`sentry auth login` refuses to authenticate against an unconfirmed
self-hosted host unless `--url` is passed, but the auto-login middleware
(triggered when any command hits an auth error in a TTY) called the OAuth
device flow with no such gate. So `sentry auth whoami` — and any other
command — could start an unconfirmed self-hosted login that `auth login`
would have refused (#1121).

Since a `.sentryclirc` shim can inject `env.SENTRY_URL`, the bypass also
reopened the OAuth-phishing vector the `auth login` gate was added to close.

Extract the shared trust logic into `login-host-guard.ts` and call it from
both paths. Auto-login is deliberately a touch more lenient than the
explicit gate: it also trusts the stored token's host, so an expired
self-hosted session can re-auth without forcing `--url` again — but an
injected host that differs from the stored host is still refused.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Address review: the stored token's host can't anchor expired-session
re-auth because both expired paths call clearAuth() before the AuthError
reaches the middleware (db/auth.ts refreshToken), so getStoredAuthHost()
is always undefined by the time the guard runs — self-hosted re-auth was
wrongly refused.

Use defaults.url instead: it survives clearAuth() and is only written by
explicit, confirmed user actions (auth login --url, cli defaults url,
confirmed cli import), never by the .sentryclirc env shim. So expired
re-auth against a previously confirmed host proceeds, while an injected
host that doesn't match is still refused.

Also tidy up: move shouldAutoAuth above its JSDoc so the doc attaches to
autoAuthMiddleware, and drop a filler test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Move the auto-login recovery flow out of the cli.ts middleware closure into
a dependency-injected module (lib/auto-auth.ts) so the host-trust gate and
login/retry behavior are unit-testable — cli.ts itself has no test coverage,
which left the #1121 fix's patch coverage at 37.5%. The new module is
covered 100%.

Also close a second instance of the same bypass flagged in review:
scopeRecoveryMiddleware (added by #1032) runs the OAuth device flow on a 403
missing-scope error without the host-trust gate, so a .sentryclirc-injected
SENTRY_URL could steer re-auth to an attacker host. Both interactive re-auth
paths now call the shared assertAutoLoginHostTrusted().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Address review: isAutoLoginHostTrusted only consulted SaaS, the process
anchor, and defaults.url. On a 403 scope-recovery the OAuth token row is
still present (clearAuth has not run), and a self-hosted user whose effective
host matches their token host but who has no persisted default URL — e.g.
defaults.url persistence failed (it's best-effort) or was cleared — was
wrongly refused.

Also trust the stored token host, which setAuthToken always records. It's the
authoritative anchor when a token exists (scope recovery), complementing
defaults.url which covers the expired path where the token row is already
wiped. isHostTrusted requires an exact host match, so an injected
env.SENTRY_URL pointing elsewhere is still refused.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>