feat(cli): Pick the stored account from the target org or server

[sentry-junior]

Stacked on #1526. Covers the automatic-selection half of #1396: with several stored accounts, commands use the account that fits what they target, so users don't have to sentry auth switch back and forth.

How the account is chosen (per invocation, most specific first)

1. Organization. If the target org isn't in the active account's cached org list, but another stored account has used that org, that account is pinned for the rest of the invocation. This hooks into resolveOrgRegion / resolveEffectiveOrg, so it covers the ~55 org-scoped call sites and DSN oNNNN ids.
2. Server. An explicit SENTRY_HOST/SENTRY_URL, .sentryclirc, or a pasted Sentry URL for another account's server selects the stored account on that server. Previously this was a HostScopeError.
3. Active account otherwise.

Guardrails

• The stored active account never changes. The selection lives in memory, keyed by the invocation's env object, so library-mode calls are isolated from each other.
• One invocation never mixes identities: the first pin wins.
• An account is only chosen for hosts its token is already trusted for, using the same SaaS-equivalence rule as token-host.ts.
• If the active account has no cached org list (for example right after auth switch), it is kept. An account that simply hasn't used the org yet can't be overridden by one that has.
• An explicit server limits candidates to accounts on that server. The persisted defaults.url counts as soft: when the pinned account is elsewhere, it yields to that account's host.
• SENTRY_FORCE_ENV_TOKEN is never overridden.

Storage
Schema v19 adds org_regions.account_id. Writes record the account whose credentials fetched the row, following in-process refresh-token rotation. The migration backfills existing rows by matching credential identity. The org→account mapping is warm right away for new logins, because login already warms the org cache.

Memoized credential state (token, fingerprint, row, stored-creds flag) is now keyed by selection, and user info reads and writes go to the account in effect. Account management (switch, logout, list) still works on the stored active account.

Not covered

• An org that no stored account has used yet still goes to the active account. There is no retry-on-403 across accounts.
• When several non-active accounts know the same org, the most recently used one wins, with no prompt.

via byk.

--

View Junior Session [Sentry]

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
sentry-local	Skipped		Oct 19, 2026 4:21pm UTC

[cursor]

Stale Bugbot comment from a previous run.

[BYK]

I wonder if we should modify commands like "org list" to list all available organizations under all accounts. Wdyt?

[BYK]

Looks like we can DRY this code up a bit. Also there are 2 important warden warnings we should address.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3600df9. Configure here.}

[BYK]

🚀 Let's go