[sentry-junior]

This follows up on #2054. Command hints in the CLI now use a sentry`…` template tag, so each hint names the program that's actually running: sentry, npx -y sentry or sentry-mcp. The sentry-cli/no-hardcoded-sentry-command oxlint rule flags hints that skip the tag. check:doc-examples checks every tag's command and flags against the real route tree.

What changed

• The tag. sentry in src/lib/app-identity.ts takes the command without the program name, for example sentry`issue list ${org}/`. It adds getInvocationCommand() when the hint is built. It's recursive: an interpolated value that's itself a sentry … command gets the same prefix. A value the tag already built keeps its prefix, so nothing is named twice. No code in src used sentry as an identifier, so the name doesn't clash. The Sentry SDK is imported as Sentry.
• Migration. About 390 asInvocationCommand("sentry …") and asRunningAppCommand("sentry …") calls on literals now use the tag. I converted them with a TypeScript-AST codemod, so the template text is unchanged.
• One function form stays. asInvocationCommand(command) remains for 51 commands that live in runtime data: USAGE_HINT/usageHint passed into errors, org-list's commandPrefix, suggestion lists, and the ContextError/ResolutionError usage lines. A tag can't wrap a value whose text isn't known at the call site. asRunningAppCommand is gone. Help usage lines and --help examples now go through the tag or asInvocationCommand, so they also print npx -y sentry … under npx.
• A route-aware lint rule. sentry <word> is flagged only when <word> is one of the top-level routes in src/command-manifest.ts (the rule reads the keys of COMMAND_MANIFEST), a flag (sentry --help), a <placeholder>, or an interpolation. Prose such as "sentry binary", "sentry entries in …" or "Installed sentry v…" passes, so I removed the 6 disable comments that existed only for those cases. The rule also flags:
  • a tag or asInvocationCommand() at module scope, which runs before the entry point sets the app identity;
  • asInvocationCommand() on a literal (use the tag instead);
  • a tag whose text repeats sentry.
• Checking tag text. script/check-doc-examples.ts already resolves commands and flags against the live route tree. It now also scans src for sentry`…` tags, with each interpolation read as a placeholder. I put the check there rather than in the lint rule: oxlint plugins run as plain JS and can't load the TypeScript route tree, while this script already loads it and already runs in CI through ci:policy. It found two DSN hints that told people to run sentry config set defaults.org/defaults.project, which don't exist. They now say sentry cli defaults org/project.
• Updated the packages/cli/AGENTS.md note.

A few disable comments remain, each with a reason: help/introspect code that matches command paths, the telemetry value app.server.distribution, the env-var reference text in env-registry.ts, and shell.ts's "Added sentry ${label}", where an interpolation follows sentry.

Testing

• node --test scripts/cli-lint-rules.test.mjs: 116/116 pass. New cases cover route-aware prose, sentry --help, a literal passed to asInvocationCommand, a doubled sentry, and a module-level tag.
• test/lib/app-identity.test.ts covers the tag under the default name, under sentry-mcp and under npx, plus the rewriting of interpolated commands without doubling.
• I added a temporary tag with a bad command (isue list) and an unknown flag (--bogus). pnpm run check:doc-examples reported both, then I removed it. The real run passes 1,551 examples. All of pnpm run ci:policy passes.
• pnpm run tsc and pnpm run lint pass.
• pnpm --filter sentry run test: 12,879 pass and 5 fail. These are the same 5 file-permission tests that fail on unchanged main in my sandbox (completions EACCES/EPERM, the read-only db warning, unreadable files in the DSN scanner, acquireLock).

Known gaps

• The lint rule can't follow data flow. A module-level command constant printed without going through one of the wrapping helpers would slip past it.
• The tag also rewrites an interpolated value that happens to start with sentry and isn't a command, such as unquoted user text. Search queries are passed through shellQuote first, so they start with a quote and aren't affected.

Refs #2054
Refs #2050

via @BYK.

--

View Session [Sentry]

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sentry-local	Ready	Preview	Nov 7, 2026 2:08am UTC

[BYK]

We should not make this specific to @sentry/mcp-server as one can run sentry as npx sentry or pnpx sentry or even npx @sentry/cli in the near future.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

There are 5 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 96ebd2a. Configure here.}

[BYK]

Maybe asInvocationCommand can become a template tag which may help with interpolation too as we can make it recursive?

[sentry-junior]

Agreed. In 96ebd2a the rule covers all of packages/cli/src, not just the code the mcp-server bundle ships, and the message now names npx sentry and sentry-mcp. About 240 more hints in commands/ go through asInvocationCommand(), so npx sentry, pnpx sentry and sentry-mcp each get their own invocation, and npx @sentry/cli will too once app-identity knows that package.

Module-level usage lines (USAGE_HINT, commandPrefix) stay plain data. ContextError, ResolutionError, buildValidationMessage and org-list now wrap them when they print them. Command help (docs, fullDescription, brief, examples) is still exempt. I updated the PR body with the details.

[sentry-junior]

Went with the template tag, reworked in place in df1b5a8:

• sentry`issue list ${org}/` (in app-identity.ts) prepends the running program: sentry, npx -y sentry, or sentry-mcp. It's recursive as you suggested: an interpolated sentry … command gets the same prefix, and a value the tag already built is never doubled.
• About 390 call sites moved to the tag via an AST codemod. asRunningAppCommand is gone. asInvocationCommand(command) stays only for the 51 commands that are runtime data (USAGE_HINT, commandPrefix, suggestion lists), since a tag can't wrap a variable's text.
• The lint rule is now route-aware: it flags sentry <word> only when <word> is a real top-level route from command-manifest.ts (or a flag, placeholder, or interpolation), so "sentry binary" and friends pass with no disable comments. It also flags a tag at module scope and asInvocationCommand() on a literal.
• check:doc-examples now validates every tag's command path and flags against the live route tree. It immediately caught two DSN hints pointing at a nonexistent sentry config set defaults.org; they now say sentry cli defaults org/project.