ref(cli): Parse event view arguments with the shared ID grammar by sentry-junior[bot] · Pull Request #1733 · getsentry/toolkit

sentry-junior · 2026-10-29T19:35:04Z

Part of #1564. Follows #1729.

event view was the last command that parsed IDs itself. It was exempt from sentry-cli/no-ad-hoc-id-arguments because it also takes issues. It now uses the shared grammar and parses its arguments before func runs.

How it parses now (parseEventViewInput, wired with boundArguments):

Issue forms are checked first, using the same looksLikeIssueShortId and numeric checks as before:
- [<org>/]<short-id>, [<org>/]<numeric-id>, and issue URLs without an event show the issue's latest event.
- <short-id>/<event-id> and [<org>/]<short-id> <event-id> show that event of the issue.
Everything else goes through parseIdArguments with a new ID_KINDS.event (fromUrl → url.eventId), using multiple, needsProject and validate: false. A short ID or numeric ID in the event-ID slot still redirects to that issue's latest event.
Parsing has no side effects. resolveEventViewInput applies a pasted URL's server, logs warnings (such as reversed arguments), and validates or recovers the event ID, like trace view does.

Removed: parseSingleArg, parseSingleSlashArg and parsePositionalArgs, plus the uses of parseSlashSeparatedArg, detectSwappedViewArgs and HEX_ID_RE. AD_HOC_ID_PARSING_ALLOWED is gone from the lint plugin, so the rule now covers every command. EventViewArguments joins the require-target-resolution type list.

Shared grammar change: the reversed form now accepts more IDs after it (<id> <org>/<project> <id>...). The grammar's header already says more IDs may follow any form, and event view handled this before, so the "collects extras when args are swapped" test keeps passing. Nothing else in the grammar changes. There's a new case in test/lib/id-arguments.test.ts.

Kept behavior (existing tests pass; only the parse function's name changed):

CLI-1HT newline expansion
the swapped-argument warning
rejecting a bare latest
issue URL → latest event
an explicit event ID with an issue short ID: it's validated and never falls back to latest
org/SHORT-ID, SHORT-ID/EVENT-ID, project/EVENT-ID, org/NUMERIC-ID, and multiple event IDs

Behavior changes (intentional):

Bad input such as CAM-82X 95fd7f5a now fails the parse like other bound positionals: Failed to parse … for org/project/event-id, exit 252, before auth and before any request.
A pasted URL's server is applied when the arguments resolve, not while parsing. An attacker host still fails in applySentryUrlContext before any request; url-arg-poison.test.ts now checks that through the command.
<target> "" is reported as a missing event ID, not an invalid empty one.
<short-id> <org>/<project> is read as reversed arguments: that issue's latest event in that project, with a warning. It used to fail validation as an event ID.
<org>/<project>/<short-id> now shows that issue's latest event. It used to fail as a malformed event ID.

Open question: issue detection still uses looksLikeIssueShortId, not the #1729 issue grammar. That grammar accepts any token as a short-ID suffix, so it can't tell an issue from an event ID; it only parses an argument already known to be an issue.

Tests:

new parse cases: reversed short ID, org/project/SHORT-ID, and a self-hosted issue URL returning baseUrl
a func test showing bad input fails before any API call
ID_KINDS.event in the shared grammar table, plus an event-URL case

Verification: tsc and repo lint (oxlint, oxfmt, ast-grep) pass. The command, security and parser suites pass: 3,633 tests. The full CLI unit suite only fails the 6 permission tests that can't pass in the sandbox, which runs as root.

via BYK.

--

View Junior Session in Sentry

Event IDs in `event view` now go through `parseIdArguments` with a new `ID_KINDS.event` kind, and the arguments are parsed before the command runs (`boundArguments`). Issue forms (short IDs, numeric IDs, issue URLs, `<short-id>/<event-id>`, `<short-id> <event-id>`) are checked first. The hand-written slash, swap, and single-argument parsing is gone, and so is event view's exemption from `sentry-cli/no-ad-hoc-id-arguments`. The shared grammar now also reads more IDs after reversed arguments (`<id> <org>/<project> <id>...`), which its header already promised and event view did before. Part of #1564 Co-Authored-By: BYK <burak.kaya@sentry.io>

vercel · 2026-10-29T19:35:10Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
sentry-local	Skipped		Oct 29, 2026 8:02pm UTC

Co-Authored-By: BYK <burak.kaya@sentry.io>

cursor

Stale Bugbot comment from a previous run.

`<short-id>/<x>` is always an event of the issue, so an incomplete event ID fails the parse instead of naming project `<short-id>`. An issue short ID after `<org>/<project>/` also takes an event ID after it. Co-Authored-By: BYK <burak.kaya@sentry.io>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 574691f. Configure here.}

Part of #1564. Follow-up to #1733, which was merged before this fix was pushed to it. Cursor Bugbot flagged the bug on that PR. #1733 checked `<org>/<numeric-issue-id>` before `<issue-short-id>/<event-id>` in single-token `event view` arguments. Event IDs are 32 hex characters, so an all-digit event ID also matches the numeric-issue check. As a result, `CAM-82X/12345678901234567890123456789012` was read as org `CAM-82X` with numeric issue `1234…`, instead of that event of issue `CAM-82X`. This restores the order from before #1733: 1. `<org>/<issue-short-id>` 2. `<issue-short-id>/<event-id>`, including an event ID made only of digits 3. `<org>/<numeric-issue-id>` A shorter numeric suffix (`CAM-82X/12345`) still names a numeric issue in org `CAM-82X`, as it did before #1733. An incomplete hex fragment (`CAM-82X/95fd7f5a`) still fails the parse. Test: `reads an all-digit event ID after <short-id>/ as the issue's event` in `test/commands/event/view.test.ts`. Verification: `tsc`, repo lint (oxlint, oxfmt, ast-grep) and the event, ID-grammar and security suites pass (389 tests).  via **BYK**.    -- [View Junior Session in Sentry](https://sentry.sentry.io/explore/conversations/agent%3Ab47afb146f99778033f77dec53fa2175/?project=4510944073809921)  Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: BYK <burak.kaya@sentry.io>

…ns (#1739) Part of #1564. Every command that still parses a positional inside `func` is now named on a lint allow-list with its follow-up, so the rest can be migrated one by one and no new one can appear. Release commands, the small straggler, move to a bound positional. A new table-driven test checks that commands taking IDs read the same inputs the same way. ## Lint - `no-ad-hoc-id-arguments` now also rejects `parseIssueTarget` and `parseDashboardTarget` in commands. These parsers only tag a positional for completion and leave the parsing to `func`. - `require-target-resolution` now also rejects `parseOrgTarget`, `parseOrgProjectTarget`, `parseOrgProjectArg`, and the `resolve{OrgOnly,OrgOptional,ProjectBound}FromArg` helpers in commands. - Both rules use allow-lists (`AD_HOC_ID_PARSING_ALLOWED`, `UNBOUND_TARGET_PARSING_ALLOWED`), and each entry names its follow-up. The lists only shrink: an allow-listed file that stops using the names gets "Remove this file from the allow-list". - `event view` is no longer exempt, since #1733 merged. - `ReleaseTarget` was added to `BOUND_TARGET_TYPES`. - New rule tests are in `scripts/cli-lint-rules.test.mjs`. ## Release positional `releaseParameter(USAGE_HINT, brief)` in `release/parse.ts` returns a bound `ReleaseTarget`. `func` reads `{ version, org, detectedFrom }` from `await target.resolved`. A blank version now fails the parse (exit 252) instead of failing inside `func`. Migrated commands: archive, create, delete, deploy, deploys, finalize, restore, set-commits, view. ## Cross-command conventions test `test/lib/argument-conventions.test.ts` runs the same inputs through each command's own positional with `applyBoundPositionals`, the way Stricli does. The inputs are: - a bare ID - `<x>/<id>` - `<org>/<project>/<id>` - `<org>/<project> <id>` - reversed arguments (expects a warning) - extra or multiple IDs - a missing ID (expects `ArgumentParseError`) - a pasted URL (its server must be applied only when `.resolved` runs) Commands covered: trace view/logs, span view/list, log view/list, event view, replay view/download, the single-issue commands (issue and feedback), and all release commands. Where a command legitimately differs, its row says how: - `slashTarget: "project"` for span view, log view and event view - `multiple` for span view, log view and event view - `optional` for span list and log list - `separateTarget: false` for span view - no URL for log view ## Audit: positional parsing in `func` Excludes `event view` (#1733, merged) and `dashboard/*` (#1730). **Already on bound parsers (verified)** - [x] `trace view`, `trace logs` (#1711, #1728) - [x] `span view`, `span list` (#1711, #1728) - [x] `log view`, `log list`: fully migrated in #1714. The remaining `parseOrgProjectInput` call is inside the bound `parseLogListInput`, not in `func`. - [x] `replay view`, `replay download`: fully migrated in #1714 (`parseIdArgument` is called inside the bound parser). - [x] Single-issue commands (`issuePositional`, #1729) and `event view` (#1733) - [x] `release *` (9 commands): **migrated in this PR** **Allow-listed, still parsing in `func`** - [ ] `issue view`, `issue explain` (`issue/utils.ts`), `issue merge`: these take several issues and need an array issue positional (#1564) - [ ] `alert issues create/delete/edit/view`: `[<org>/[<project>/]]<rule>`, resolving to every matching project (#1564: alert rule target) - [ ] `alert metrics create/delete/edit/list/view`: `[<org>/]<rule>`, org-scoped (#1564: alert rule target) - [ ] `agent-conversation view`, `integration delete`: `[<org>/]<id>` with a non-hex ID, the same shape as `releaseParameter` (#1564: org-scoped ID) - [ ] `org view`, `trial list`, `trial start`: a bare org positional (#1564: org positional) - [ ] `init`, `project create`: a target followed by other positionals (#1564) - [ ] `dashboard create`, `dashboard list/restore/revisions/view`, `dashboard widget add/delete/edit`: covered by #1730. These entries will fail the ratchet once #1730 lands, and whichever PR merges second removes them. **Not target parsing, and not covered by these rules** - `monitor run`: `args[0]` is a monitor slug followed by a passthrough command. This is arity handling, not target parsing. - Paths, endpoints, versions, selectors and doc parts: `api`, `auth login/switch`, `build/debug-files/snapshots upload`, `debug-files find` (debug IDs), `docs *`, `help`, `local *`, `schema`, `cli upgrade`, `org list`, `react-native xcode`, `wasm-split`. ## Checks `pnpm run tsc` and `pnpm run lint` pass, and the lint-rule tests pass (70/70). The new conventions test and the release and issue tests pass. The only full-suite failures locally are sandbox noise: tests that need to run without root, e2e and init-eval tests that need a build or keys, and timing-sensitive tests.  via **BYK**.    -- [View Junior Session in Sentry](https://sentry.sentry.io/explore/conversations/agent%3Af950a2e3aa4d0471d8b1b07a64bfa60d/?project=4510944073809921)  Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: BYK <burak.kaya@sentry.io>

…mar (#1730) Part of #1564. Dashboard commands parsed their positionals by hand inside `func`, and issue commands used their own grammar (#1729). This moves both onto the shared ID grammar (`grammar/id-arguments.pegjs`, #1714), parsed before `func` runs. Event view's issue checks (#1733, #1738) use the new issue kind too. **Shared grammar: kinds with names.** `IdKind.names` adds one idea to `id-arguments.pegjs`: a kind may name an item without its ID, and anything that is not, and may not be, an ID is a name. Kinds without names keep their grammar paths exactly as before. Kinds with names keep each line whole (no splitting at spaces), so `Top 10` stays one title and never becomes title `Top` + ID `10`. - `ID_KINDS.dashboard`: a numeric ID or a title, which may hold spaces and slashes (`Latency/p95`). `<org>/[<project>/]<digits>` reads as a path only when slugs come before the digits, so `Errors.v2/123` and `/123` are titles. After a target, the title takes the rest of the arguments (`my-org/ My Dashboard`). A bare first word names an org (`orgScoped`). - `ID_KINDS.issue`: an identifier (numeric ID, short ID, selector, issue URL) is one whole token (`wholeIds`). `src/lib/issue-identifier.ts` takes it apart with the #1729 grammar, which is unchanged. Text with spaces is a name, meaning a search. - `dashboard-arguments.pegjs` is gone. `dashboard list` keeps its thin `parseDashboardListArgs`, because a bare word there is a title filter (see #1711). **Bare first word: org or title?** For `dashboard view My Dashboard`, the parser makes no decision. It returns the structural reading (org `My`, title `Dashboard`) and the whole input as one title (`nameWithTarget`, surfaced as `orgOrTitle`). `resolveDashboardInput` decides after auth: - First it checks whether `My` is an org: the cached org list and region cache, then `GET /organizations/My/` only on a cache miss. - If the org exists, the title lookup in that org is final, even when it misses. - On a 404 or 403 it warns ``No org 'My'; treating "My Dashboard" as the dashboard title. Use my-org/ to name an org.`` and looks up "My Dashboard" in the auto-detected org. - If that misses too, one error names both readings (no org `My` to find `Dashboard` in, and no `My Dashboard` in `<detected-org>`) and hints at `<org>/ Dashboard` and at quoting. - A 5xx or network error from the org check propagates, with no fallback. - It never falls back for `my-org/ …` (explicit org), a numeric ref, or a URL. **Issue search text.** `issue view "login timeout"` resolves through `GET /organizations/{org}/issues/?query=…` in the detected org. One hit is the issue. Zero or several hits raise a `ResolutionError` that lists up to 5 candidates as runnable commands and points at `sentry issue list <org>/ --query '…'`. I checked the endpoint against getsentry/sentry (`organization_group_index.py`, `group_index/index.py`): `query` takes free text, an exact event ID or short ID gets a fast lookup, and an explicit query replaces the default `is:unresolved`. **Search hints.** Text where a trace, span, log, or replay ID belongs (`trace view login`) now fails with ``Not a trace ID: "login". To search, try `sentry trace list --query 'login'`.``. The hint comes from `validate()`, so commands that recover malformed IDs (`trace view`, `span view`, `log view`) recover first and use the hint only as their final error. Event IDs get no hint, because `event list` lists one issue's events. **event view.** `ID_KINDS.issue.distinctForm` (uppercase short ID or numeric) replaces `looksLikeIssueShortId` + `isAllDigits` and keeps #1738's order: `<org>/<short-id>`, then `<short-id>/<event-id>` (even an all-digit event ID), then `<org>/<numeric-id>`. I added a regression test for the all-digit event ID and one for that order. **Behavior changes:** - `dashboard view my-org My Dashboard` (unquoted title) looks up "My Dashboard". Before, it used `My` and dropped `Dashboard`. The same goes for `my-org/ My Dashboard` and `https://acme.sentry.io/ My Dashboard`. - `dashboard view My Dashboard`: when there is no org `My` (404/403), it falls back to the title "My Dashboard" in the detected org, with the warning above. If neither reading finds a dashboard, one error names both. Dashboard commands with one dashboard ref get this (`view`, `restore`, `revisions`, `widget edit/delete`, and `widget add` after it splits off its widget title). - A numeric ref first is the dashboard, as with every ID kind: `dashboard view 42 X`, `my-org/42 X`. Before, the first of two arguments was always the target. After a target, a numeric ID keeps the rest as extra (`my-org 123 extra` → ID 123, ignored `extra`) instead of joining them into a title. Arguments after the ID go through the shared rules: extra, reversed (`42 my-org/`), or the shared "reference different projects" error when they name another target. - A lone non-Sentry URL is no longer taken as a dashboard title. - `issue view "login timeout"` (text with spaces) searches instead of failing as a malformed identifier. Control characters and URLs are still rejected. - Trace/span/log/replay IDs that are plain text get a search hint instead of "Invalid trace ID". - Parse errors (no dashboard, an org URL without a dashboard, a dashboard URL passed to `list`, an invalid target slug) fail before the auth guard, as in the earlier commits on this branch. They print `Failed to parse "…" for <placeholder>: …` and exit 252. - `widget add/edit/delete`: an argument error comes before flag errors like "Specify --index or --title". `widget add`'s positional completes cached dashboards. `parseDashboardTarget` had no callers left and is removed. **Lint ratchet (#1739):** the dashboard entries are off both allow-lists, since these commands now parse before `func`. The issue entries (`issue/utils.ts`, `issue/merge.ts`, which need an array issue positional) stay. **Syncing:** this branch merges `main` (no rebase). 54ebfa2 and 7f52f19 merge #1729, #1732–#1734, #1736, #1738 and #1739. Verification: - `tsc`, `pnpm run lint` (oxlint, format, ast-grep) and `scripts/cli-lint-rules.test.mjs` (70/70) pass. - vitest on `test/lib`, `test/grammar` and the dashboard, issue, event, trace, span, log, replay and feedback command tests: 10,158 passed. The 6 failures are the sandbox-only permission tests (completions EACCES/EPERM, code-scanner, file-changes, telemetry readonly, upgrade lock), which also fail on `main`. The full CLI suite shows the same 6, plus e2e/eval files that need a build or credentials. - New tests: - The bare-org fallback: the org from cache and from the API (no fallback), org missing then fallback hit with the warning, a 403, org missing then fallback miss with the combined error, a 5xx (propagates, no fallback), `my-org/ My Dashboard`, and a numeric ref. - Issue search with 0, 1 and several hits. - Search hints, including `validate: false` deferral. - #1738's event view order. - Differential runs against this PR's previous parsers: - Issue arguments: 8,575 cases. 1,388 former errors are now searches (text with spaces), with 0 other differences. - Dashboard view: 32,552 cases over 0–3 arguments. Every difference is in one of the categories above: a numeric ID first (2,600), arguments after a dashboard URL that name another target (688), a numeric ID after a target with more words (475), and a lone non-Sentry URL (1).  via **BYK**.    -- [View Junior Session in Sentry](https://sentry.sentry.io/explore/conversations/agent%3A5a5e7e4543124325a44d731c08dd6089/?project=4510944073809921)  --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: BYK <burak.kaya@sentry.io>

github-actions Bot added the risk: medium PR risk score: medium label Oct 29, 2026

test(cli): Expect event view to be linted for ad-hoc ID parsing

d85b68d

Co-Authored-By: BYK <burak.kaya@sentry.io>

cursor Bot reviewed Oct 29, 2026

View reviewed changes

Comment thread packages/cli/src/commands/event/view.ts Resolved

Comment thread packages/cli/src/commands/event/view.ts Resolved

vercel Bot deployed to Preview October 29, 2026 19:47

View deployment

BYK approved these changes Oct 29, 2026

View reviewed changes

BYK enabled auto-merge (squash) October 29, 2026 19:47

vercel Bot temporarily deployed to Preview October 29, 2026 20:02 Inactive

cursor Bot reviewed Oct 29, 2026

View reviewed changes

Comment thread packages/cli/src/commands/event/view.ts Resolved

BYK merged commit 8c6d0de into main Oct 29, 2026
31 checks passed

BYK deleted the byk/cli-event-view-id-arguments branch October 29, 2026 20:15

This was referenced Oct 29, 2026

fix(cli): Keep all-digit event IDs after <short-id>/ as events #1738

Merged

ref(cli): Ratchet hand-parsed positionals and test argument conventions #1739

Merged

sentry-junior Bot mentioned this pull request Oct 29, 2026

ref(cli): Parse dashboard and issue arguments with the shared ID grammar #1730

Merged

sentry-junior Bot mentioned this pull request Oct 30, 2026

Consolidate target parsing into positional parsers #1564

Closed

Navigation Menu

Repository navigation

ref(cli): Parse event view arguments with the shared ID grammar - #1733

ref(cli): Parse event view arguments with the shared ID grammar#1733
BYK merged 3 commits into
mainfrom
byk/cli-event-view-id-arguments

sentry-junior Bot commented Oct 29, 2026

Uh oh!

vercel Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

sentry-junior Bot commented Oct 29, 2026

Uh oh!

vercel Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Oct 29, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading