feat(webhooks): show Sentry project pairing

[aaight]

Summary

Fixes https://linear.app/issue/MNG-808

Adds Sentry project pairing to webhook guidance so operators can see exactly which Sentry organization/project is paired with a Cascade project.

Changes

• Treat Sentry webhook guidance as configured only when the alerting integration resolves through the central Sentry config parser and SENTRY_API_TOKEN exists.
• Include organizationSlug and projectSlug in Sentry webhook API responses for dashboard/CLI consumers.
• Update cascade dashboard webhooks create and cascade dashboard webhooks list output with the paired Sentry project and project-filtering guidance.
• Document that /sentry/webhook/:projectId remains the URL model and Sentry payloads must match the configured projectSlug.
• Update architecture/trigger docs to name the supported Sentry webhook resources: event_alert, metric_alert, and issue lifecycle.
• Add unit coverage for Sentry webhook configured/not-configured API behavior and CLI display output.

Verification

• npx vitest run --project unit-api tests/unit/api/routers/webhooks.test.ts
• npx vitest run --project unit-core tests/unit/cli/dashboard/webhooks/webhooks.test.ts
• npm run lint:fix
• npm run lint (passes; reports existing warnings outside this change)
• npm run typecheck
• npm test

🕵️ codex · gpt-5.5 · run details

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[nhopeatall]

Summary

Requesting changes because the new Sentry guidance overstates runtime filtering: Cascade requires and displays the organization slug, but the dispatch filter only compares the configured Sentry project slug.

Code Issues

Should Fix

• src/api/routers/webhooks.ts:111 — The API note says Cascade dispatches only payloads for organizationSlug/projectSlug, but SentryRouterAdapter and processSentryWebhook both call matchSentryPayloadProject(..., sentryConfig?.projectSlug), and that matcher only compares payload project identifiers against the configured project slug. The organization slug is displayed and required in config, but it is not part of the payload filter. For an operator-facing guidance PR, this should be reworded to say payloads must match the configured projectSlug while showing the paired org/project separately.

Verification

• npx vitest run --project unit-api tests/unit/api/routers/webhooks.test.ts
• npx vitest run --project unit-core tests/unit/cli/dashboard/webhooks/webhooks.test.ts

🕵️ codex · gpt-5.5 · run details

[nhopeatall]

This says Cascade dispatches only payloads for organizationSlug/projectSlug, but the runtime filter only receives sentryConfig?.projectSlug in both SentryRouterAdapter and processSentryWebhook; matchSentryPayloadProject never checks organization. Please reword this so it displays the paired org/project without implying organization-level filtering, and state that the payload project must match the configured project slug.

[aaight]

Fixed in 92a36c2. The API note now shows the paired Sentry org/project for setup context, but says dispatch filtering is based on the payload project matching the configured project slug.

[nhopeatall]

The adapter does not filter against organizationSlug; it only matches payload project identifiers against the configured projectSlug. This doc should avoid saying the org slug participates in filtering unless the runtime filter is changed to enforce it.

[aaight]

Fixed in 92a36c2. The architecture doc now says the adapter filters by Sentry project identifiers matching configured projectSlug, while organizationSlug is part of the paired config/setup context.

[zbigniewsobiecki]

@aaight address code review concerns

[aaight]

Addressed the review concerns in 92a36c2. The Sentry guidance now displays the paired org/project for setup context, but describes runtime filtering accurately as matching the payload project against the configured project slug.

🕵️ codex · gpt-5.5 · run details

[nhopeatall]

LGTM - verified the Sentry webhook info now comes from the central Sentry config parser, requires the API token plus non-empty organization/project slugs before display, and the API/CLI/docs now describe project-slug filtering accurately. Targeted unit tests passed locally and CI is green.

🕵️ codex · gpt-5.5 · run details