fix(resolve): skip org/project discovery when the DSN already identifies the target (#1476)

Closes #1147

## Problem

When the CLI runs via an AI agent (MCP/skill), it redundantly discovered
org and project identity even though a DSN was already present, causing
unnecessary API calls and occasional re-auth.

## Root cause

A SaaS DSN (`oXXX.ingest…` host) encodes both the numeric org ID and
project ID, so it already identifies the target. But on a
`project_cache` miss, `resolveFromDsn` and `resolveDsnToTarget` still
fired a `getProject(orgId, projectId)` discovery call — routed through
the auth/SDK-config path — purely to translate the numeric IDs into
slugs/display names. That call recurs on every cold-cache invocation
(common in ephemeral agent environments), which is the redundant API
traffic and re-auth the issue reports.

## Fix

`resolveFromDsn` and `resolveDsnToTarget` (both in
`packages/cli/src/lib/resolve-target.ts`) now resolve without any
discovery API call for DSNs that carry an org ID:

1. use resolution the DSN detection layer already surfaced
(`dsn.resolved`), else
2. use locally cached slugs (`project_cache`), else
3. build the target from the DSN's numeric IDs via a new
`dsnTargetFromNumericIds` helper — the Sentry API accepts numeric IDs as
`{org,project}_id_or_slug`, and the org slug is enriched from the local
regions cache (`getOrgByNumericId`, no network) when available.

Public-key-only DSNs (self-hosted / no org ID) are unchanged — the DSN
does not encode identity there, so they still resolve via
`findProjectByDsnKey`.

## Tests

`packages/cli/test/lib/resolve-target.mocked.test.ts`:
- replaced the two obsolete cache-miss tests with regression tests
asserting `getProject` is **not** called when the DSN encodes identity
(detector-`resolved` path, numeric-ID fallback, and regions-cache slug
enrichment)
- added a `resolveAllTargets` test asserting orgId DSNs resolve with no
discovery call
- reworked the "resolution fails" test to use a public-key DSN, the only
path that can still fail

Verified locally: `tsc --noEmit` clean; all 50 `resolve-target.mocked`
tests pass.

<!-- jared:ci-checks=12 -->

Co-authored-by: jared-outpost[bot] <jared-outpost[bot]@users.noreply.github.com>

Author: jared-outpost[bot]

src/lib/resolve-target.ts

@@ -182,7 +182,10 @@ export type ResolveOrgOptions = {
 
 /**
  * Resolve organization and project from DSN detection.
- * Uses cached project info when available, otherwise fetches and caches it.
+ *
+ * A SaaS DSN already encodes org+project identity, so this never makes a
+ * discovery API call: it returns cached slugs when available and otherwise
+ * builds the target from the DSN's numeric IDs (valid API identifiers).
  *
  * @param cwd - Current working directory to search for DSN
  * @returns Resolved target with org/project info, or null if DSN not found
@@ -197,7 +200,19 @@ export async function resolveFromDsn(
 
   const detectedFrom = getDsnSourceDescription(dsn);
 
-  // Check cache first
+  // Resolution the DSN detection layer already surfaced (dsn_cache) — no lookup.
+  if (dsn.resolved) {
+    return {
+      org: dsn.resolved.orgSlug,
+      project: dsn.resolved.projectSlug,
+      projectId: toNumericId(dsn.projectId),
+      orgDisplay: dsn.resolved.orgName,
+      projectDisplay: dsn.resolved.projectName,
+      detectedFrom,
+    };
+  }
+
+  // Locally cached slugs — no lookup.
   const cached = getCachedProject(dsn.orgId, dsn.projectId);
   if (cached) {
     return {
@@ -210,40 +225,33 @@ export async function resolveFromDsn(
     };
   }
 
-  // Cache miss — fetch project details and cache them
-  const projectInfo = await getProject(dsn.orgId, dsn.projectId);
-
-  if (projectInfo.organization) {
-    const orgName = resolveOrgDisplayName(
-      projectInfo.organization.slug,
-      projectInfo.organization.name
-    );
-    setCachedProject(dsn.orgId, dsn.projectId, {
-      orgSlug: projectInfo.organization.slug,
-      orgName,
-      projectSlug: projectInfo.slug,
-      projectName: projectInfo.name,
-      projectId: projectInfo.id,
-    });
-
-    return {
-      org: projectInfo.organization.slug,
-      project: projectInfo.slug,
-      projectId: toNumericId(projectInfo.id),
-      orgDisplay: orgName,
-      projectDisplay: projectInfo.name,
-      detectedFrom,
-    };
-  }
+  // The DSN already encodes org+project identity, so skip the getProject
+  // discovery call (and its auth round-trip). Enrich the org slug from the
+  // local regions cache when available, otherwise fall back to the numeric IDs
+  // — the API accepts both as {org,project}_id_or_slug path params.
+  return dsnTargetFromNumericIds(dsn.orgId, dsn.projectId, detectedFrom);
+}
 
-  // Fallback to numeric IDs if org info missing (rare edge case)
+/**
+ * Build a {@link ResolvedTarget} straight from a DSN's numeric org/project IDs
+ * without any API discovery. The org slug is resolved from the local regions
+ * cache when present; both IDs are otherwise valid API identifiers.
+ */
+function dsnTargetFromNumericIds(
+  orgId: string,
+  projectId: string,
+  detectedFrom: string,
+  packagePath?: string
+): ResolvedTarget {
+  const org = getOrgByNumericId(orgId)?.slug ?? orgId;
   return {
-    org: dsn.orgId,
-    project: dsn.projectId,
-    projectId: toNumericId(projectInfo.id),
-    orgDisplay: dsn.orgId,
-    projectDisplay: projectInfo.name,
+    org,
+    project: projectId,
+    projectId: toNumericId(projectId),
+    orgDisplay: org,
+    projectDisplay: projectId,
     detectedFrom,
+    packagePath,
   };
 }
 
@@ -389,10 +397,11 @@ export async function resolveDsnByPublicKey(
 
 /**
  * Resolve a single detected DSN to a ResolvedTarget.
- * Uses cache when available, otherwise fetches from API.
  *
  * Supports two resolution paths:
- * 1. DSNs with orgId: Use getProject(orgId, projectId) API
+ * 1. DSNs with orgId: the DSN already encodes org+project identity, so no
+ *    discovery API call is made — cached slugs are used when available,
+ *    otherwise the target is built from the DSN's numeric IDs.
  * 2. DSNs without orgId: Use findProjectByDsnKey(publicKey) API
  *
  * @param dsn - Detected DSN to resolve
@@ -404,15 +413,27 @@ async function resolveDsnToTarget(
   // For DSNs without orgId (self-hosted or some SaaS patterns),
   // resolve by searching for the project via DSN public key
   if (!dsn.orgId) {
-    return resolveDsnByPublicKey(dsn);
+    return await resolveDsnByPublicKey(dsn);
   }
 
-  // Capture narrowed values before the closure (TS loses narrowing across closures)
   const orgId = dsn.orgId;
   const { projectId: dsnProjectId, packagePath } = dsn;
   const detectedFrom = getDsnSourceDescription(dsn);
 
-  // Check cache first
+  // Resolution the DSN detection layer already surfaced (dsn_cache) — no lookup.
+  if (dsn.resolved) {
+    return {
+      org: dsn.resolved.orgSlug,
+      project: dsn.resolved.projectSlug,
+      projectId: toNumericId(dsnProjectId),
+      orgDisplay: dsn.resolved.orgName,
+      projectDisplay: dsn.resolved.projectName,
+      detectedFrom,
+      packagePath,
+    };
+  }
+
+  // Locally cached slugs — no lookup.
   const cached = getCachedProject(orgId, dsnProjectId);
   if (cached) {
     return {
@@ -426,46 +447,14 @@ async function resolveDsnToTarget(
     };
   }
 
-  // Cache miss — fetch project details and cache them
-  const result = await withAuthGuard(async () => {
-    const projectInfo = await getProject(orgId, dsnProjectId);
-
-    if (projectInfo.organization) {
-      const orgName = resolveOrgDisplayName(
-        projectInfo.organization.slug,
-        projectInfo.organization.name
-      );
-      setCachedProject(orgId, dsnProjectId, {
-        orgSlug: projectInfo.organization.slug,
-        orgName,
-        projectSlug: projectInfo.slug,
-        projectName: projectInfo.name,
-        projectId: projectInfo.id,
-      });
-
-      return {
-        org: projectInfo.organization.slug,
-        project: projectInfo.slug,
-        projectId: toNumericId(projectInfo.id),
-        orgDisplay: orgName,
-        projectDisplay: projectInfo.name,
-        detectedFrom,
-        packagePath,
-      };
-    }
-
-    // Fallback to numeric IDs if org info missing
-    return {
-      org: orgId,
-      project: dsnProjectId,
-      projectId: toNumericId(projectInfo.id),
-      orgDisplay: orgId,
-      projectDisplay: projectInfo.name,
-      detectedFrom,
-      packagePath,
-    };
-  });
-  return result.ok ? result.value : null;
+  // The DSN already encodes org+project identity, so skip the getProject
+  // discovery call (and its auth round-trip) and build the target directly.
+  return dsnTargetFromNumericIds(
+    orgId,
+    dsnProjectId,
+    detectedFrom,
+    packagePath
+  );
 }
 
 /** Minimum directory name length for inference (avoids matching too broadly) */

test/lib/resolve-target.mocked.test.ts

@@ -475,7 +475,7 @@ describe("resolveFromDsn", () => {
     expect(mockGetCachedProject).toHaveBeenCalledWith("123", "456");
   });
 
-  test("fetches and caches project info on cache miss", async () => {
+  test("uses resolution surfaced by the detector without any API call", async () => {
     mockDetectDsn.mockResolvedValue({
       raw: "https://abc@o123.ingest.sentry.io/456",
       protocol: "https",
@@ -484,31 +484,26 @@ describe("resolveFromDsn", () => {
       projectId: "456",
       orgId: "123",
       source: "env",
-      sourcePath: "/test/.env",
-    });
-    mockGetCachedProject.mockReturnValue(null);
-    mockGetProject.mockResolvedValue({
-      id: "456",
-      slug: "fetched-project",
-      name: "Fetched Project",
-      organization: {
-        id: "123",
-        slug: "fetched-org",
-        name: "Fetched Organization",
+      resolved: {
+        orgSlug: "detected-org",
+        orgName: "Detected Organization",
+        projectSlug: "detected-project",
+        projectName: "Detected Project",
       },
     });
 
     const result = await resolveFromDsn("/test");
 
-    expect(result).not.toBeNull();
-    expect(result?.org).toBe("fetched-org");
-    expect(result?.project).toBe("fetched-project");
-    expect(result?.orgDisplay).toBe("Fetched Organization");
-    expect(result?.projectDisplay).toBe("Fetched Project");
-    expect(mockSetCachedProject).toHaveBeenCalled();
+    expect(result?.org).toBe("detected-org");
+    expect(result?.project).toBe("detected-project");
+    expect(result?.orgDisplay).toBe("Detected Organization");
+    expect(result?.projectDisplay).toBe("Detected Project");
+    // DSN already encodes identity — no discovery call and no cache lookup.
+    expect(mockGetProject).not.toHaveBeenCalled();
+    expect(mockGetCachedProject).not.toHaveBeenCalled();
   });
 
-  test("falls back to numeric IDs when project has no org info", async () => {
+  test("skips org/project discovery on cache miss when DSN encodes identity", async () => {
     mockDetectDsn.mockResolvedValue({
       raw: "https://abc@o123.ingest.sentry.io/456",
       protocol: "https",
@@ -517,22 +512,43 @@ describe("resolveFromDsn", () => {
       projectId: "456",
       orgId: "123",
       source: "env",
+      sourcePath: "/test/.env",
     });
     mockGetCachedProject.mockReturnValue(null);
-    mockGetProject.mockResolvedValue({
-      id: "456",
-      slug: "project",
-      name: "Project Name",
-      // No organization field
-    });
 
     const result = await resolveFromDsn("/test");
 
-    // Falls back to using numeric IDs (both org and project)
-    expect(result).not.toBeNull();
+    // No getProject discovery call — the numeric IDs from the DSN are used
+    // directly (the API accepts them as org/project identifiers).
+    expect(mockGetProject).not.toHaveBeenCalled();
     expect(result?.org).toBe("123");
-    expect(result?.project).toBe("456"); // Uses dsn.projectId, not projectInfo.slug
-    expect(result?.projectDisplay).toBe("Project Name");
+    expect(result?.project).toBe("456");
+    expect(result?.projectId).toBe(456);
+  });
+
+  test("enriches org slug from the local regions cache without an API call", async () => {
+    mockDetectDsn.mockResolvedValue({
+      raw: "https://abc@o1169445.ingest.us.sentry.io/456",
+      protocol: "https",
+      publicKey: "abc",
+      host: "o1169445.ingest.us.sentry.io",
+      projectId: "456",
+      orgId: "1169445",
+      source: "env",
+    });
+    mockGetCachedProject.mockReturnValue(null);
+    mockGetOrgByNumericId.mockReturnValue({
+      slug: "my-org",
+      regionUrl: "https://us.sentry.io",
+    });
+
+    const result = await resolveFromDsn("/test");
+
+    expect(result?.org).toBe("my-org");
+    expect(result?.orgDisplay).toBe("my-org");
+    expect(result?.project).toBe("456");
+    expect(mockGetProject).not.toHaveBeenCalled();
+    expect(mockGetOrgByNumericId).toHaveBeenCalledWith("1169445");
   });
 });
 
@@ -840,7 +856,47 @@ describe("resolveAllTargets", () => {
     expect(result.targets[0].project).toBe("my-app");
   });
 
-  test("returns empty targets when all DSN resolutions fail", async () => {
+  test("returns empty targets when a public-key DSN cannot be resolved", async () => {
+    mockGetDefaultOrganization.mockReturnValue(null);
+    mockGetDefaultProject.mockReturnValue(null);
+    // Self-hosted / public-key-only DSN (no orgId) — the DSN does not encode
+    // org identity, so a lookup is required and can fail.
+    mockDetectAllDsns.mockResolvedValue({
+      primary: {
+        raw: "https://abc@sentry.example.com/456",
+        protocol: "https",
+        publicKey: "abc",
+        host: "sentry.example.com",
+        projectId: "456",
+        source: "env",
+      },
+      all: [
+        {
+          raw: "https://abc@sentry.example.com/456",
+          protocol: "https",
+          publicKey: "abc",
+          host: "sentry.example.com",
+          projectId: "456",
+          source: "env",
+        },
+      ],
+      hasMultiple: false,
+      fingerprint: "",
+    });
+    mockGetCachedProjectByDsnKey.mockReturnValue(null);
+    // findProjectByDsnKey returns null (project not found)
+    mockFindProjectByDsnKey.mockResolvedValue(null);
+    mockFindProjectRoot.mockResolvedValue({
+      projectRoot: "/a",
+      detectedFrom: "package.json",
+    });
+
+    const result = await resolveAllTargets({ cwd: "/test" });
+
+    expect(result.targets).toHaveLength(0);
+  });
+
+  test("skips discovery for orgId DSNs and resolves from numeric IDs", async () => {
     mockGetDefaultOrganization.mockReturnValue(null);
     mockGetDefaultProject.mockReturnValue(null);
     mockDetectAllDsns.mockResolvedValue({
@@ -868,16 +924,14 @@ describe("resolveAllTargets", () => {
       fingerprint: "",
     });
     mockGetCachedProject.mockReturnValue(null);
-    // getProject returns null (project not found)
-    mockGetProject.mockResolvedValue(null);
-    mockFindProjectRoot.mockResolvedValue({
-      projectRoot: "/a",
-      detectedFrom: "package.json",
-    });
 
     const result = await resolveAllTargets({ cwd: "/test" });
 
-    expect(result.targets).toHaveLength(0);
+    expect(result.targets).toHaveLength(1);
+    expect(result.targets[0].org).toBe("123");
+    expect(result.targets[0].project).toBe("456");
+    // The DSN already identifies the target — no discovery API call.
+    expect(mockGetProject).not.toHaveBeenCalled();
   });
 });