safe-chains 0.219.0

[[command]]
name = "sentry-cli"
description = "Sentry CLI — manages releases, source maps, and crash artifacts against a Sentry organization. Most subcommands contact the Sentry API over the network using an ambient auth token (SENTRY_AUTH_TOKEN / ~/.sentryclirc). Read-only network subcommands (`info`, `releases list`, `releases info`, `projects list`, `organizations list`, `issues list`, `events list`) query and mutate nothing. A handful are purely local: `releases propose-version` (derives a version from git HEAD), `debug-files check/find/print-sources` (inspect a debug-info file on disk), and `bash-hook` (prints a shell snippet to stdout). `debug-files bundle-sources/bundle-jvm` and `sourcemaps inject` write local files only. Everything else mutates the remote or executes code and is not covered: `releases new/finalize/delete/set-commits`, `deploys`, `issues mutate`, all `upload`/`sourcemaps upload`/`debug-files upload` (network uploads), `send-event`/`send-envelope` (exfiltrate local data to a DSN), `monitors run -- <cmd>` (wraps and executes an arbitrary command), and `login`/`logout` (interactive credential lifecycle). Rust project, frequent releases; 2.x→3.x dropped legacy API-key auth and the `files`/`send-metric` subcommands."
url = "https://docs.sentry.io/cli/"
researched_version = "sentry-cli 3.5.1 (2026-06-16)"
bare_flags = ["--help", "--version", "-h", "-V"]

examples_safe = [
  "sentry-cli info",
  "sentry-cli releases list",
  "sentry-cli releases info abc123",
  "sentry-cli releases propose-version",
  "sentry-cli projects list",
  "sentry-cli organizations list",
  "sentry-cli issues list",
  "sentry-cli debug-files check ./app.dSYM",
  "sentry-cli sourcemaps inject ./dist",
  "sentry-cli bash-hook",
]
examples_denied = [
  "sentry-cli releases new v1.0",
  "sentry-cli releases finalize v1.0",
  "sentry-cli sourcemaps upload ./dist",
  "sentry-cli debug-files upload ./app.dSYM",
  "sentry-cli send-event -m hello",
  "sentry-cli monitors run my-monitor -- ./backup.sh",
  "sentry-cli login",
]

[[command.sub]]
name = "info"
level = "SafeRead"
bare = true
standalone = ["--config-status-json", "--help", "-h"]

[[command.sub]]
name = "completions"
level = "Inert"
bare = false
tolerate_unknown_short = true
standalone = ["--help", "-h"]

[[command.sub]]
name = "help"
allow_all = true

[[command.sub]]
name = "login"
candidate = true

# `list`/`info` read; `propose-version` derives a version from git (local).
# Mutating verbs (new/finalize/delete/set-commits/files upload) are not covered.
[[command.sub]]
name = "releases"
[[command.sub.sub]]
name = "list"
level = "SafeRead"
standalone = ["--help", "-h"]
[[command.sub.sub]]
name = "info"
level = "SafeRead"
bare = false
standalone = ["--help", "-h"]
[[command.sub.sub]]
name = "propose-version"
level = "Inert"
standalone = ["--help", "-h"]

[[command.sub]]
name = "issues"
[[command.sub.sub]]
name = "list"
level = "SafeRead"
standalone = ["--help", "-h"]

[[command.sub]]
name = "events"
[[command.sub.sub]]
name = "list"
level = "SafeRead"
standalone = ["--help", "-h"]

[[command.sub]]
name = "files"
candidate = true

[[command.sub]]
name = "deploys"
candidate = true

[[command.sub]]
name = "send-event"
candidate = true

[[command.sub]]
name = "send-envelope"
candidate = true

[[command.sub]]
name = "send-metric"
candidate = true

# `inject` rewrites local JS/map files with debug IDs (local write). `upload`
# and `explain` are not covered.
[[command.sub]]
name = "sourcemaps"
[[command.sub.sub]]
name = "inject"
level = "SafeWrite"
bare = false
standalone = ["--help", "-h"]

[[command.sub]]
name = "upload-dif"
candidate = true

[[command.sub]]
name = "upload-proguard"
candidate = true

# `check`/`find`/`print-sources` inspect debug-info files on disk (local read);
# `bundle-sources`/`bundle-jvm` write a local bundle. `upload` is not covered.
[[command.sub]]
name = "debug-files"
[[command.sub.sub]]
name = "check"
level = "Inert"
bare = false
standalone = ["--help", "-h"]
[[command.sub.sub]]
name = "find"
level = "Inert"
standalone = ["--help", "-h"]
[[command.sub.sub]]
name = "print-sources"
level = "Inert"
bare = false
standalone = ["--help", "-h"]
[[command.sub.sub]]
name = "bundle-sources"
level = "SafeWrite"
bare = false
standalone = ["--help", "-h"]
[[command.sub.sub]]
name = "bundle-jvm"
level = "SafeWrite"
bare = false
standalone = ["--help", "-h"]

[[command.sub]]
name = "react-native"
candidate = true

[[command.sub]]
name = "monitors"
candidate = true

[[command.sub]]
name = "monitors-run"
candidate = true

[[command.sub]]
name = "organizations"
[[command.sub.sub]]
name = "list"
level = "SafeRead"
standalone = ["--help", "-h"]

[[command.sub]]
name = "projects"
[[command.sub.sub]]
name = "list"
level = "SafeRead"
standalone = ["--help", "-h"]

[[command.sub]]
name = "update"
candidate = true

[[command.sub]]
name = "uninstall"
candidate = true

[[command.sub]]
name = "kvstore"
candidate = true

[[command.sub]]
name = "mcp-server"
candidate = true

[[command.sub]]
name = "logout"
candidate = true

[[command.sub]]
name = "config"
candidate = true

[[command.sub]]
name = "send"
candidate = true

# Prints a bash trap snippet to stdout (what the caller does with it is theirs).
[[command.sub]]
name = "bash-hook"
level = "Inert"
standalone = ["--help", "-h"]