

  Line 233:   registerTrustedRegionUrls(sourceOrigin, [regionUrl]);

  Line 282:     registerTrustedRegionUrls(entry.sourceOrigin ?? DEFAULT_SENTRY_URL, [

Success. Updated the following files:
M packages/cli/src/lib/db/regions.ts
M packages/cli/src/lib/api/organizations.ts
M packages/cli/src/lib/api/projects.ts
M packages/cli/src/commands/project/delete.ts
M packages/cli/src/commands/org/list.ts

Checked 5 files in 1793ms. Fixed 2 files.
 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var. ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/schema.test.ts</path>
<type>file</type>
<content>
1: /**
2:  * Tests for database schema repair functions.
3:  */
4: 
5: import { join } from "node:path";
6: import { describe, expect, test } from "vitest";
7: import {
8:   CURRENT_SCHEMA_VERSION,
9:   EXPECTED_COLUMNS,
10:   EXPECTED_TABLES,
11:   generatePreMigrationTableDDL,
12:   getSchemaIssues,
13:   hasColumn,
14:   initSchema,
15:   isReadonlyError,
16:   repairSchema,
17:   runMigrations,
18:   tableExists,
19: } from "../../../src/lib/db/schema.js";
20: import { Database } from "../../../src/lib/db/sqlite.js";
21: import { getMetadata } from "../../../src/lib/db/utils.js";
22: import { useTestConfigDir } from "../../helpers.js";
23: 
24: /**
25:  * Create a database with all tables but some missing (for testing repair). ...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/db/schema.test.ts</path>
<type>file</type>
<content>
430: 
431:     db.close();
432:   });
433: 
434:   test("migration 12→13 handles partial defaults (org only)", () => {
435:     const db = new Database(join(getTestDir(), "test.db"));
436:     initSchema(db);
437: 
438:     db.exec(`CREATE TABLE IF NOT EXISTS defaults (
439:       id INTEGER PRIMARY KEY CHECK (id = 1),
440:       organization TEXT,
441:       project TEXT,
442:       updated_at INTEGER NOT NULL DEFAULT (unixepoch() * 1000)
443:     )`);
444:     db.query(
445:       "INSERT INTO defaults (id, organization, project) VALUES (1, ?, NULL)"
446:     ).run("only-org");
447:     db.query("UPDATE schema_version SET version = 12").run();
448: 
449:     runMigrations(db);
450: 
451:     expect(tableExists(db, "defaults")).toBe(false);
452: 
453:     const m = getMetadata(db, ["defaults.org", ...

Success. Updated the following files:
M packages/cli/test/lib/db/schema.test.ts

src/lib/oauth.ts:200:16 lint/complexity/noExcessiveCognitiveComplexity ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Excessive complexity of 17 detected (max: 15).
  
    198 │  * Converts network errors into user-friendly ApiError messages.
    199 │  */
  > 200 │ async function fetchWithConnectionError(
        │                ^^^^^^^^^^^^^^^^^^^^^^^^
    201 │   url: string,
    202 │   init: RequestInit
  
  i Please refactor this function to reduce its complexity score from 17 to the max allowed complexity 15.
  

check ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while applying fixes.
  

Checked 17 files in 4s. No fixes applied.
Found 1 error.

[
  {
    "content": "Inspect issue and affected CLI behavior",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add regression coverage and implement fix",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Close redirect and region-trust review findings",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Run focused and repository checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

Success. Updated the following files:
M packages/cli/src/lib/oauth.ts

Checked 1 file in 1460ms. No fixes applied.
 DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework

 RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli

[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.
[info] [auth] Detected SENTRY_AUTH_TOKEN env var but using stored login for stored OAuth user.
  Set SENTRY_FORCE_ENV_TOKEN=1 to prefer the env var.

 Test Files  3 passed (3)
      Tests  27 passed (27)
   Start at  12:02:17
   Duration  10.48s (transform 6.06s, setup 237ms, import 8.30s, tests 8.84s, environment 0ms)


> sentry@0.40.0-dev.0 lint /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
> biome check ...

[
  {
    "content": "Inspect issue and affected CLI behavior",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add regression coverage and implement fix",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Close redirect and region-trust review findings",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run focused and repository checks",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Review final diff and report outcome",
    "status": "pending",
    "priority": "medium"
  }
]

...output truncated...

Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_08b3786790012zgvD1ZE0qC3B4

USER=byk
npm_config_user_agent=pnpm/10.11.0 npm/? node/v24.16.0 linux x64
AGENT=1
npm_node_execpath=/home/byk/.volta/tools/image/node/24.16.0/bin/node
SHLVL=1
HOME=/home/byk
npm_package_json=/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/package.json
npm_package_engines_node=>=18.0
SYSTEMD_EXEC_PID=1540839
OPENCODE_EXPERIMENTAL_PLAN_MODE=1
VOLTA_HOME=/home/byk/.volta
_VOLTA_TOOL_RECURSION=1
LOGNAME=byk
JOURNAL_STREAM=8:380479822
_=/home/byk/.volta/bin/pnpm
MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/system.slice/opencode.service/memory.pressure
npm_config_registry=https://registry.npmjs.org/
npm_config_node_linker=isolated
OPENCODE=1
SENTRY_ENABLED=1
npm_config_node_gyp=/home/byk/.opencode/server/opencode-server
PATH=/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cact...

<path>/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli/test/lib/resolve-target.mocked.test.ts</path>
<type>file</type>
<content>
270:       protocol: "https",
271:       publicKey: "abc",
272:       host: "o123.ingest.sentry.io",
273:       projectId: "456",
274:       orgId: "123",
275:       source: "env",
276:     });
277:     mockGetCachedProject.mockReturnValue(null);
278: 
279:     const result = await resolveOrg({ cwd: "/test" });
280: 
281:     expect(result).not.toBeNull();
282:     expect(result?.org).toBe("123");
283:   });
284: 
285:   test("normalizes numeric orgId to slug via DB cache", async () => {
286:     mockGetDefaultOrganization.mockReturnValue(null);
287:     mockDetectDsn.mockResolvedValue({
288:       raw: "https://abc@o1169445.ingest.us.sentry.io/456",
289:       protocol: "https",
290:       publicKey: "abc",
291:       host: "o1169445.ingest.us.sentry.io",
292:       projectId: "456",
293:       ...

Success. Updated the following files:
M packages/cli/test/lib/resolve-target.mocked.test.ts

...output truncated...

Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_08b405321001WhTV99kY0m1vNy

SHELL=/usr/bin/bash
npm_package_version=0.40.0-dev.0
npm_lifecycle_event=test:unit
npm_config_verify_deps_before_run=false
LORE_GATEWAY_URL=http://127.0.0.1:3207
LORE_ALLOW_REMOTE_MANAGEMENT=1
LORE_WARMUP_PROBE=1
PWD=/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
npm_execpath=/home/byk/.local/share/pnpm/.tools/pnpm/10.11.0_tmp_3945111/node_modules/pnpm/bin/pnpm.cjs
npm_config__jsr_registry=https://npm.jsr.io/
npm_command=run-script
PNPM_SCRIPT_SRC_DIR=/home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
LORE_LISTEN_HOST=127.0.0.1,100.69.65.125
AWS_BEARER_TOKEN_BEDROCK=ABSKTWFudGxlQXBpS2V5LW14aW1zeGxkLWF0LTg1NDQ4MTIwMTg4NDpqYmJnbGhQTVlFMDVpT3JQZkxlUmhIdlZpTXpRekhEVFhIVUl6RHJwUjJPeHZtR3FnQ3puM3RhYjNrOD0=
MEMORY_PRESSURE_WRITE=c29tZSAyMDAwMDAgMjAwMDA...

<path>/home/byk/.local/share/opencode/tool-output/tool_08b405321001WhTV99kY0m1vNy</path>
<type>file</type>
<content>
1: Checked 1 file in 2s. No fixes applied.
2:  DEPRECATED  `test.poolOptions` was removed in Vitest 4. All previous `poolOptions` are now top-level options. Please, refer to the migration guide: https://vitest.dev/guide/migration#pool-rework
3: 
4:  RUN  v4.1.10 /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
5: 
6: 
7:  Test Files  1 passed (1)
8:       Tests  48 passed (48)
9:    Start at  12:12:17
10:    Duration  3.57s (transform 2.66s, setup 139ms, import 3.13s, tests 63ms, environment 0ms)
11: 
12: 
13: > sentry@0.40.0-dev.0 test:unit /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/glowing-cactus/packages/cli
14: > pnpm run generate:docs && pnpm run generate:sdk && vitest run test/lib test/commands test/types test/script --coverage
15: 
16: 
17: > sentry@0.40.0-dev.0 ...