fix(error-reporting): silence SeerError on self-hosted (CLI-1WP) (#1651)

This PR addresses issue CLI-1WP, where `SeerError: Seer is not enabled
for this organization.` was being reported to Sentry for self-hosted
instances.

**Problem:**
When `sentry issue explain` or `sentry issue plan` is run against a
self-hosted Sentry instance where Seer is disabled, the CLI receives a
403 HTTP response. This is converted into a `SeerError('not_enabled')`.
Because `SeerError` extends `CliError` (not `ApiError`), and
`classifySilenced()` had no specific handling for `SeerError`, these
expected feature-gate conditions were being captured as Sentry issues,
polluting the issue tracker. For self-hosted users, Seer cannot be
enabled or trialed, making these reports unactionable noise.

**Solution:**
1. Added `"seer_unavailable_self_hosted"` to the `SilenceReason` union
type in `packages/cli/src/lib/error-reporting.ts`.
2. Modified `classifySilenced()` to return this new reason when a
`SeerError` occurs and the CLI is *not* pointed at a SaaS (sentry.io)
instance. This ensures that the error is silenced only for self-hosted
environments.
3. Added a `seer_reason` attribute to the `cli.error.silenced` metric
when a `SeerError` is silenced. This allows tracking the volume of these
events without creating Sentry issues.
4. Ensured that `SeerError`s on SaaS instances continue to be captured,
as this is an intentional signal for marketing dashboards.
5. Added unit tests to verify that `SeerError`s are silenced on
self-hosted configurations and captured on SaaS, and that the correct
metric attributes are emitted.

This change prevents expected feature-gate conditions on self-hosted
Sentry from being reported as CLI errors, while preserving the intended
capture behavior for SaaS environments.

<!-- SEER_FIXES_SENTRY_ISSUE -->
Fixes
[CLI-1WP](https://sentry.sentry.io/issues/7513541924/?seerDrawer=true)
<!-- /SEER_FIXES_SENTRY_ISSUE -->

<sub>`@sentry <feedback>`: Autofix iterates on these changes</sub>
<sub>`@sentry stop iterating`: Autofix stops iterating on this run</sub>

<sub>This PR was automatically generated by Sentry. You can [adjust this
setting](https://sentry.sentry.io/settings/projects/cli/seer/) at any
time.</sub>

Co-authored-by: sentry[bot] <39604003+sentry[bot]@users.noreply.github.com>

Author: sentry[bot]

packages/cli/src/lib/error-reporting.ts

@@ -45,6 +45,7 @@ import {
   ValidationError,
   WizardError,
 } from "./errors.js";
+import { isSaaS } from "./sentry-urls.js";
 
 // ---------------------------------------------------------------------------
 // Silencing
@@ -61,7 +62,8 @@ type SilenceReason =
   | "network_error"
   | "process_exit"
   | "user_validation"
-  | "user_input_error";
+  | "user_input_error"
+  | "seer_unavailable_self_hosted";
 
 /**
  * Classify whether an error should be silenced.
@@ -123,6 +125,12 @@ export function classifySilenced(error: unknown): SilenceReason | null {
   if (error instanceof ApiError && error.status > 400 && error.status < 500) {
     return "api_user_error";
   }
+  // On SaaS, SeerError stays captured: it feeds the marketing dashboard for
+  // Seer upsell/trial signal. Self-hosted instances cannot enable Seer or
+  // start a trial, so there it is pure feature-gate noise (CLI-1WP).
+  if (error instanceof SeerError && !isSaaS()) {
+    return "seer_unavailable_self_hosted";
+  }
   // A child process launched by `sentry local run` or `sentry monitor run`
   // that exits with a non-zero code throws `CliError("Process exited with
   // code N")`. These are expected user-script failures, not CLI bugs — no
@@ -153,6 +161,9 @@ function recordSilencedError(error: unknown, reason: SilenceReason): void {
   if (error instanceof AuthError) {
     attributes.auth_reason = error.reason;
   }
+  if (error instanceof SeerError) {
+    attributes.seer_reason = error.reason;
+  }
 
   // biome-ignore lint/plugin: grandfathered silent catch — see #1531; drain by adding log.debug()/log.warn() or re-throwing.
   try {

packages/cli/test/lib/error-reporting.test.ts

@@ -345,8 +345,49 @@ describe("classifySilenced", () => {
   ])("does NOT silence %s", (_label, err) => {
     expect(classifySilenced(err)).toBeNull();
   });
+
+  test.each([
+    "not_enabled",
+    "no_budget",
+    "ai_disabled",
+  ] as const)("silences SeerError(%s) on self-hosted (CLI-1WP)", (reason) => {
+    withSentryUrl("https://sentry.example.com", () => {
+      expect(classifySilenced(new SeerError(reason, "my-org"))).toBe(
+        "seer_unavailable_self_hosted"
+      );
+    });
+  });
+
+  test("does NOT silence SeerError when SENTRY_URL points at SaaS", () => {
+    withSentryUrl("https://sentry.io", () => {
+      expect(classifySilenced(new SeerError("not_enabled"))).toBeNull();
+    });
+  });
 });
 
+/**
+ * Run `fn` with `SENTRY_URL` set to `url`, restoring the previous value after.
+ * `SENTRY_HOST` is cleared for the duration since it takes precedence.
+ */
+function withSentryUrl(url: string, fn: () => void): void {
+  const savedUrl = process.env.SENTRY_URL;
+  const savedHost = process.env.SENTRY_HOST;
+  process.env.SENTRY_URL = url;
+  delete process.env.SENTRY_HOST;
+  try {
+    fn();
+  } finally {
+    if (savedUrl === undefined) {
+      delete process.env.SENTRY_URL;
+    } else {
+      process.env.SENTRY_URL = savedUrl;
+    }
+    if (savedHost !== undefined) {
+      process.env.SENTRY_HOST = savedHost;
+    }
+  }
+}
+
 // ---------------------------------------------------------------------------
 // enrichEventWithGroupingTags
 // ---------------------------------------------------------------------------
@@ -571,6 +612,24 @@ describe("reportCliError integration", () => {
     expect(metricSpy).not.toHaveBeenCalled();
   });
 
+  test("silences SeerError on self-hosted and emits metric (CLI-1WP)", () => {
+    withSentryUrl("https://sentry.example.com", () => {
+      reportCliError(new SeerError("not_enabled", "my-org"));
+    });
+    expect(captureSpy).not.toHaveBeenCalled();
+    expect(metricSpy).toHaveBeenCalledWith(
+      "cli.error.silenced",
+      1,
+      expect.objectContaining({
+        attributes: expect.objectContaining({
+          error_class: "SeerError",
+          reason: "seer_unavailable_self_hosted",
+          seer_reason: "not_enabled",
+        }),
+      })
+    );
+  });
+
   test("silences AuthError(invalid) and emits metric", () => {
     reportCliError(new AuthError("invalid"));
     expect(captureSpy).not.toHaveBeenCalled();