From d6b780918082d0545143cb46213cb1b66b30d290 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 12:48:14 +0000
Subject: [PATCH 01/19] feat(dsn): add project root detection for automatic DSN
 discovery

Walk up from CWD to find project root before scanning for DSNs:
- Check .env files for SENTRY_DSN during walk-up (immediate return if found)
- Stop at VCS/CI markers (.git, .github, etc.) as definitive repo root
- Use language markers (package.json, pyproject.toml, etc.) as fallback
- Limit scan depth to 2 levels from project root for performance

This ensures DSN detection works regardless of which subdirectory
the user runs the CLI from within a project.
---
 src/lib/dsn/detector.ts           |  85 ++--
 src/lib/dsn/index.ts              |  14 +
 src/lib/dsn/languages/index.ts    | 101 ++++-
 src/lib/dsn/project-root.ts       | 675 ++++++++++++++++++++++++++++++
 test/lib/dsn/detector.test.ts     |  13 +-
 test/lib/dsn/project-root.test.ts | 342 +++++++++++++++
 6 files changed, 1181 insertions(+), 49 deletions(-)
 create mode 100644 src/lib/dsn/project-root.ts
 create mode 100644 test/lib/dsn/project-root.test.ts

diff --git a/src/lib/dsn/detector.ts b/src/lib/dsn/detector.ts
index 9eab7a01..ae41defa 100644
--- a/src/lib/dsn/detector.ts
+++ b/src/lib/dsn/detector.ts
@@ -1,18 +1,18 @@
 /**
  * DSN Detector
  *
- * Detects Sentry DSN with GitHub CLI-style caching.
+ * Detects Sentry DSN with GitHub CLI-style caching and project root detection.
  *
- * Fast path (cache hit): ~5ms - verify single file
- * Slow path (cache miss): ~2-5s - full scan
+ * Detection algorithm:
+ * 1. Find project root by walking up from cwd (checks .env for DSN at each level)
+ * 2. If DSN found during walk-up, return immediately (fast path)
+ * 3. Check cache for project root
+ * 4. Full scan from project root with depth limiting
  *
- * Detection priority (explicit code DSN wins):
- * 1. Source code (explicit DSN in Sentry.init, etc.)
- * 2. .env files (.env.local, .env, etc.)
- * 3. SENTRY_DSN environment variable
+ * Priority: .env with SENTRY_DSN > code > .env files > SENTRY_DSN env var
  */
 
-import { join } from "node:path";
+import { join, relative } from "node:path";
 import { getCachedDsn, setCachedDsn } from "../db/dsn-cache.js";
 import { detectFromEnv, SENTRY_DSN_ENV } from "./env.js";
 import {
@@ -26,6 +26,7 @@ import {
   getDetectorForFile,
 } from "./languages/index.js";
 import { createDetectedDsn, parseDsn } from "./parser.js";
+import { findProjectRoot } from "./project-root.js";
 import type {
   CachedDsnEntry,
   DetectedDsn,
@@ -38,28 +39,49 @@ import type {
 // ─────────────────────────────────────────────────────────────────────────────
 
 /**
- * Detect DSN with caching support
+ * Detect DSN with project root detection and caching support.
  *
- * Fast path (cache hit): ~5ms
- * Slow path (cache miss): ~2-5s
+ * Algorithm:
+ * 1. Find project root by walking up from cwd (checking .env for SENTRY_DSN at each level)
+ * 2. If DSN found during walk-up, return immediately (fastest path)
+ * 3. Check cache for project root (fast path)
+ * 4. Full scan from project root with depth limiting (slow path)
  *
- * Priority: code > .env files > SENTRY_DSN env var
- *
- * @param cwd - Directory to search in
+ * @param cwd - Directory to start searching from
  * @returns Detected DSN with source info, or null if not found
  */
 export async function detectDsn(cwd: string): Promise<DetectedDsn | null> {
-  // 1. Check cache for this directory (fast path)
-  const cached = await getCachedDsn(cwd);
+  // 1. Find project root (may find DSN in .env along the way)
+  const { projectRoot, foundDsn } = await findProjectRoot(cwd);
+
+  // 2. If DSN found during walk-up, cache and return immediately
+  if (foundDsn) {
+    // Make source path relative to project root for caching
+    const sourcePath = foundDsn.sourcePath
+      ? relative(projectRoot, join(cwd, foundDsn.sourcePath)) ||
+        foundDsn.sourcePath
+      : foundDsn.sourcePath;
+
+    await setCachedDsn(projectRoot, {
+      dsn: foundDsn.raw,
+      projectId: foundDsn.projectId,
+      orgId: foundDsn.orgId,
+      source: foundDsn.source,
+      sourcePath,
+    });
+    return foundDsn;
+  }
+
+  // 3. Check cache for project root (fast path)
+  const cached = await getCachedDsn(projectRoot);
 
   if (cached) {
-    // 2. Verify cached source file still has same DSN
-    const verified = await verifyCachedDsn(cwd, cached);
+    const verified = await verifyCachedDsn(projectRoot, cached);
     if (verified) {
       // Check if DSN changed
       if (verified.raw !== cached.dsn) {
         // DSN changed - update cache
-        await setCachedDsn(cwd, {
+        await setCachedDsn(projectRoot, {
           dsn: verified.raw,
           projectId: verified.projectId,
           orgId: verified.orgId,
@@ -78,12 +100,12 @@ export async function detectDsn(cwd: string): Promise<DetectedDsn | null> {
     // Cache invalid, fall through to full scan
   }
 
-  // 3. Full scan (cache miss): code → .env → env var
-  const detected = await fullScanFirst(cwd);
+  // 4. Full scan from project root (slow path)
+  const detected = await fullScanFirst(projectRoot);
 
   if (detected) {
-    // 4. Cache for next time (without resolved info yet)
-    await setCachedDsn(cwd, {
+    // Cache for next time (without resolved info yet)
+    await setCachedDsn(projectRoot, {
       dsn: detected.raw,
       projectId: detected.projectId,
       orgId: detected.orgId,
@@ -99,6 +121,7 @@ export async function detectDsn(cwd: string): Promise<DetectedDsn | null> {
  * Detect all DSNs in a directory (supports monorepos)
  *
  * Unlike detectDsn, this finds ALL DSNs from all sources.
+ * First finds project root, then scans from there with depth limiting.
  * Useful for monorepos with multiple Sentry projects.
  *
  * Collection order matches priority: code > .env files > env var
@@ -107,6 +130,9 @@ export async function detectDsn(cwd: string): Promise<DetectedDsn | null> {
  * @returns Detection result with all found DSNs and hasMultiple flag
  */
 export async function detectAllDsns(cwd: string): Promise<DsnDetectionResult> {
+  // Find project root first
+  const { projectRoot, foundDsn } = await findProjectRoot(cwd);
+
   const allDsns: DetectedDsn[] = [];
   const seenRawDsns = new Set<string>();
 
@@ -118,14 +144,19 @@ export async function detectAllDsns(cwd: string): Promise<DsnDetectionResult> {
     }
   };
 
-  // 1. Check all code files (highest priority)
-  const codeDsns = await detectAllFromCode(cwd);
+  // If DSN was found during walk-up, add it first (highest priority)
+  if (foundDsn) {
+    addDsn(foundDsn);
+  }
+
+  // 1. Check all code files from project root
+  const codeDsns = await detectAllFromCode(projectRoot);
   for (const dsn of codeDsns) {
     addDsn(dsn);
   }
 
-  // 2. Check all .env files (includes monorepo packages/apps)
-  const envFileDsns = await detectFromAllEnvFiles(cwd);
+  // 2. Check all .env files from project root (includes monorepo packages/apps)
+  const envFileDsns = await detectFromAllEnvFiles(projectRoot);
   for (const dsn of envFileDsns) {
     addDsn(dsn);
   }
diff --git a/src/lib/dsn/index.ts b/src/lib/dsn/index.ts
index 1c8e81ae..d8f005c3 100644
--- a/src/lib/dsn/index.ts
+++ b/src/lib/dsn/index.ts
@@ -81,3 +81,17 @@ export {
   isValidDsn,
   parseDsn,
 } from "./parser.js";
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Project Root Detection
+// ─────────────────────────────────────────────────────────────────────────────
+
+export type { ProjectRootReason, ProjectRootResult } from "./project-root.js";
+export {
+  findProjectRoot,
+  getStopBoundary,
+  hasBuildSystemMarker,
+  hasLanguageMarker,
+  hasRepoRootMarker,
+  isProjectRoot,
+} from "./project-root.js";
diff --git a/src/lib/dsn/languages/index.ts b/src/lib/dsn/languages/index.ts
index 0230db80..e95d280b 100644
--- a/src/lib/dsn/languages/index.ts
+++ b/src/lib/dsn/languages/index.ts
@@ -4,6 +4,8 @@
  * Unified scanner for detecting DSN from source code across all supported languages.
  * Uses a registry of language detectors to scan files by extension.
  *
+ * Scans with depth limiting (default 2 levels) to avoid deep recursion.
+ *
  * ## Adding a New Language
  *
  * 1. Create `{lang}.ts` implementing `LanguageDetector`
@@ -23,6 +25,8 @@
  */
 
 import { extname, join } from "node:path";
+// biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
+import * as Sentry from "@sentry/bun";
 import { createDetectedDsn, inferPackagePath } from "../parser.js";
 import type { DetectedDsn } from "../types.js";
 import { goDetector } from "./go.js";
@@ -79,6 +83,14 @@ const allExtensions = languageDetectors.flatMap((d) => d.extensions);
 const globPattern = `**/*{${allExtensions.join(",")}}`;
 const codeGlob = new Bun.Glob(globPattern);
 
+/**
+ * Maximum depth to scan from project root.
+ * Depth 0 = files in root directory
+ * Depth 1 = files in first-level subdirectories
+ * Depth 2 = files in second-level subdirectories
+ */
+const MAX_SCAN_DEPTH = 2;
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Public API
 // ─────────────────────────────────────────────────────────────────────────────
@@ -129,13 +141,37 @@ export function detectAllFromCode(cwd: string): Promise<DetectedDsn[]> {
 // Internal
 // ─────────────────────────────────────────────────────────────────────────────
 
+/**
+ * Get the depth of a file path (number of directory levels).
+ * Files in the root have depth 0, first-level subdirs have depth 1, etc.
+ *
+ * @param filepath - Relative file path
+ * @returns Depth level (0 for root files)
+ */
+function getPathDepth(filepath: string): number {
+  const parts = filepath.split("/");
+  // Depth is number of directory parts (excluding the filename)
+  return parts.length - 1;
+}
+
 /**
  * Check if a path should be skipped during scanning.
  *
+ * Skips paths that:
+ * - Exceed the maximum scan depth
+ * - Contain a known skip directory (node_modules, dist, etc.)
+ *
  * @param filepath - Relative file path to check
- * @returns True if any path segment matches a skip directory
+ * @returns True if the path should be skipped
  */
 function shouldSkipPath(filepath: string): boolean {
+  // Check depth first (fast reject)
+  const depth = getPathDepth(filepath);
+  if (depth > MAX_SCAN_DEPTH) {
+    return true;
+  }
+
+  // Check for skip directories
   const parts = filepath.split("/");
   return parts.some((part) => allSkipDirs.has(part));
 }
@@ -175,31 +211,64 @@ async function processCodeFile(
 }
 
 /**
- * Scan code files for DSNs.
+ * Scan code files for DSNs with Sentry performance tracing.
  *
  * @param cwd - Directory to search in
  * @param stopOnFirst - Whether to stop after first match
  * @returns Array of detected DSNs
  */
-async function scanCodeFiles(
+function scanCodeFiles(
   cwd: string,
   stopOnFirst: boolean
 ): Promise<DetectedDsn[]> {
-  const results: DetectedDsn[] = [];
+  return Sentry.startSpan(
+    {
+      name: "scanCodeFiles",
+      op: "dsn.detect.code",
+      attributes: {
+        "dsn.scan_dir": cwd,
+        "dsn.stop_on_first": stopOnFirst,
+        "dsn.max_depth": MAX_SCAN_DEPTH,
+      },
+      onlyIfParent: true,
+    },
+    async (span) => {
+      const results: DetectedDsn[] = [];
+      let filesScanned = 0;
+      let filesSkipped = 0;
 
-  for await (const relativePath of codeGlob.scan({ cwd, onlyFiles: true })) {
-    if (shouldSkipPath(relativePath)) {
-      continue;
-    }
+      for await (const relativePath of codeGlob.scan({
+        cwd,
+        onlyFiles: true,
+      })) {
+        if (shouldSkipPath(relativePath)) {
+          filesSkipped += 1;
+          continue;
+        }
 
-    const detected = await processCodeFile(cwd, relativePath);
-    if (detected) {
-      results.push(detected);
-      if (stopOnFirst) {
-        return results;
+        filesScanned += 1;
+        const detected = await processCodeFile(cwd, relativePath);
+        if (detected) {
+          results.push(detected);
+          if (stopOnFirst) {
+            span.setAttributes({
+              "dsn.files_scanned": filesScanned,
+              "dsn.files_skipped": filesSkipped,
+              "dsn.dsns_found": results.length,
+            });
+            span.setStatus({ code: 1 });
+            return results;
+          }
+        }
       }
-    }
-  }
 
-  return results;
+      span.setAttributes({
+        "dsn.files_scanned": filesScanned,
+        "dsn.files_skipped": filesSkipped,
+        "dsn.dsns_found": results.length,
+      });
+      span.setStatus({ code: 1 });
+      return results;
+    }
+  );
 }
diff --git a/src/lib/dsn/project-root.ts b/src/lib/dsn/project-root.ts
new file mode 100644
index 00000000..2ecc8fe1
--- /dev/null
+++ b/src/lib/dsn/project-root.ts
@@ -0,0 +1,675 @@
+/**
+ * Project Root Detection
+ *
+ * Walks up from starting directory to find project root, optionally
+ * detecting DSN along the way for early exit.
+ *
+ * Priority:
+ * 1. .env with SENTRY_DSN → immediate return
+ * 2. VCS/CI markers → definitive repo root (stop walking)
+ * 3. Language markers → closest to cwd wins
+ * 4. Build system markers → last resort
+ *
+ * Stops at: home directory or filesystem root
+ */
+
+import { stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+// biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
+import * as Sentry from "@sentry/bun";
+import { extractDsnFromEnvContent } from "./env-file.js";
+import { createDetectedDsn } from "./parser.js";
+import type { DetectedDsn } from "./types.js";
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Types
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Why a directory was chosen as project root
+ */
+export type ProjectRootReason =
+  | "env_dsn" // Found .env with SENTRY_DSN
+  | "vcs" // Version control (.git, .hg, etc.)
+  | "ci" // CI/CD markers (.github, etc.)
+  | "editorconfig" // .editorconfig with root=true
+  | "language" // Language/package marker
+  | "build_system" // Build system marker
+  | "fallback"; // No markers found, using cwd
+
+/**
+ * Result of project root detection
+ */
+export type ProjectRootResult = {
+  /** The determined project root directory */
+  projectRoot: string;
+  /** DSN found in .env while walking up (early exit) */
+  foundDsn?: DetectedDsn;
+  /** Why this directory was chosen as root */
+  reason: ProjectRootReason;
+  /** Number of directories traversed to find root */
+  levelsTraversed: number;
+};
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Marker Definitions
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** VCS directories - definitive repo root */
+const VCS_MARKERS = [
+  ".git",
+  ".hg",
+  ".svn",
+  ".bzr",
+  "_darcs",
+  ".fossil",
+  ".pijul",
+] as const;
+
+/** CI/CD markers - definitive repo root */
+const CI_MARKERS = [
+  ".github",
+  ".gitlab-ci.yml",
+  ".circleci",
+  "Jenkinsfile",
+  ".travis.yml",
+  "azure-pipelines.yml",
+  ".buildkite",
+  "bitbucket-pipelines.yml",
+  ".drone.yml",
+  ".woodpecker.yml",
+  ".forgejo",
+  ".gitea",
+] as const;
+
+/** Language/package markers - strong project boundary */
+const LANGUAGE_MARKERS = [
+  // JavaScript/Node ecosystem
+  "package.json",
+  "deno.json",
+  "deno.jsonc",
+  // Python
+  "pyproject.toml",
+  "setup.py",
+  "setup.cfg",
+  "Pipfile",
+  // Go
+  "go.mod",
+  "go.work",
+  // Rust
+  "Cargo.toml",
+  // Ruby
+  "Gemfile",
+  // PHP
+  "composer.json",
+  // Java/JVM
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "settings.gradle",
+  "settings.gradle.kts",
+  "build.sbt",
+  // .NET
+  "global.json",
+  // Swift
+  "Package.swift",
+  // Elixir
+  "mix.exs",
+  // Dart/Flutter
+  "pubspec.yaml",
+  // Haskell
+  "stack.yaml",
+  "cabal.project",
+  // OCaml
+  "dune-project",
+  // Zig
+  "build.zig",
+  "build.zig.zon",
+  // Clojure
+  "project.clj",
+  "deps.edn",
+] as const;
+
+/** Glob patterns for language markers that need wildcard matching */
+const LANGUAGE_MARKER_GLOBS = [
+  "*.sln",
+  "*.csproj",
+  "*.fsproj",
+  "*.vbproj",
+  "*.cabal",
+  "*.opam",
+  "*.nimble",
+] as const;
+
+/** Build system markers - last resort */
+const BUILD_SYSTEM_MARKERS = [
+  "Makefile",
+  "GNUmakefile",
+  "makefile",
+  "CMakeLists.txt",
+  "BUILD",
+  "BUILD.bazel",
+  "WORKSPACE",
+  "WORKSPACE.bazel",
+  "MODULE.bazel",
+  "meson.build",
+  "Justfile",
+  "justfile",
+  "Taskfile.yml",
+  "Taskfile.yaml",
+  "SConstruct",
+  "xmake.lua",
+  "premake5.lua",
+  "premake4.lua",
+  "wscript",
+  "Earthfile",
+] as const;
+
+/** .env files to check for SENTRY_DSN (in priority order) */
+const ENV_FILES = [
+  ".env.local",
+  ".env.development.local",
+  ".env.production.local",
+  ".env",
+  ".env.development",
+  ".env.production",
+] as const;
+
+/** Regex for detecting root=true in .editorconfig (top-level for performance) */
+const EDITORCONFIG_ROOT_REGEX = /^\s*root\s*=\s*true\s*$/im;
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Telemetry Helpers
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Wrap a file system operation with a span for tracing.
+ */
+function withFsSpan<T>(
+  operation: string,
+  fn: () => T | Promise<T>
+): Promise<T> {
+  return Sentry.startSpan(
+    {
+      name: operation,
+      op: "file",
+      onlyIfParent: true,
+    },
+    async (span) => {
+      try {
+        const result = await fn();
+        span.setStatus({ code: 1 }); // OK
+        return result;
+      } catch (error) {
+        span.setStatus({ code: 2 }); // Error
+        throw error;
+      }
+    }
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// File System Helpers (Parallelized)
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Check if a path exists (file or directory)
+ */
+async function pathExists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Check if a file exists (async) - only for regular files
+ */
+async function fileExists(path: string): Promise<boolean> {
+  try {
+    return await Bun.file(path).exists();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Check if any of the given paths exist in a directory (parallel)
+ * Works for both files and directories.
+ *
+ * @param dir - Directory to check
+ * @param names - Array of file/directory names to check
+ * @returns True if any path exists
+ */
+async function anyExists(
+  dir: string,
+  names: readonly string[]
+): Promise<boolean> {
+  const checks = names.map((name) => pathExists(join(dir, name)));
+  const results = await Promise.all(checks);
+  return results.some((exists) => exists);
+}
+
+/**
+ * Check if any files matching glob patterns exist in a directory (parallel)
+ *
+ * @param dir - Directory to check
+ * @param patterns - Glob patterns to match
+ * @returns True if any matching file exists
+ */
+async function anyGlobMatches(
+  dir: string,
+  patterns: readonly string[]
+): Promise<boolean> {
+  const checks = patterns.map(async (pattern) => {
+    const glob = new Bun.Glob(pattern);
+    for await (const _match of glob.scan({ cwd: dir, onlyFiles: true })) {
+      return true; // Found at least one match
+    }
+    return false;
+  });
+
+  const results = await Promise.all(checks);
+  return results.some((found) => found);
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Marker Detection Functions
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Check if .editorconfig exists and contains root=true
+ *
+ * @param dir - Directory to check
+ * @returns True if .editorconfig with root=true found
+ */
+async function checkEditorConfigRoot(dir: string): Promise<boolean> {
+  const editorConfigPath = join(dir, ".editorconfig");
+  try {
+    const file = Bun.file(editorConfigPath);
+    if (!(await file.exists())) {
+      return false;
+    }
+    const content = await file.text();
+    return EDITORCONFIG_ROOT_REGEX.test(content);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Determine the type of repo root marker found
+ */
+function getRepoRootType(
+  hasVcs: boolean,
+  hasCi: boolean,
+  hasEditorConfigRoot: boolean
+): "vcs" | "ci" | "editorconfig" | undefined {
+  if (hasVcs) {
+    return "vcs";
+  }
+  if (hasCi) {
+    return "ci";
+  }
+  if (hasEditorConfigRoot) {
+    return "editorconfig";
+  }
+  return;
+}
+
+/**
+ * Check if directory has VCS or CI/CD markers (definitive repo root)
+ *
+ * @param dir - Directory to check
+ * @returns Object with found status and marker type
+ */
+export function hasRepoRootMarker(
+  dir: string
+): Promise<{ found: boolean; type?: "vcs" | "ci" | "editorconfig" }> {
+  return withFsSpan("hasRepoRootMarker", async () => {
+    // Check all marker types in parallel
+    const [hasVcs, hasCi, hasEditorConfigRoot] = await Promise.all([
+      anyExists(dir, VCS_MARKERS),
+      anyExists(dir, CI_MARKERS),
+      checkEditorConfigRoot(dir),
+    ]);
+
+    const type = getRepoRootType(hasVcs, hasCi, hasEditorConfigRoot);
+    return type ? { found: true, type } : { found: false };
+  });
+}
+
+/**
+ * Check if directory has language/package markers
+ *
+ * @param dir - Directory to check
+ * @returns True if any language marker found
+ */
+export function hasLanguageMarker(dir: string): Promise<boolean> {
+  return withFsSpan("hasLanguageMarker", async () => {
+    // Check exact filenames and glob patterns in parallel
+    const [hasExact, hasGlob] = await Promise.all([
+      anyExists(dir, LANGUAGE_MARKERS),
+      anyGlobMatches(dir, LANGUAGE_MARKER_GLOBS),
+    ]);
+    return hasExact || hasGlob;
+  });
+}
+
+/**
+ * Check if directory has build system markers
+ *
+ * @param dir - Directory to check
+ * @returns True if any build system marker found
+ */
+export function hasBuildSystemMarker(dir: string): Promise<boolean> {
+  return withFsSpan("hasBuildSystemMarker", async () =>
+    anyExists(dir, BUILD_SYSTEM_MARKERS)
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// DSN Detection in .env Files
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Check .env files in a directory for SENTRY_DSN
+ *
+ * Checks files in priority order and returns immediately on first match.
+ *
+ * @param dir - Directory to check
+ * @returns Detected DSN or null
+ */
+export function checkEnvForDsn(dir: string): Promise<DetectedDsn | null> {
+  return withFsSpan("checkEnvForDsn", async () => {
+    // Check all env files in parallel for existence
+    const existenceChecks = ENV_FILES.map(async (filename) => {
+      const path = join(dir, filename);
+      const exists = await fileExists(path);
+      return { filename, path, exists };
+    });
+
+    const results = await Promise.all(existenceChecks);
+    const existingFiles = results.filter((r) => r.exists);
+
+    // Read existing files in parallel
+    const contentChecks = existingFiles.map(async ({ filename, path }) => {
+      try {
+        const content = await Bun.file(path).text();
+        const dsn = extractDsnFromEnvContent(content);
+        return dsn ? { dsn, filename } : null;
+      } catch {
+        return null;
+      }
+    });
+
+    const dsnResults = await Promise.all(contentChecks);
+
+    // Return first found DSN (respecting priority order)
+    for (const filename of ENV_FILES) {
+      const found = dsnResults.find(
+        (r) => r !== null && r.filename === filename
+      );
+      if (found) {
+        return createDetectedDsn(found.dsn, "env_file", found.filename);
+      }
+    }
+
+    return null;
+  });
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Main API
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Get the stop boundary for project root search.
+ *
+ * Returns home directory if it exists, otherwise filesystem root.
+ */
+export function getStopBoundary(): string {
+  try {
+    return homedir();
+  } catch {
+    return "/";
+  }
+}
+
+/**
+ * Process one directory level during the walk-up search
+ */
+async function processDirectoryLevel(
+  currentDir: string,
+  languageMarkerAt: string | null,
+  buildSystemAt: string | null
+): Promise<{
+  dsnResult: DetectedDsn | null;
+  repoRootResult: { found: boolean; type?: "vcs" | "ci" | "editorconfig" };
+  hasLang: boolean;
+  hasBuild: boolean;
+}> {
+  // Run all checks for this level in parallel
+  const [dsnResult, repoRootResult, hasLang, hasBuild] = await Promise.all([
+    checkEnvForDsn(currentDir),
+    hasRepoRootMarker(currentDir),
+    languageMarkerAt ? Promise.resolve(false) : hasLanguageMarker(currentDir),
+    buildSystemAt ? Promise.resolve(false) : hasBuildSystemMarker(currentDir),
+  ]);
+
+  return { dsnResult, repoRootResult, hasLang, hasBuild };
+}
+
+/**
+ * Convert repo root type to project root reason
+ */
+function repoRootTypeToReason(
+  type: "vcs" | "ci" | "editorconfig" | undefined
+): ProjectRootReason {
+  switch (type) {
+    case "editorconfig":
+      return "editorconfig";
+    case "ci":
+      return "ci";
+    default:
+      return "vcs";
+  }
+}
+
+/**
+ * Determine the final project root from candidates
+ */
+function selectProjectRoot(
+  languageMarkerAt: string | null,
+  buildSystemAt: string | null,
+  fallback: string
+): { projectRoot: string; reason: ProjectRootReason } {
+  if (languageMarkerAt) {
+    return { projectRoot: languageMarkerAt, reason: "language" };
+  }
+  if (buildSystemAt) {
+    return { projectRoot: buildSystemAt, reason: "build_system" };
+  }
+  return { projectRoot: fallback, reason: "fallback" };
+}
+
+/**
+ * State tracked during directory walk-up
+ */
+type WalkState = {
+  currentDir: string;
+  levelsTraversed: number;
+  languageMarkerAt: string | null;
+  buildSystemAt: string | null;
+};
+
+/**
+ * Create result when DSN is found in .env file
+ */
+function createDsnFoundResult(
+  currentDir: string,
+  dsnResult: DetectedDsn,
+  levelsTraversed: number
+): ProjectRootResult {
+  return {
+    projectRoot: currentDir,
+    foundDsn: dsnResult,
+    reason: "env_dsn",
+    levelsTraversed,
+  };
+}
+
+/**
+ * Create result when repo root marker is found
+ */
+function createRepoRootResult(
+  currentDir: string,
+  markerType: "vcs" | "ci" | "editorconfig" | undefined,
+  levelsTraversed: number
+): ProjectRootResult {
+  return {
+    projectRoot: currentDir,
+    reason: repoRootTypeToReason(markerType),
+    levelsTraversed,
+  };
+}
+
+/**
+ * Walk up directories searching for project root
+ */
+async function walkUpDirectories(
+  resolvedStart: string,
+  stopBoundary: string
+): Promise<ProjectRootResult> {
+  const state: WalkState = {
+    currentDir: resolvedStart,
+    levelsTraversed: 0,
+    languageMarkerAt: null,
+    buildSystemAt: null,
+  };
+
+  while (state.currentDir !== "/" && state.currentDir !== stopBoundary) {
+    state.levelsTraversed += 1;
+
+    const { dsnResult, repoRootResult, hasLang, hasBuild } =
+      await processDirectoryLevel(
+        state.currentDir,
+        state.languageMarkerAt,
+        state.buildSystemAt
+      );
+
+    // 1. Check for DSN in .env files - immediate return
+    if (dsnResult) {
+      return createDsnFoundResult(
+        state.currentDir,
+        dsnResult,
+        state.levelsTraversed
+      );
+    }
+
+    // 2. Check for VCS/CI markers - definitive root, stop walking
+    if (repoRootResult.found) {
+      return createRepoRootResult(
+        state.currentDir,
+        repoRootResult.type,
+        state.levelsTraversed
+      );
+    }
+
+    // 3. Remember language marker (closest to cwd wins)
+    if (!state.languageMarkerAt && hasLang) {
+      state.languageMarkerAt = state.currentDir;
+    }
+
+    // 4. Remember build system marker (last resort)
+    if (!state.buildSystemAt && hasBuild) {
+      state.buildSystemAt = state.currentDir;
+    }
+
+    // Move to parent directory
+    const parentDir = dirname(state.currentDir);
+    if (parentDir === state.currentDir) {
+      break; // Reached filesystem root
+    }
+    state.currentDir = parentDir;
+  }
+
+  // Determine project root from candidates (priority order)
+  const selected = selectProjectRoot(
+    state.languageMarkerAt,
+    state.buildSystemAt,
+    resolvedStart
+  );
+
+  return {
+    projectRoot: selected.projectRoot,
+    reason: selected.reason,
+    levelsTraversed: state.levelsTraversed,
+  };
+}
+
+/**
+ * Find project root by walking up from starting directory.
+ *
+ * Checks for DSN in .env files at each level (early exit if found).
+ * Stops at VCS/CI markers (definitive repo root).
+ * Falls back to language markers, then build system markers.
+ *
+ * @param startDir - Directory to start searching from
+ * @returns Project root result with optional DSN
+ */
+export function findProjectRoot(startDir: string): Promise<ProjectRootResult> {
+  return Sentry.startSpan(
+    {
+      name: "findProjectRoot",
+      op: "dsn.detect",
+      attributes: {
+        "dsn.start_dir": startDir,
+      },
+      onlyIfParent: true,
+    },
+    async (span) => {
+      const resolvedStart = resolve(startDir);
+      const stopBoundary = getStopBoundary();
+
+      const result = await walkUpDirectories(resolvedStart, stopBoundary);
+
+      span.setAttributes({
+        "dsn.found": result.foundDsn !== undefined,
+        "dsn.reason": result.reason,
+        "dsn.levels_traversed": result.levelsTraversed,
+        "dsn.project_root": result.projectRoot,
+      });
+      span.setStatus({ code: 1 });
+
+      return result;
+    }
+  );
+}
+
+/**
+ * Check if a directory is a project root.
+ *
+ * A directory is considered a project root if it has any of:
+ * - VCS markers (.git, .hg, etc.)
+ * - CI/CD markers (.github, etc.)
+ * - .editorconfig with root=true
+ * - Language/package markers
+ * - Build system markers
+ *
+ * @param dir - Directory to check
+ * @returns True if directory appears to be a project root
+ */
+export async function isProjectRoot(dir: string): Promise<boolean> {
+  // Check all marker types in parallel
+  const [hasRepo, hasLang, hasBuild] = await Promise.all([
+    hasRepoRootMarker(dir),
+    hasLanguageMarker(dir),
+    hasBuildSystemMarker(dir),
+  ]);
+
+  return hasRepo.found || hasLang || hasBuild;
+}
diff --git a/test/lib/dsn/detector.test.ts b/test/lib/dsn/detector.test.ts
index a0b83a02..c7706ee0 100644
--- a/test/lib/dsn/detector.test.ts
+++ b/test/lib/dsn/detector.test.ts
@@ -99,7 +99,7 @@ describe("DSN Detector (New Module)", () => {
       expect(cached?.dsn).toBe(dsn2);
     });
 
-    test("code DSN takes priority over env file", async () => {
+    test("env file DSN found during walk-up takes priority over code", async () => {
       const envFileDsn = "https://file@o111.ingest.sentry.io/111";
       const codeDsn = "https://code@o222.ingest.sentry.io/222";
 
@@ -111,10 +111,11 @@ describe("DSN Detector (New Module)", () => {
         `Sentry.init({ dsn: "${codeDsn}" })`
       );
 
-      // Should return code DSN (highest priority)
+      // With project root detection, .env files are checked during walk-up
+      // and return immediately if SENTRY_DSN is found (fastest path)
       const result = await detectDsn(testDir);
-      expect(result?.raw).toBe(codeDsn);
-      expect(result?.source).toBe("code");
+      expect(result?.raw).toBe(envFileDsn);
+      expect(result?.source).toBe("env_file");
     });
 
     test("code DSN takes priority over env var", async () => {
@@ -245,8 +246,8 @@ describe("DSN Detector (New Module)", () => {
       const result = await detectAllDsns(testDir);
 
       expect(result.hasMultiple).toBe(true);
-      // Code DSN has higher priority, so it's first
-      expect(result.primary?.raw).toBe(codeDsn);
+      // With project root detection, env file DSN found during walk-up is first
+      expect(result.primary?.raw).toBe(envDsn);
       expect(result.all).toHaveLength(2);
     });
 
diff --git a/test/lib/dsn/project-root.test.ts b/test/lib/dsn/project-root.test.ts
new file mode 100644
index 00000000..e4477207
--- /dev/null
+++ b/test/lib/dsn/project-root.test.ts
@@ -0,0 +1,342 @@
+/**
+ * Project Root Detection Tests
+ *
+ * Tests for finding project root by walking up from a starting directory.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  findProjectRoot,
+  getStopBoundary,
+  hasBuildSystemMarker,
+  hasLanguageMarker,
+  hasRepoRootMarker,
+  isProjectRoot,
+} from "../../../src/lib/dsn/project-root.js";
+
+// Test directory structure helper
+function createDir(path: string): void {
+  mkdirSync(path, { recursive: true });
+}
+
+function createFile(path: string, content = ""): void {
+  writeFileSync(path, content);
+}
+
+describe("project-root", () => {
+  let testDir: string;
+
+  beforeEach(() => {
+    // Create a unique temp directory for each test
+    testDir = join(
+      tmpdir(),
+      `sentry-cli-test-${Date.now()}-${Math.random().toString(36).slice(2)}`
+    );
+    createDir(testDir);
+  });
+
+  afterEach(() => {
+    // Clean up test directory
+    try {
+      rmSync(testDir, { recursive: true, force: true });
+    } catch {
+      // Ignore cleanup errors
+    }
+  });
+
+  describe("getStopBoundary", () => {
+    test("returns home directory", () => {
+      const boundary = getStopBoundary();
+      expect(boundary).toBe(homedir());
+    });
+  });
+
+  describe("hasRepoRootMarker", () => {
+    test("detects .git directory", async () => {
+      createDir(join(testDir, ".git"));
+      const result = await hasRepoRootMarker(testDir);
+      expect(result.found).toBe(true);
+      expect(result.type).toBe("vcs");
+    });
+
+    test("detects .hg directory", async () => {
+      createDir(join(testDir, ".hg"));
+      const result = await hasRepoRootMarker(testDir);
+      expect(result.found).toBe(true);
+      expect(result.type).toBe("vcs");
+    });
+
+    test("detects .github directory", async () => {
+      createDir(join(testDir, ".github"));
+      const result = await hasRepoRootMarker(testDir);
+      expect(result.found).toBe(true);
+      expect(result.type).toBe("ci");
+    });
+
+    test("detects .gitlab-ci.yml file", async () => {
+      createFile(join(testDir, ".gitlab-ci.yml"));
+      const result = await hasRepoRootMarker(testDir);
+      expect(result.found).toBe(true);
+      expect(result.type).toBe("ci");
+    });
+
+    test("detects .editorconfig with root=true", async () => {
+      createFile(
+        join(testDir, ".editorconfig"),
+        "root = true\n[*]\nindent_style = space"
+      );
+      const result = await hasRepoRootMarker(testDir);
+      expect(result.found).toBe(true);
+      expect(result.type).toBe("editorconfig");
+    });
+
+    test("ignores .editorconfig without root=true", async () => {
+      createFile(join(testDir, ".editorconfig"), "[*]\nindent_style = space");
+      const result = await hasRepoRootMarker(testDir);
+      expect(result.found).toBe(false);
+    });
+
+    test("returns found=false when no markers", async () => {
+      const result = await hasRepoRootMarker(testDir);
+      expect(result.found).toBe(false);
+    });
+  });
+
+  describe("hasLanguageMarker", () => {
+    test("detects package.json", async () => {
+      createFile(join(testDir, "package.json"), "{}");
+      expect(await hasLanguageMarker(testDir)).toBe(true);
+    });
+
+    test("detects pyproject.toml", async () => {
+      createFile(join(testDir, "pyproject.toml"), "");
+      expect(await hasLanguageMarker(testDir)).toBe(true);
+    });
+
+    test("detects go.mod", async () => {
+      createFile(join(testDir, "go.mod"), "module example.com/test");
+      expect(await hasLanguageMarker(testDir)).toBe(true);
+    });
+
+    test("detects Cargo.toml", async () => {
+      createFile(join(testDir, "Cargo.toml"), "");
+      expect(await hasLanguageMarker(testDir)).toBe(true);
+    });
+
+    test("detects .sln file (glob pattern)", async () => {
+      createFile(join(testDir, "MyProject.sln"), "");
+      expect(await hasLanguageMarker(testDir)).toBe(true);
+    });
+
+    test("detects .csproj file (glob pattern)", async () => {
+      createFile(join(testDir, "MyProject.csproj"), "");
+      expect(await hasLanguageMarker(testDir)).toBe(true);
+    });
+
+    test("returns false when no markers", async () => {
+      expect(await hasLanguageMarker(testDir)).toBe(false);
+    });
+  });
+
+  describe("hasBuildSystemMarker", () => {
+    test("detects Makefile", async () => {
+      createFile(join(testDir, "Makefile"), "");
+      expect(await hasBuildSystemMarker(testDir)).toBe(true);
+    });
+
+    test("detects CMakeLists.txt", async () => {
+      createFile(join(testDir, "CMakeLists.txt"), "");
+      expect(await hasBuildSystemMarker(testDir)).toBe(true);
+    });
+
+    test("detects BUILD.bazel", async () => {
+      createFile(join(testDir, "BUILD.bazel"), "");
+      expect(await hasBuildSystemMarker(testDir)).toBe(true);
+    });
+
+    test("returns false when no markers", async () => {
+      expect(await hasBuildSystemMarker(testDir)).toBe(false);
+    });
+  });
+
+  describe("isProjectRoot", () => {
+    test("returns true for directory with .git", async () => {
+      createDir(join(testDir, ".git"));
+      expect(await isProjectRoot(testDir)).toBe(true);
+    });
+
+    test("returns true for directory with package.json", async () => {
+      createFile(join(testDir, "package.json"), "{}");
+      expect(await isProjectRoot(testDir)).toBe(true);
+    });
+
+    test("returns true for directory with Makefile", async () => {
+      createFile(join(testDir, "Makefile"), "");
+      expect(await isProjectRoot(testDir)).toBe(true);
+    });
+
+    test("returns false for empty directory", async () => {
+      expect(await isProjectRoot(testDir)).toBe(false);
+    });
+  });
+
+  describe("findProjectRoot", () => {
+    describe("DSN detection in .env files", () => {
+      test("finds DSN in .env file and returns immediately", async () => {
+        const dsn = "https://abc123@o123.ingest.sentry.io/456";
+        createFile(join(testDir, ".env"), `SENTRY_DSN=${dsn}`);
+        createDir(join(testDir, "src", "lib"));
+
+        const result = await findProjectRoot(join(testDir, "src", "lib"));
+
+        expect(result.foundDsn).toBeDefined();
+        expect(result.foundDsn?.raw).toBe(dsn);
+        expect(result.reason).toBe("env_dsn");
+        expect(result.projectRoot).toBe(testDir);
+      });
+
+      test("finds DSN in .env.local (higher priority)", async () => {
+        const dsnLocal = "https://local@o123.ingest.sentry.io/456";
+        const dsnBase = "https://base@o123.ingest.sentry.io/789";
+        createFile(join(testDir, ".env.local"), `SENTRY_DSN=${dsnLocal}`);
+        createFile(join(testDir, ".env"), `SENTRY_DSN=${dsnBase}`);
+
+        const result = await findProjectRoot(testDir);
+
+        expect(result.foundDsn?.raw).toBe(dsnLocal);
+      });
+
+      test("finds DSN at intermediate level during walk-up", async () => {
+        const dsn = "https://abc123@o123.ingest.sentry.io/456";
+        // Create nested structure: testDir/packages/app/src
+        const packagesDir = join(testDir, "packages");
+        const appDir = join(packagesDir, "app");
+        const srcDir = join(appDir, "src");
+        createDir(srcDir);
+
+        // Put DSN in app directory
+        createFile(join(appDir, ".env"), `SENTRY_DSN=${dsn}`);
+
+        // Put .git at root
+        createDir(join(testDir, ".git"));
+
+        const result = await findProjectRoot(srcDir);
+
+        // Should find DSN at app level (immediate return)
+        expect(result.foundDsn).toBeDefined();
+        expect(result.foundDsn?.raw).toBe(dsn);
+        expect(result.reason).toBe("env_dsn");
+      });
+    });
+
+    describe("VCS marker detection", () => {
+      test("stops at .git directory", async () => {
+        createDir(join(testDir, ".git"));
+        createDir(join(testDir, "src", "lib", "utils"));
+
+        const result = await findProjectRoot(
+          join(testDir, "src", "lib", "utils")
+        );
+
+        expect(result.projectRoot).toBe(testDir);
+        expect(result.reason).toBe("vcs");
+        // Levels: utils(1) -> lib(2) -> src(3) -> testDir(4, found .git)
+        expect(result.levelsTraversed).toBe(4);
+      });
+
+      test("stops at .github directory", async () => {
+        createDir(join(testDir, ".github"));
+        createDir(join(testDir, "src"));
+
+        const result = await findProjectRoot(join(testDir, "src"));
+
+        expect(result.projectRoot).toBe(testDir);
+        expect(result.reason).toBe("ci");
+      });
+    });
+
+    describe("language marker detection", () => {
+      test("uses closest language marker to cwd", async () => {
+        // Root has package.json
+        createFile(join(testDir, "package.json"), "{}");
+
+        // Nested package also has package.json
+        const nestedDir = join(testDir, "packages", "frontend");
+        createDir(nestedDir);
+        createFile(join(nestedDir, "package.json"), "{}");
+
+        // Start from nested/src
+        const srcDir = join(nestedDir, "src");
+        createDir(srcDir);
+
+        const result = await findProjectRoot(srcDir);
+
+        // Should use the closest package.json (in packages/frontend)
+        expect(result.projectRoot).toBe(nestedDir);
+        expect(result.reason).toBe("language");
+      });
+
+      test("VCS marker takes precedence over language marker", async () => {
+        createDir(join(testDir, ".git"));
+        createFile(join(testDir, "package.json"), "{}");
+        createDir(join(testDir, "src"));
+
+        const result = await findProjectRoot(join(testDir, "src"));
+
+        // Should stop at .git even though package.json was also found
+        expect(result.projectRoot).toBe(testDir);
+        expect(result.reason).toBe("vcs");
+      });
+    });
+
+    describe("build system marker detection", () => {
+      test("uses build system marker as last resort", async () => {
+        createFile(join(testDir, "Makefile"), "");
+        createDir(join(testDir, "src"));
+
+        const result = await findProjectRoot(join(testDir, "src"));
+
+        expect(result.projectRoot).toBe(testDir);
+        expect(result.reason).toBe("build_system");
+      });
+
+      test("language marker takes precedence over build system", async () => {
+        createFile(join(testDir, "Makefile"), "");
+        createFile(join(testDir, "package.json"), "{}");
+        createDir(join(testDir, "src"));
+
+        const result = await findProjectRoot(join(testDir, "src"));
+
+        expect(result.reason).toBe("language");
+      });
+    });
+
+    describe("fallback behavior", () => {
+      test("returns cwd when no markers found", async () => {
+        const deepDir = join(testDir, "a", "b", "c");
+        createDir(deepDir);
+
+        const result = await findProjectRoot(deepDir);
+
+        // Should fall back to the starting directory
+        expect(result.projectRoot).toBe(deepDir);
+        expect(result.reason).toBe("fallback");
+      });
+    });
+
+    describe("levels traversed tracking", () => {
+      test("tracks correct number of levels", async () => {
+        createDir(join(testDir, ".git"));
+        createDir(join(testDir, "a", "b", "c", "d"));
+
+        const result = await findProjectRoot(join(testDir, "a", "b", "c", "d"));
+
+        // Levels: d(1) -> c(2) -> b(3) -> a(4) -> testDir(5, found .git)
+        expect(result.levelsTraversed).toBe(5);
+      });
+    });
+  });
+});

From aff89c6bc389802f4b243c9d1322236c6db22948 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 14:22:57 +0000
Subject: [PATCH 02/19] refactor(dsn): replace language-specific detectors with
 grep-based scanner

- Add language-agnostic code-scanner.ts that greps for DSN URL patterns
- Filter commented lines using common prefixes (// # -- <!-- etc.)
- Respect .gitignore via 'ignore' package
- Scan concurrently with p-limit for performance
- Remove 8 language-specific detector files and 6 test files
- Add 28 new tests for the code scanner
---
 bun.lock                                  |  14 +-
 package.json                              |   4 +
 src/lib/dsn/code-scanner.ts               | 559 ++++++++++++++++++++++
 src/lib/dsn/detector.ts                   |  34 +-
 src/lib/dsn/languages/go.ts               |  52 --
 src/lib/dsn/languages/index.ts            | 274 -----------
 src/lib/dsn/languages/java.ts             |  77 ---
 src/lib/dsn/languages/javascript.ts       |  62 ---
 src/lib/dsn/languages/php.ts              |  53 --
 src/lib/dsn/languages/python.ts           |  69 ---
 src/lib/dsn/languages/ruby.ts             |  61 ---
 src/lib/dsn/languages/types.ts            |  29 --
 test/lib/dsn/code-scanner.test.ts         | 336 +++++++++++++
 test/lib/dsn/languages/go.test.ts         |  64 ---
 test/lib/dsn/languages/java.test.ts       |  69 ---
 test/lib/dsn/languages/javascript.test.ts |  64 ---
 test/lib/dsn/languages/php.test.ts        |  62 ---
 test/lib/dsn/languages/python.test.ts     |  69 ---
 test/lib/dsn/languages/ruby.test.ts       |  63 ---
 19 files changed, 923 insertions(+), 1092 deletions(-)
 create mode 100644 src/lib/dsn/code-scanner.ts
 delete mode 100644 src/lib/dsn/languages/go.ts
 delete mode 100644 src/lib/dsn/languages/index.ts
 delete mode 100644 src/lib/dsn/languages/java.ts
 delete mode 100644 src/lib/dsn/languages/javascript.ts
 delete mode 100644 src/lib/dsn/languages/php.ts
 delete mode 100644 src/lib/dsn/languages/python.ts
 delete mode 100644 src/lib/dsn/languages/ruby.ts
 delete mode 100644 src/lib/dsn/languages/types.ts
 create mode 100644 test/lib/dsn/code-scanner.test.ts
 delete mode 100644 test/lib/dsn/languages/go.test.ts
 delete mode 100644 test/lib/dsn/languages/java.test.ts
 delete mode 100644 test/lib/dsn/languages/javascript.test.ts
 delete mode 100644 test/lib/dsn/languages/php.test.ts
 delete mode 100644 test/lib/dsn/languages/python.test.ts
 delete mode 100644 test/lib/dsn/languages/ruby.test.ts

diff --git a/bun.lock b/bun.lock
index 0d041fe0..a55dd9fa 100644
--- a/bun.lock
+++ b/bun.lock
@@ -4,6 +4,10 @@
   "workspaces": {
     "": {
       "name": "sentry",
+      "dependencies": {
+        "ignore": "^7.0.5",
+        "p-limit": "^7.2.0",
+      },
       "devDependencies": {
         "@biomejs/biome": "2.3.8",
         "@sentry/bun": "10.38.0",
@@ -347,6 +351,8 @@
 
     "https-proxy-agent": ["https-proxy-agent@5.0.1", "", { "dependencies": { "agent-base": "6", "debug": "4" } }, "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA=="],
 
+    "ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
+
     "import-in-the-middle": ["import-in-the-middle@2.0.6", "", { "dependencies": { "acorn": "^8.15.0", "acorn-import-attributes": "^1.9.5", "cjs-module-lexer": "^2.2.0", "module-details-from-path": "^1.0.4" } }, "sha512-3vZV3jX0XRFW3EJDTwzWoZa+RH1b8eTTx6YOCjglrLyPuepwoBti1k3L2dKwdCUrnVEfc5CuRuGstaC/uQJJaw=="],
 
     "is-binary-path": ["is-binary-path@2.1.0", "", { "dependencies": { "binary-extensions": "^2.0.0" } }, "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw=="],
@@ -391,7 +397,7 @@
 
     "nypm": ["nypm@0.6.4", "", { "dependencies": { "citty": "^0.2.0", "pathe": "^2.0.3", "tinyexec": "^1.0.2" }, "bin": { "nypm": "dist/cli.mjs" } }, "sha512-1TvCKjZyyklN+JJj2TS3P4uSQEInrM/HkkuSXsEzm1ApPgBffOn8gFguNnZf07r/1X6vlryfIqMUkJKQMzlZiw=="],
 
-    "p-limit": ["p-limit@3.1.0", "", { "dependencies": { "yocto-queue": "^0.1.0" } }, "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ=="],
+    "p-limit": ["p-limit@7.2.0", "", { "dependencies": { "yocto-queue": "^1.2.1" } }, "sha512-ATHLtwoTNDloHRFFxFJdHnG6n2WUeFjaR8XQMFdKIv0xkXjrER8/iG9iu265jOM95zXHAfv9oTkqhrfbIzosrQ=="],
 
     "p-locate": ["p-locate@5.0.0", "", { "dependencies": { "p-limit": "^3.0.2" } }, "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw=="],
 
@@ -471,7 +477,7 @@
 
     "yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
 
-    "yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
+    "yocto-queue": ["yocto-queue@1.2.2", "", {}, "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ=="],
 
     "zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
@@ -491,6 +497,8 @@
 
     "glob/minimatch": ["minimatch@10.1.1", "", { "dependencies": { "@isaacs/brace-expansion": "^5.0.0" } }, "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ=="],
 
+    "p-locate/p-limit": ["p-limit@3.1.0", "", { "dependencies": { "yocto-queue": "^0.1.0" } }, "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ=="],
+
     "readdirp/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
 
     "ultracite/zod": ["zod@4.3.5", "", {}, "sha512-k7Nwx6vuWx1IJ9Bjuf4Zt1PEllcwe7cls3VNzm4CQ1/hgtFUK2bRNG3rvnpPUhFjmqJKAKtjV576KnUkHocg/g=="],
@@ -505,6 +513,8 @@
 
     "@sentry/bundler-plugin-core/glob/path-scurry": ["path-scurry@1.11.1", "", { "dependencies": { "lru-cache": "^10.2.0", "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0" } }, "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA=="],
 
+    "p-locate/p-limit/yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
+
     "@sentry/bundler-plugin-core/glob/path-scurry/lru-cache": ["lru-cache@10.4.3", "", {}, "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="],
 
     "@sentry/bundler-plugin-core/glob/path-scurry/minipass": ["minipass@7.1.2", "", {}, "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw=="],
diff --git a/package.json b/package.json
index c9549394..995a7a61 100644
--- a/package.json
+++ b/package.json
@@ -57,5 +57,9 @@
   "patchedDependencies": {
     "@stricli/core@1.2.5": "patches/@stricli%2Fcore@1.2.5.patch",
     "@sentry/core@10.38.0": "patches/@sentry%2Fcore@10.38.0.patch"
+  },
+  "dependencies": {
+    "ignore": "^7.0.5",
+    "p-limit": "^7.2.0"
   }
 }
diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
new file mode 100644
index 00000000..4d0fed18
--- /dev/null
+++ b/src/lib/dsn/code-scanner.ts
@@ -0,0 +1,559 @@
+/**
+ * Language-Agnostic Code Scanner
+ *
+ * Scans source code for Sentry DSNs using a simple grep-based approach.
+ * This replaces the language-specific detectors with a unified scanner that:
+ *
+ * 1. Greps for DSN URL pattern directly: https://KEY@HOST/PROJECT_ID
+ * 2. Filters out commented lines using common prefixes
+ * 3. Respects .gitignore using the `ignore` package
+ * 4. Validates DSN hosts (SaaS or self-hosted via SENTRY_URL)
+ * 5. Scans concurrently with p-limit for performance
+ * 6. Skips large files and known non-source directories
+ */
+
+import { readdir } from "node:fs/promises";
+import { join, relative } from "node:path";
+// biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
+import * as Sentry from "@sentry/bun";
+import ignore, { type Ignore } from "ignore";
+import pLimit from "p-limit";
+import { createDetectedDsn, inferPackagePath, parseDsn } from "./parser.js";
+import type { DetectedDsn } from "./types.js";
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Constants
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Maximum file size to scan (256KB).
+ * Files larger than this are skipped as they're unlikely to be source files
+ * with DSN configuration.
+ */
+const MAX_FILE_SIZE = 256 * 1024;
+
+/**
+ * Concurrency limit for file reads.
+ * Balances performance with file descriptor limits.
+ */
+const CONCURRENCY_LIMIT = 50;
+
+/**
+ * Maximum depth to scan from project root.
+ * Depth 0 = files in root directory
+ * Depth 2 = files in second-level subdirectories (e.g., src/lib/file.ts)
+ */
+const MAX_SCAN_DEPTH = 2;
+
+/**
+ * Directories that are always skipped regardless of .gitignore.
+ * These are common dependency/build/cache directories that should never contain DSNs.
+ */
+const ALWAYS_SKIP_DIRS = new Set([
+  // Version control
+  ".git",
+  ".hg",
+  ".svn",
+  // IDE/Editor
+  ".idea",
+  ".vscode",
+  ".cursor",
+  // Node.js
+  "node_modules",
+  // Python
+  "__pycache__",
+  ".pytest_cache",
+  ".mypy_cache",
+  ".ruff_cache",
+  "venv",
+  ".venv",
+  // Java/Kotlin/Gradle
+  "build",
+  "target",
+  ".gradle",
+  // Go
+  "vendor",
+  // Ruby
+  ".bundle",
+  // PHP - vendor already listed above
+  // General build outputs
+  "dist",
+  "out",
+  ".next",
+  ".nuxt",
+  ".output",
+  "coverage",
+]);
+
+/**
+ * File extensions to scan for DSNs.
+ * Covers source code, config files, and data formats that might contain DSNs.
+ */
+const TEXT_EXTENSIONS = new Set([
+  // JavaScript/TypeScript ecosystem
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".astro",
+  ".vue",
+  ".svelte",
+  // Python
+  ".py",
+  // Go
+  ".go",
+  // Ruby
+  ".rb",
+  ".erb",
+  // PHP
+  ".php",
+  // JVM languages
+  ".java",
+  ".kt",
+  ".kts",
+  ".scala",
+  ".groovy",
+  // .NET languages
+  ".cs",
+  ".fs",
+  ".vb",
+  // Rust
+  ".rs",
+  // Swift/Objective-C
+  ".swift",
+  ".m",
+  ".mm",
+  // Dart/Flutter
+  ".dart",
+  // Elixir/Erlang
+  ".ex",
+  ".exs",
+  ".erl",
+  // Lua
+  ".lua",
+  // Config/data formats
+  ".json",
+  ".yaml",
+  ".yml",
+  ".toml",
+  ".xml",
+  ".properties",
+  ".config",
+]);
+
+/**
+ * Common comment prefixes to detect commented-out DSNs.
+ * Lines starting with these (after trimming whitespace) are ignored.
+ */
+const COMMENT_PREFIXES = ["//", "#", "--", "<!--", "/*", "*", "'''", '"""'];
+
+/**
+ * Pattern to match Sentry DSN URLs.
+ * Captures the full DSN including protocol, public key, host, and project ID.
+ *
+ * Format: https://{PUBLIC_KEY}@{HOST}/{PROJECT_ID}
+ * Example: https://abc123def456@o123456.ingest.us.sentry.io/4507654321
+ *
+ * The public key is typically a 32-character hex string, but we accept any
+ * alphanumeric string to support test fixtures and edge cases.
+ */
+const DSN_PATTERN =
+  /https?:\/\/[a-z0-9]+@[a-z0-9.-]+(?:\.sentry\.io|:[0-9]+)\/\d+/gi;
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Types
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Options for collecting files to scan.
+ */
+type CollectFilesOptions = {
+  /** Root directory for relative path calculation */
+  cwd: string;
+  /** Current directory being scanned */
+  dir: string;
+  /** Gitignore instance */
+  ig: Ignore;
+  /** Current depth level */
+  depth: number;
+};
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Public API
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Extract all DSN URLs from file content, filtering out commented lines.
+ *
+ * @param content - File content to scan
+ * @returns Array of unique DSN strings found in non-commented lines
+ */
+export function extractDsnsFromContent(content: string): string[] {
+  const dsns = new Set<string>();
+  const lines = content.split("\n");
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+
+    // Skip commented lines
+    if (isCommentedLine(trimmed)) {
+      continue;
+    }
+
+    // Find all DSN matches in this line
+    const matches = trimmed.matchAll(DSN_PATTERN);
+    for (const match of matches) {
+      const dsn = match[0];
+      // Validate it's a real DSN with valid host
+      if (isValidDsnHost(dsn)) {
+        dsns.add(dsn);
+      }
+    }
+  }
+
+  return [...dsns];
+}
+
+/**
+ * Scan a directory for all DSNs in source code files.
+ *
+ * Respects .gitignore, skips large files, and limits depth.
+ * Returns all unique DSNs found across all files.
+ *
+ * @param cwd - Directory to scan
+ * @returns Array of detected DSNs with source information
+ */
+export function scanCodeForDsns(cwd: string): Promise<DetectedDsn[]> {
+  return scanDirectory(cwd, false);
+}
+
+/**
+ * Scan a directory and return the first DSN found.
+ *
+ * Optimized for the common case of single-project repositories.
+ * Stops scanning as soon as a valid DSN is found.
+ *
+ * @param cwd - Directory to scan
+ * @returns First detected DSN or null if none found
+ */
+export async function scanCodeForFirstDsn(
+  cwd: string
+): Promise<DetectedDsn | null> {
+  const results = await scanDirectory(cwd, true);
+  return results[0] ?? null;
+}
+
+/**
+ * Extract the first DSN from file content.
+ * Used by cache verification to check if a DSN is still present in a file.
+ *
+ * @param content - File content
+ * @returns First DSN found or null
+ */
+export function extractFirstDsnFromContent(content: string): string | null {
+  const dsns = extractDsnsFromContent(content);
+  return dsns[0] ?? null;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Internal: Line Processing
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Check if a line is commented out based on common comment prefixes.
+ */
+function isCommentedLine(trimmedLine: string): boolean {
+  for (const prefix of COMMENT_PREFIXES) {
+    if (trimmedLine.startsWith(prefix)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Validate that a DSN has a valid Sentry host.
+ *
+ * Valid hosts are:
+ * - SaaS: *.sentry.io (e.g., o123.ingest.us.sentry.io)
+ * - Self-hosted: Host from SENTRY_URL environment variable
+ */
+function isValidDsnHost(dsn: string): boolean {
+  const parsed = parseDsn(dsn);
+  if (!parsed) {
+    return false;
+  }
+
+  // SaaS DSN
+  if (parsed.host.endsWith(".sentry.io")) {
+    return true;
+  }
+
+  // Self-hosted: check SENTRY_URL environment variable
+  const sentryUrl = process.env.SENTRY_URL;
+  if (sentryUrl) {
+    try {
+      const url = new URL(sentryUrl);
+      if (parsed.host === url.host) {
+        return true;
+      }
+    } catch {
+      // Invalid SENTRY_URL, ignore
+    }
+  }
+
+  return false;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Internal: File Collection
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Load .gitignore from a directory and create an ignore instance.
+ */
+async function loadGitignore(cwd: string): Promise<Ignore> {
+  const ig = ignore();
+
+  try {
+    const gitignorePath = join(cwd, ".gitignore");
+    const content = await Bun.file(gitignorePath).text();
+    ig.add(content);
+  } catch {
+    // No .gitignore, use empty ignore instance
+  }
+
+  return ig;
+}
+
+/**
+ * Check if a file should be scanned based on its extension.
+ */
+function shouldScanFile(filename: string): boolean {
+  const lastDot = filename.lastIndexOf(".");
+  if (lastDot === -1) {
+    return false;
+  }
+  const ext = filename.slice(lastDot);
+  return TEXT_EXTENSIONS.has(ext);
+}
+
+/**
+ * Recursively collect files to scan from a directory.
+ *
+ * @param options - Collection options (cwd, dir, ig, depth)
+ * @returns Array of file paths relative to cwd
+ */
+async function collectFiles(options: CollectFilesOptions): Promise<string[]> {
+  const { cwd, dir, ig, depth } = options;
+
+  if (depth > MAX_SCAN_DEPTH) {
+    return [];
+  }
+
+  const files: string[] = [];
+  const entries = await readdir(dir, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const entryPath = join(dir, entry.name);
+    const relativePath = relative(cwd, entryPath);
+
+    // Skip always-skip directories
+    if (entry.isDirectory() && ALWAYS_SKIP_DIRS.has(entry.name)) {
+      continue;
+    }
+
+    // Skip gitignored paths
+    if (ig.ignores(relativePath)) {
+      continue;
+    }
+
+    if (entry.isDirectory()) {
+      const subFiles = await collectFiles({
+        cwd,
+        dir: entryPath,
+        ig,
+        depth: depth + 1,
+      });
+      files.push(...subFiles);
+    } else if (entry.isFile() && shouldScanFile(entry.name)) {
+      files.push(relativePath);
+    }
+  }
+
+  return files;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Internal: File Processing
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Process a single file and extract DSNs.
+ *
+ * @param cwd - Root directory
+ * @param relativePath - Path relative to cwd
+ * @param stopOnFirst - Whether to stop after finding the first DSN
+ * @returns Array of detected DSNs (may be empty)
+ */
+async function processFile(
+  cwd: string,
+  relativePath: string,
+  stopOnFirst: boolean
+): Promise<DetectedDsn[]> {
+  const filepath = join(cwd, relativePath);
+
+  try {
+    const file = Bun.file(filepath);
+
+    // Skip large files
+    const fileSize = file.size;
+    if (fileSize > MAX_FILE_SIZE) {
+      return [];
+    }
+
+    const content = await file.text();
+    const dsnStrings = extractDsnsFromContent(content);
+
+    if (dsnStrings.length === 0) {
+      return [];
+    }
+
+    const results: DetectedDsn[] = [];
+    const packagePath = inferPackagePath(relativePath);
+
+    for (const dsnString of dsnStrings) {
+      const detected = createDetectedDsn(
+        dsnString,
+        "code",
+        relativePath,
+        packagePath
+      );
+      if (detected) {
+        results.push(detected);
+        if (stopOnFirst) {
+          return results;
+        }
+      }
+    }
+
+    return results;
+  } catch {
+    // Skip files we can't read
+    return [];
+  }
+}
+
+/**
+ * Scan files concurrently and collect DSNs.
+ *
+ * @param cwd - Root directory
+ * @param files - Files to scan (relative paths)
+ * @param stopOnFirst - Whether to stop after finding the first DSN
+ * @returns Array of detected DSNs and count of files scanned
+ */
+async function scanFilesForDsns(
+  cwd: string,
+  files: string[],
+  stopOnFirst: boolean
+): Promise<{ results: DetectedDsn[]; filesScanned: number }> {
+  const limit = pLimit(CONCURRENCY_LIMIT);
+  const results: DetectedDsn[] = [];
+  const seenDsns = new Set<string>();
+  let filesScanned = 0;
+  let earlyExit = false;
+
+  const tasks = files.map((file) =>
+    limit(async () => {
+      // Check if we should stop early
+      if (earlyExit) {
+        return;
+      }
+
+      filesScanned += 1;
+      const dsns = await processFile(cwd, file, stopOnFirst);
+
+      for (const dsn of dsns) {
+        // Deduplicate by raw DSN string
+        if (!seenDsns.has(dsn.raw)) {
+          seenDsns.add(dsn.raw);
+          results.push(dsn);
+
+          if (stopOnFirst) {
+            earlyExit = true;
+            // Clear pending tasks
+            limit.clearQueue();
+            return;
+          }
+        }
+      }
+    })
+  );
+
+  await Promise.all(tasks);
+
+  return { results, filesScanned };
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Internal: Main Scanner
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Main scan implementation with Sentry performance tracing.
+ */
+function scanDirectory(
+  cwd: string,
+  stopOnFirst: boolean
+): Promise<DetectedDsn[]> {
+  return Sentry.startSpan(
+    {
+      name: "scanCodeForDsns",
+      op: "dsn.detect.code",
+      attributes: {
+        "dsn.scan_dir": cwd,
+        "dsn.stop_on_first": stopOnFirst,
+        "dsn.max_depth": MAX_SCAN_DEPTH,
+      },
+      onlyIfParent: true,
+    },
+    async (span) => {
+      // Load gitignore
+      const ig = await loadGitignore(cwd);
+
+      // Collect all files to scan
+      let files: string[];
+      try {
+        files = await collectFiles({ cwd, dir: cwd, ig, depth: 0 });
+      } catch {
+        // Directory might not exist or be readable
+        span.setStatus({ code: 2, message: "Directory scan failed" });
+        return [];
+      }
+
+      span.setAttribute("dsn.files_collected", files.length);
+
+      if (files.length === 0) {
+        span.setStatus({ code: 1 });
+        return [];
+      }
+
+      // Scan files
+      const { results, filesScanned } = await scanFilesForDsns(
+        cwd,
+        files,
+        stopOnFirst
+      );
+
+      span.setAttributes({
+        "dsn.files_scanned": filesScanned,
+        "dsn.dsns_found": results.length,
+      });
+      span.setStatus({ code: 1 });
+
+      return results;
+    }
+  );
+}
diff --git a/src/lib/dsn/detector.ts b/src/lib/dsn/detector.ts
index ae41defa..dd47a50c 100644
--- a/src/lib/dsn/detector.ts
+++ b/src/lib/dsn/detector.ts
@@ -14,17 +14,17 @@
 
 import { join, relative } from "node:path";
 import { getCachedDsn, setCachedDsn } from "../db/dsn-cache.js";
+import {
+  extractFirstDsnFromContent,
+  scanCodeForDsns,
+  scanCodeForFirstDsn,
+} from "./code-scanner.js";
 import { detectFromEnv, SENTRY_DSN_ENV } from "./env.js";
 import {
   detectFromAllEnvFiles,
   detectFromEnvFiles,
   extractDsnFromEnvContent,
 } from "./env-file.js";
-import {
-  detectAllFromCode,
-  detectFromCode,
-  getDetectorForFile,
-} from "./languages/index.js";
 import { createDetectedDsn, parseDsn } from "./parser.js";
 import { findProjectRoot } from "./project-root.js";
 import type {
@@ -150,7 +150,7 @@ export async function detectAllDsns(cwd: string): Promise<DsnDetectionResult> {
   }
 
   // 1. Check all code files from project root
-  const codeDsns = await detectAllFromCode(projectRoot);
+  const codeDsns = await scanCodeForDsns(projectRoot);
   for (const dsn of codeDsns) {
     addDsn(dsn);
   }
@@ -208,11 +208,7 @@ async function verifyCachedDsn(
 
   try {
     const content = await Bun.file(filePath).text();
-    const foundDsn = extractDsnFromContent(
-      content,
-      cached.source,
-      cached.sourcePath
-    );
+    const foundDsn = extractDsnFromContent(content, cached.source);
 
     if (foundDsn === cached.dsn) {
       // Same DSN - cache is valid!
@@ -231,27 +227,21 @@ async function verifyCachedDsn(
 }
 
 /**
- * Extract DSN from content based on source type and file path.
+ * Extract DSN from content based on source type.
  *
  * @param content - File content
  * @param source - Source type (env_file, code, etc.)
- * @param sourcePath - Path to the file (used to determine language for code files)
  */
 function extractDsnFromContent(
   content: string,
-  source: DsnSource,
-  sourcePath?: string
+  source: DsnSource
 ): string | null {
   switch (source) {
     case "env_file":
       return extractDsnFromEnvContent(content);
     case "code": {
-      if (!sourcePath) {
-        return null;
-      }
-      // Find the right language detector based on file extension
-      const detector = getDetectorForFile(sourcePath);
-      return detector?.extractDsn(content) ?? null;
+      // Use language-agnostic DSN extraction
+      return extractFirstDsnFromContent(content);
     }
     default:
       return null;
@@ -272,7 +262,7 @@ function extractDsnFromContent(
  */
 async function fullScanFirst(cwd: string): Promise<DetectedDsn | null> {
   // 1. Search source code first (explicit DSN = highest priority)
-  const codeDsn = await detectFromCode(cwd);
+  const codeDsn = await scanCodeForFirstDsn(cwd);
   if (codeDsn) {
     return codeDsn;
   }
diff --git a/src/lib/dsn/languages/go.ts b/src/lib/dsn/languages/go.ts
deleted file mode 100644
index bc3f588a..00000000
--- a/src/lib/dsn/languages/go.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-/**
- * Go DSN Detection
- *
- * Detects DSN from Go source code patterns.
- * Looks for sentry.Init(sentry.ClientOptions{Dsn: "..."}) and similar patterns.
- */
-
-import type { LanguageDetector } from "./types.js";
-
-/**
- * Regex pattern for DSN in Go struct initialization.
- * Matches: Dsn: "https://...@..." in sentry.ClientOptions{}
- */
-const DSN_PATTERN_STRUCT = /Dsn:\s*["'](https?:\/\/[^"']+@[^"']+)["']/s;
-
-/**
- * Generic pattern for dsn assignment
- * Matches: dsn := "..." or dsn = "..."
- */
-const DSN_PATTERN_ASSIGN = /dsn\s*:?=\s*["`](https?:\/\/[^"`]+@[^"`]+)["`]/is;
-
-/**
- * Extract DSN string from Go code content.
- *
- * @param content - Source code content
- * @returns DSN string or null if not found
- */
-export function extractDsnFromGo(content: string): string | null {
-  // Try struct field pattern first (most common)
-  const structMatch = content.match(DSN_PATTERN_STRUCT);
-  if (structMatch?.[1]) {
-    return structMatch[1];
-  }
-
-  // Try assignment pattern
-  const assignMatch = content.match(DSN_PATTERN_ASSIGN);
-  if (assignMatch?.[1]) {
-    return assignMatch[1];
-  }
-
-  return null;
-}
-
-/**
- * Go language detector.
- */
-export const goDetector: LanguageDetector = {
-  name: "Go",
-  extensions: [".go"],
-  skipDirs: ["vendor", ".git", "testdata"],
-  extractDsn: extractDsnFromGo,
-};
diff --git a/src/lib/dsn/languages/index.ts b/src/lib/dsn/languages/index.ts
deleted file mode 100644
index e95d280b..00000000
--- a/src/lib/dsn/languages/index.ts
+++ /dev/null
@@ -1,274 +0,0 @@
-/**
- * Language Detection Registry
- *
- * Unified scanner for detecting DSN from source code across all supported languages.
- * Uses a registry of language detectors to scan files by extension.
- *
- * Scans with depth limiting (default 2 levels) to avoid deep recursion.
- *
- * ## Adding a New Language
- *
- * 1. Create `{lang}.ts` implementing `LanguageDetector`
- * 2. Import and add to `languageDetectors` array below
- * 3. Add tests in `test/lib/dsn/languages/{lang}.test.ts`
- *
- * @example
- * ```typescript
- * // languages/rust.ts
- * export const rustDetector: LanguageDetector = {
- *   name: "Rust",
- *   extensions: [".rs"],
- *   skipDirs: ["target"],
- *   extractDsn: (content) => { ... }
- * };
- * ```
- */
-
-import { extname, join } from "node:path";
-// biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
-import * as Sentry from "@sentry/bun";
-import { createDetectedDsn, inferPackagePath } from "../parser.js";
-import type { DetectedDsn } from "../types.js";
-import { goDetector } from "./go.js";
-import { javaDetector } from "./java.js";
-import { javascriptDetector } from "./javascript.js";
-import { phpDetector } from "./php.js";
-import { pythonDetector } from "./python.js";
-import { rubyDetector } from "./ruby.js";
-import type { LanguageDetector } from "./types.js";
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Registry
-// ─────────────────────────────────────────────────────────────────────────────
-
-/**
- * All supported language detectors.
- *
- * Order matters for performance - most common languages first.
- * Add new detectors here after creating the detector file.
- */
-export const languageDetectors: LanguageDetector[] = [
-  javascriptDetector,
-  pythonDetector,
-  phpDetector,
-  rubyDetector,
-  goDetector,
-  javaDetector,
-];
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Derived Configuration
-// ─────────────────────────────────────────────────────────────────────────────
-
-/** Map of file extension to detector for fast lookup */
-const extensionToDetector = new Map<string, LanguageDetector>();
-for (const detector of languageDetectors) {
-  for (const ext of detector.extensions) {
-    extensionToDetector.set(ext, detector);
-  }
-}
-
-/** Combined set of all skip directories from all detectors */
-const allSkipDirs = new Set<string>();
-for (const detector of languageDetectors) {
-  for (const dir of detector.skipDirs) {
-    allSkipDirs.add(dir);
-  }
-}
-
-/** All file extensions to scan */
-const allExtensions = languageDetectors.flatMap((d) => d.extensions);
-
-/** Glob pattern matching all supported file extensions */
-const globPattern = `**/*{${allExtensions.join(",")}}`;
-const codeGlob = new Bun.Glob(globPattern);
-
-/**
- * Maximum depth to scan from project root.
- * Depth 0 = files in root directory
- * Depth 1 = files in first-level subdirectories
- * Depth 2 = files in second-level subdirectories
- */
-const MAX_SCAN_DEPTH = 2;
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Public API
-// ─────────────────────────────────────────────────────────────────────────────
-
-/**
- * Get the appropriate detector for a file based on its extension.
- *
- * Used by cache verification to extract DSN from a specific file.
- *
- * @param filepath - File path to get detector for
- * @returns The matching detector, or undefined if no detector handles this extension
- */
-export function getDetectorForFile(
-  filepath: string
-): LanguageDetector | undefined {
-  const ext = extname(filepath);
-  return extensionToDetector.get(ext);
-}
-
-/**
- * Detect DSN from source code files in a directory.
- *
- * Scans all supported languages and returns the first DSN found.
- * This is the fast path for single-project detection.
- *
- * @param cwd - Directory to search in
- * @returns First detected DSN or null if not found
- */
-export async function detectFromCode(cwd: string): Promise<DetectedDsn | null> {
-  const results = await scanCodeFiles(cwd, true);
-  return results[0] ?? null;
-}
-
-/**
- * Detect DSN from ALL source code files.
- *
- * Unlike detectFromCode, this doesn't stop at the first match.
- * Useful for monorepos with multiple Sentry projects.
- *
- * @param cwd - Directory to search in
- * @returns Array of all detected DSNs with packagePath inferred
- */
-export function detectAllFromCode(cwd: string): Promise<DetectedDsn[]> {
-  return scanCodeFiles(cwd, false);
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Internal
-// ─────────────────────────────────────────────────────────────────────────────
-
-/**
- * Get the depth of a file path (number of directory levels).
- * Files in the root have depth 0, first-level subdirs have depth 1, etc.
- *
- * @param filepath - Relative file path
- * @returns Depth level (0 for root files)
- */
-function getPathDepth(filepath: string): number {
-  const parts = filepath.split("/");
-  // Depth is number of directory parts (excluding the filename)
-  return parts.length - 1;
-}
-
-/**
- * Check if a path should be skipped during scanning.
- *
- * Skips paths that:
- * - Exceed the maximum scan depth
- * - Contain a known skip directory (node_modules, dist, etc.)
- *
- * @param filepath - Relative file path to check
- * @returns True if the path should be skipped
- */
-function shouldSkipPath(filepath: string): boolean {
-  // Check depth first (fast reject)
-  const depth = getPathDepth(filepath);
-  if (depth > MAX_SCAN_DEPTH) {
-    return true;
-  }
-
-  // Check for skip directories
-  const parts = filepath.split("/");
-  return parts.some((part) => allSkipDirs.has(part));
-}
-
-/**
- * Process a single code file and extract DSN if present.
- *
- * @param cwd - Base directory
- * @param relativePath - Relative path to the file
- * @returns Detected DSN or null
- */
-async function processCodeFile(
-  cwd: string,
-  relativePath: string
-): Promise<DetectedDsn | null> {
-  const detector = getDetectorForFile(relativePath);
-  if (!detector) {
-    return null;
-  }
-
-  const filepath = join(cwd, relativePath);
-
-  try {
-    const content = await Bun.file(filepath).text();
-    const dsn = detector.extractDsn(content);
-
-    if (!dsn) {
-      return null;
-    }
-
-    const packagePath = inferPackagePath(relativePath);
-    return createDetectedDsn(dsn, "code", relativePath, packagePath);
-  } catch {
-    // Skip files we can't read
-    return null;
-  }
-}
-
-/**
- * Scan code files for DSNs with Sentry performance tracing.
- *
- * @param cwd - Directory to search in
- * @param stopOnFirst - Whether to stop after first match
- * @returns Array of detected DSNs
- */
-function scanCodeFiles(
-  cwd: string,
-  stopOnFirst: boolean
-): Promise<DetectedDsn[]> {
-  return Sentry.startSpan(
-    {
-      name: "scanCodeFiles",
-      op: "dsn.detect.code",
-      attributes: {
-        "dsn.scan_dir": cwd,
-        "dsn.stop_on_first": stopOnFirst,
-        "dsn.max_depth": MAX_SCAN_DEPTH,
-      },
-      onlyIfParent: true,
-    },
-    async (span) => {
-      const results: DetectedDsn[] = [];
-      let filesScanned = 0;
-      let filesSkipped = 0;
-
-      for await (const relativePath of codeGlob.scan({
-        cwd,
-        onlyFiles: true,
-      })) {
-        if (shouldSkipPath(relativePath)) {
-          filesSkipped += 1;
-          continue;
-        }
-
-        filesScanned += 1;
-        const detected = await processCodeFile(cwd, relativePath);
-        if (detected) {
-          results.push(detected);
-          if (stopOnFirst) {
-            span.setAttributes({
-              "dsn.files_scanned": filesScanned,
-              "dsn.files_skipped": filesSkipped,
-              "dsn.dsns_found": results.length,
-            });
-            span.setStatus({ code: 1 });
-            return results;
-          }
-        }
-      }
-
-      span.setAttributes({
-        "dsn.files_scanned": filesScanned,
-        "dsn.files_skipped": filesSkipped,
-        "dsn.dsns_found": results.length,
-      });
-      span.setStatus({ code: 1 });
-      return results;
-    }
-  );
-}
diff --git a/src/lib/dsn/languages/java.ts b/src/lib/dsn/languages/java.ts
deleted file mode 100644
index ef36386b..00000000
--- a/src/lib/dsn/languages/java.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-/**
- * Java/Kotlin DSN Detection
- *
- * Detects DSN from Java and Kotlin source code patterns.
- * Also checks sentry.properties files.
- * Looks for options.setDsn("...") and dsn=... patterns.
- */
-
-import type { LanguageDetector } from "./types.js";
-
-/**
- * Regex for Java/Kotlin code: options.setDsn("...")
- */
-const DSN_PATTERN_SET_DSN = /\.setDsn\s*\(\s*["']([^"']+)["']\s*\)/s;
-
-/**
- * Regex for sentry.properties file: dsn=...
- */
-const DSN_PATTERN_PROPERTIES = /^dsn\s*=\s*(.+)$/m;
-
-/**
- * Generic pattern for DSN in annotations or config
- * Matches: dsn = "..." or "dsn", "..."
- */
-const DSN_PATTERN_GENERIC =
-  /["']?dsn["']?\s*[=,]\s*["'](https?:\/\/[^"']+@[^"']+)["']/s;
-
-/**
- * Extract DSN string from Java/Kotlin code or properties content.
- *
- * @param content - Source code or properties content
- * @returns DSN string or null if not found
- */
-export function extractDsnFromJava(content: string): string | null {
-  // Try setDsn() pattern first (most common in Java)
-  const setDsnMatch = content.match(DSN_PATTERN_SET_DSN);
-  if (setDsnMatch?.[1]) {
-    return setDsnMatch[1];
-  }
-
-  // Try properties file pattern (dsn=...)
-  const propsMatch = content.match(DSN_PATTERN_PROPERTIES);
-  if (propsMatch?.[1]) {
-    const dsn = propsMatch[1].trim();
-    // Validate it looks like a DSN
-    if (dsn.startsWith("https://") && dsn.includes("@")) {
-      return dsn;
-    }
-  }
-
-  // Try generic pattern
-  const genericMatch = content.match(DSN_PATTERN_GENERIC);
-  if (genericMatch?.[1]) {
-    return genericMatch[1];
-  }
-
-  return null;
-}
-
-/**
- * Java/Kotlin language detector.
- */
-export const javaDetector: LanguageDetector = {
-  name: "Java",
-  extensions: [".java", ".kt", ".properties"],
-  skipDirs: [
-    "target",
-    "build",
-    ".gradle",
-    ".idea",
-    ".git",
-    "out",
-    "bin",
-    ".mvn",
-  ],
-  extractDsn: extractDsnFromJava,
-};
diff --git a/src/lib/dsn/languages/javascript.ts b/src/lib/dsn/languages/javascript.ts
deleted file mode 100644
index 43a90726..00000000
--- a/src/lib/dsn/languages/javascript.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-/**
- * JavaScript/TypeScript DSN Detection
- *
- * Detects DSN from JavaScript and TypeScript source code patterns.
- * Looks for Sentry.init({ dsn: "..." }) and similar patterns.
- */
-
-import type { LanguageDetector } from "./types.js";
-
-/**
- * Regex patterns for extracting DSN from code.
- * DSN_PATTERN_INIT: Matches Sentry.init({ dsn: "..." })
- * DSN_PATTERN_GENERIC: Matches any dsn: "https://..." pattern
- */
-const DSN_PATTERN_INIT =
-  /Sentry\.init\s*\(\s*\{[^}]*dsn\s*:\s*["'`]([^"'`]+)["'`]/s;
-const DSN_PATTERN_GENERIC = /dsn\s*:\s*["'`](https?:\/\/[^"'`]+@[^"'`]+)["'`]/s;
-
-/**
- * Extract DSN string from JavaScript/TypeScript code content.
- *
- * @param content - Source code content
- * @returns DSN string or null if not found
- */
-export function extractDsnFromCode(content: string): string | null {
-  // Try Sentry.init pattern first (more specific)
-  const initMatch = content.match(DSN_PATTERN_INIT);
-  if (initMatch?.[1]) {
-    return initMatch[1];
-  }
-
-  // Try generic dsn: "..." pattern
-  const genericMatch = content.match(DSN_PATTERN_GENERIC);
-  if (genericMatch?.[1]) {
-    return genericMatch[1];
-  }
-
-  return null;
-}
-
-/**
- * JavaScript/TypeScript language detector.
- */
-export const javascriptDetector: LanguageDetector = {
-  name: "JavaScript",
-  extensions: [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"],
-  skipDirs: [
-    "node_modules",
-    ".git",
-    "dist",
-    "build",
-    ".next",
-    ".nuxt",
-    ".output",
-    "coverage",
-    ".turbo",
-    ".cache",
-    ".vercel",
-    ".netlify",
-  ],
-  extractDsn: extractDsnFromCode,
-};
diff --git a/src/lib/dsn/languages/php.ts b/src/lib/dsn/languages/php.ts
deleted file mode 100644
index 23188851..00000000
--- a/src/lib/dsn/languages/php.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * PHP DSN Detection
- *
- * Detects DSN from PHP source code patterns.
- * Looks for \Sentry\init(['dsn' => '...']) and similar patterns.
- */
-
-import type { LanguageDetector } from "./types.js";
-
-/**
- * Regex patterns for extracting DSN from PHP code.
- * Matches: \Sentry\init(['dsn' => '...']) or Sentry\init(["dsn" => "..."])
- */
-const DSN_PATTERN_INIT =
-  /\\?Sentry\\init\s*\(\s*\[[^\]]*['"]dsn['"]\s*=>\s*['"]([^'"]+)['"]/s;
-
-/**
- * Generic pattern for 'dsn' => '...' in PHP arrays
- */
-const DSN_PATTERN_GENERIC =
-  /['"]dsn['"]\s*=>\s*['"](https?:\/\/[^'"]+@[^'"]+)['"]/s;
-
-/**
- * Extract DSN string from PHP code content.
- *
- * @param content - Source code content
- * @returns DSN string or null if not found
- */
-export function extractDsnFromPhp(content: string): string | null {
-  // Try Sentry\init pattern first (more specific)
-  const initMatch = content.match(DSN_PATTERN_INIT);
-  if (initMatch?.[1]) {
-    return initMatch[1];
-  }
-
-  // Try generic 'dsn' => '...' pattern
-  const genericMatch = content.match(DSN_PATTERN_GENERIC);
-  if (genericMatch?.[1]) {
-    return genericMatch[1];
-  }
-
-  return null;
-}
-
-/**
- * PHP language detector.
- */
-export const phpDetector: LanguageDetector = {
-  name: "PHP",
-  extensions: [".php"],
-  skipDirs: ["vendor", ".git", "cache", "storage/framework"],
-  extractDsn: extractDsnFromPhp,
-};
diff --git a/src/lib/dsn/languages/python.ts b/src/lib/dsn/languages/python.ts
deleted file mode 100644
index e95debc4..00000000
--- a/src/lib/dsn/languages/python.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * Python DSN Detection
- *
- * Detects DSN from Python source code patterns.
- * Looks for sentry_sdk.init(dsn="...") and similar patterns.
- */
-
-import type { LanguageDetector } from "./types.js";
-
-/**
- * Regex patterns for extracting DSN from Python code.
- * Matches: sentry_sdk.init(dsn="...") or sentry_sdk.init(dsn='...')
- * Also matches keyword argument style: sentry_sdk.init(\n    dsn="...",\n)
- */
-const DSN_PATTERN_INIT =
-  /sentry_sdk\.init\s*\([^)]*dsn\s*=\s*["']([^"']+)["']/s;
-
-/**
- * Generic pattern for dsn= in Python (catches dict-style configs)
- * Matches: "dsn": "..." or 'dsn': '...' or dsn="..." or dsn='...'
- */
-const DSN_PATTERN_GENERIC =
-  /["']?dsn["']?\s*[:=]\s*["'](https?:\/\/[^"']+@[^"']+)["']/s;
-
-/**
- * Extract DSN string from Python code content.
- *
- * @param content - Source code content
- * @returns DSN string or null if not found
- */
-export function extractDsnFromPython(content: string): string | null {
-  // Try sentry_sdk.init pattern first (more specific)
-  const initMatch = content.match(DSN_PATTERN_INIT);
-  if (initMatch?.[1]) {
-    return initMatch[1];
-  }
-
-  // Try generic dsn pattern
-  const genericMatch = content.match(DSN_PATTERN_GENERIC);
-  if (genericMatch?.[1]) {
-    return genericMatch[1];
-  }
-
-  return null;
-}
-
-/**
- * Python language detector.
- */
-export const pythonDetector: LanguageDetector = {
-  name: "Python",
-  extensions: [".py"],
-  skipDirs: [
-    "venv",
-    ".venv",
-    "env",
-    ".env",
-    "__pycache__",
-    ".tox",
-    ".nox",
-    "site-packages",
-    ".pytest_cache",
-    ".mypy_cache",
-    ".ruff_cache",
-    "dist",
-    "build",
-  ],
-  extractDsn: extractDsnFromPython,
-};
diff --git a/src/lib/dsn/languages/ruby.ts b/src/lib/dsn/languages/ruby.ts
deleted file mode 100644
index 13f2d859..00000000
--- a/src/lib/dsn/languages/ruby.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-/**
- * Ruby DSN Detection
- *
- * Detects DSN from Ruby source code patterns.
- * Looks for Sentry.init { |config| config.dsn = '...' } and similar patterns.
- */
-
-import type { LanguageDetector } from "./types.js";
-
-/**
- * Regex patterns for extracting DSN from Ruby code.
- * Matches: config.dsn = '...' or config.dsn = "..."
- */
-const DSN_PATTERN_CONFIG = /config\.dsn\s*=\s*['"]([^'"]+)['"]/s;
-
-/**
- * Generic pattern for dsn in Ruby hashes
- * Matches: dsn: '...' or :dsn => '...'
- */
-const DSN_PATTERN_HASH =
-  /(?:dsn:|:dsn\s*=>)\s*['"](https?:\/\/[^'"]+@[^'"]+)['"]/s;
-
-/**
- * Extract DSN string from Ruby code content.
- *
- * @param content - Source code content
- * @returns DSN string or null if not found
- */
-export function extractDsnFromRuby(content: string): string | null {
-  // Try config.dsn pattern first (most common in Sentry.init block)
-  const configMatch = content.match(DSN_PATTERN_CONFIG);
-  if (configMatch?.[1]) {
-    return configMatch[1];
-  }
-
-  // Try hash-style pattern
-  const hashMatch = content.match(DSN_PATTERN_HASH);
-  if (hashMatch?.[1]) {
-    return hashMatch[1];
-  }
-
-  return null;
-}
-
-/**
- * Ruby language detector.
- */
-export const rubyDetector: LanguageDetector = {
-  name: "Ruby",
-  extensions: [".rb"],
-  skipDirs: [
-    "vendor/bundle",
-    ".bundle",
-    "tmp",
-    "log",
-    ".git",
-    "coverage",
-    "pkg",
-  ],
-  extractDsn: extractDsnFromRuby,
-};
diff --git a/src/lib/dsn/languages/types.ts b/src/lib/dsn/languages/types.ts
deleted file mode 100644
index 6bbd22de..00000000
--- a/src/lib/dsn/languages/types.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-/**
- * Language Detector Interface
- *
- * Common interface for all language-specific DSN detectors.
- * Each language implements this interface to detect DSNs from its source files.
- */
-
-/**
- * Language-specific DSN detector.
- * Each supported language provides a detector implementing this type.
- */
-export type LanguageDetector = {
-  /** Display name for the language (e.g., "Python", "JavaScript") */
-  name: string;
-
-  /** File extensions to scan (e.g., [".py"], [".ts", ".tsx"]) */
-  extensions: string[];
-
-  /** Directories to skip when scanning (e.g., ["node_modules", "venv"]) */
-  skipDirs: string[];
-
-  /**
-   * Extract DSN string from file content.
-   *
-   * @param content - File content to search
-   * @returns DSN string if found, null otherwise
-   */
-  extractDsn: (content: string) => string | null;
-};
diff --git a/test/lib/dsn/code-scanner.test.ts b/test/lib/dsn/code-scanner.test.ts
new file mode 100644
index 00000000..bb6e79c3
--- /dev/null
+++ b/test/lib/dsn/code-scanner.test.ts
@@ -0,0 +1,336 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+  extractDsnsFromContent,
+  extractFirstDsnFromContent,
+  scanCodeForDsns,
+  scanCodeForFirstDsn,
+} from "../../../src/lib/dsn/code-scanner.js";
+
+describe("Code Scanner", () => {
+  const testDir = join(import.meta.dir, ".test-code-scanner");
+
+  beforeEach(() => {
+    mkdirSync(testDir, { recursive: true });
+  });
+
+  afterEach(() => {
+    rmSync(testDir, { recursive: true, force: true });
+    delete process.env.SENTRY_URL;
+  });
+
+  describe("extractDsnsFromContent", () => {
+    test("extracts DSN from JavaScript code", () => {
+      const content = `
+        Sentry.init({
+          dsn: "https://abc123@o123.ingest.sentry.io/456"
+        });
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://abc123@o123.ingest.sentry.io/456"]);
+    });
+
+    test("extracts DSN from Python code", () => {
+      const content = `
+        sentry_sdk.init(
+            dsn="https://abc123@o123.ingest.sentry.io/456"
+        )
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://abc123@o123.ingest.sentry.io/456"]);
+    });
+
+    test("extracts DSN from Go code", () => {
+      const content = `
+        sentry.Init(sentry.ClientOptions{
+          Dsn: "https://abc123@o123.ingest.sentry.io/456",
+        })
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://abc123@o123.ingest.sentry.io/456"]);
+    });
+
+    test("extracts DSN from constant assignment", () => {
+      const content = `
+        const SENTRY_DSN = "https://abc123@o123.ingest.sentry.io/456";
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://abc123@o123.ingest.sentry.io/456"]);
+    });
+
+    test("extracts multiple DSNs", () => {
+      const content = `
+        const PROD_DSN = "https://prod@o123.ingest.sentry.io/111";
+        const DEV_DSN = "https://dev@o456.ingest.sentry.io/222";
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toHaveLength(2);
+      expect(dsns).toContain("https://prod@o123.ingest.sentry.io/111");
+      expect(dsns).toContain("https://dev@o456.ingest.sentry.io/222");
+    });
+
+    test("deduplicates DSNs", () => {
+      const content = `
+        const DSN1 = "https://abc@o123.ingest.sentry.io/456";
+        const DSN2 = "https://abc@o123.ingest.sentry.io/456";
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toHaveLength(1);
+    });
+
+    test("ignores single-line comments with //", () => {
+      const content = `
+        // const DSN = "https://abc123@o123.ingest.sentry.io/456";
+        const REAL_DSN = "https://real@o456.ingest.sentry.io/789";
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://real@o456.ingest.sentry.io/789"]);
+    });
+
+    test("ignores Python/shell comments with #", () => {
+      const content = `
+        # DSN = "https://abc123@o123.ingest.sentry.io/456"
+        REAL_DSN = "https://real@o456.ingest.sentry.io/789"
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://real@o456.ingest.sentry.io/789"]);
+    });
+
+    test("ignores HTML comments with <!--", () => {
+      const content = `
+        <!-- <script>const DSN = "https://abc123@o123.ingest.sentry.io/456";</script> -->
+        <script>const DSN = "https://real@o456.ingest.sentry.io/789";</script>
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://real@o456.ingest.sentry.io/789"]);
+    });
+
+    test("ignores C-style block comment lines starting with /*", () => {
+      const content = `
+        /* const DSN = "https://abc123@o123.ingest.sentry.io/456"; */
+        const REAL_DSN = "https://real@o456.ingest.sentry.io/789";
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://real@o456.ingest.sentry.io/789"]);
+    });
+
+    test("ignores JSDoc/multi-line comment continuation lines starting with *", () => {
+      const content = `
+        /**
+         * DSN: "https://abc123@o123.ingest.sentry.io/456"
+         */
+        const REAL_DSN = "https://real@o456.ingest.sentry.io/789";
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://real@o456.ingest.sentry.io/789"]);
+    });
+
+    test("ignores SQL comments with --", () => {
+      const content = `
+        -- INSERT INTO config VALUES ('dsn', 'https://abc123@o123.ingest.sentry.io/456');
+        INSERT INTO config VALUES ('dsn', 'https://real@o456.ingest.sentry.io/789');
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://real@o456.ingest.sentry.io/789"]);
+    });
+
+    test("ignores Python triple-quote docstrings", () => {
+      const content = `
+        '''https://abc123@o123.ingest.sentry.io/456'''
+        DSN = "https://real@o456.ingest.sentry.io/789"
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://real@o456.ingest.sentry.io/789"]);
+    });
+
+    test("returns empty array for content without DSNs", () => {
+      const content = `
+        const config = { debug: true };
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual([]);
+    });
+
+    test("only accepts *.sentry.io hosts for SaaS", () => {
+      const content = `
+        const REAL = "https://abc@o123.ingest.sentry.io/456";
+        const FAKE = "https://abc@fake.example.com/456";
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://abc@o123.ingest.sentry.io/456"]);
+    });
+
+    test("accepts self-hosted DSNs when SENTRY_URL is set", () => {
+      process.env.SENTRY_URL = "https://sentry.mycompany.com:9000";
+      const content = `
+        const DSN = "https://abc@sentry.mycompany.com:9000/123";
+      `;
+      const dsns = extractDsnsFromContent(content);
+      expect(dsns).toEqual(["https://abc@sentry.mycompany.com:9000/123"]);
+    });
+  });
+
+  describe("extractFirstDsnFromContent", () => {
+    test("returns first DSN", () => {
+      const content = `
+        const DSN1 = "https://first@o123.ingest.sentry.io/111";
+        const DSN2 = "https://second@o456.ingest.sentry.io/222";
+      `;
+      const dsn = extractFirstDsnFromContent(content);
+      expect(dsn).toBe("https://first@o123.ingest.sentry.io/111");
+    });
+
+    test("returns null when no DSN found", () => {
+      const dsn = extractFirstDsnFromContent("no dsn here");
+      expect(dsn).toBeNull();
+    });
+  });
+
+  describe("scanCodeForFirstDsn", () => {
+    test("finds DSN in root file", async () => {
+      writeFileSync(
+        join(testDir, "config.ts"),
+        'const DSN = "https://abc@o123.ingest.sentry.io/456";'
+      );
+
+      const result = await scanCodeForFirstDsn(testDir);
+      expect(result?.raw).toBe("https://abc@o123.ingest.sentry.io/456");
+      expect(result?.source).toBe("code");
+      expect(result?.sourcePath).toBe("config.ts");
+    });
+
+    test("finds DSN in subdirectory", async () => {
+      mkdirSync(join(testDir, "src"), { recursive: true });
+      writeFileSync(
+        join(testDir, "src/sentry.ts"),
+        'Sentry.init({ dsn: "https://abc@o123.ingest.sentry.io/456" });'
+      );
+
+      const result = await scanCodeForFirstDsn(testDir);
+      expect(result?.raw).toBe("https://abc@o123.ingest.sentry.io/456");
+      expect(result?.sourcePath).toBe("src/sentry.ts");
+    });
+
+    test("returns null when no DSN found", async () => {
+      writeFileSync(join(testDir, "index.ts"), "console.log('hello');");
+
+      const result = await scanCodeForFirstDsn(testDir);
+      expect(result).toBeNull();
+    });
+
+    test("skips node_modules directory", async () => {
+      mkdirSync(join(testDir, "node_modules/some-package"), {
+        recursive: true,
+      });
+      writeFileSync(
+        join(testDir, "node_modules/some-package/index.js"),
+        'const DSN = "https://abc@o123.ingest.sentry.io/456";'
+      );
+
+      const result = await scanCodeForFirstDsn(testDir);
+      expect(result).toBeNull();
+    });
+
+    test("respects gitignore", async () => {
+      writeFileSync(join(testDir, ".gitignore"), "ignored/");
+      mkdirSync(join(testDir, "ignored"), { recursive: true });
+      writeFileSync(
+        join(testDir, "ignored/config.ts"),
+        'const DSN = "https://ignored@o123.ingest.sentry.io/456";'
+      );
+      writeFileSync(
+        join(testDir, "real.ts"),
+        'const DSN = "https://real@o456.ingest.sentry.io/789";'
+      );
+
+      const result = await scanCodeForFirstDsn(testDir);
+      expect(result?.raw).toBe("https://real@o456.ingest.sentry.io/789");
+    });
+
+    test("infers packagePath for monorepo structure", async () => {
+      // Use depth 2 (packages/frontend/sentry.ts) to stay within MAX_SCAN_DEPTH
+      mkdirSync(join(testDir, "packages/frontend"), { recursive: true });
+      writeFileSync(
+        join(testDir, "packages/frontend/sentry.ts"),
+        'const DSN = "https://abc@o123.ingest.sentry.io/456";'
+      );
+
+      const result = await scanCodeForFirstDsn(testDir);
+      expect(result?.packagePath).toBe("packages/frontend");
+    });
+
+    test("scans various file types", async () => {
+      // Test Python
+      writeFileSync(
+        join(testDir, "app.py"),
+        'sentry_sdk.init(dsn="https://py@o123.ingest.sentry.io/1")'
+      );
+
+      let result = await scanCodeForFirstDsn(testDir);
+      expect(result?.raw).toBe("https://py@o123.ingest.sentry.io/1");
+
+      // Clean and test Go
+      rmSync(join(testDir, "app.py"));
+      writeFileSync(
+        join(testDir, "main.go"),
+        'sentry.Init(sentry.ClientOptions{Dsn: "https://go@o123.ingest.sentry.io/2"})'
+      );
+
+      result = await scanCodeForFirstDsn(testDir);
+      expect(result?.raw).toBe("https://go@o123.ingest.sentry.io/2");
+
+      // Clean and test Ruby
+      rmSync(join(testDir, "main.go"));
+      writeFileSync(
+        join(testDir, "config.rb"),
+        'Sentry.init do |config|\n  config.dsn = "https://rb@o123.ingest.sentry.io/3"\nend'
+      );
+
+      result = await scanCodeForFirstDsn(testDir);
+      expect(result?.raw).toBe("https://rb@o123.ingest.sentry.io/3");
+    });
+  });
+
+  describe("scanCodeForDsns", () => {
+    test("finds all DSNs across multiple files", async () => {
+      mkdirSync(join(testDir, "src"), { recursive: true });
+      writeFileSync(
+        join(testDir, "src/frontend.ts"),
+        'const DSN = "https://frontend@o123.ingest.sentry.io/111";'
+      );
+      writeFileSync(
+        join(testDir, "src/backend.ts"),
+        'const DSN = "https://backend@o456.ingest.sentry.io/222";'
+      );
+
+      const results = await scanCodeForDsns(testDir);
+      expect(results).toHaveLength(2);
+
+      const dsns = results.map((r) => r.raw);
+      expect(dsns).toContain("https://frontend@o123.ingest.sentry.io/111");
+      expect(dsns).toContain("https://backend@o456.ingest.sentry.io/222");
+    });
+
+    test("deduplicates same DSN from multiple files", async () => {
+      writeFileSync(
+        join(testDir, "a.ts"),
+        'const DSN = "https://same@o123.ingest.sentry.io/456";'
+      );
+      writeFileSync(
+        join(testDir, "b.ts"),
+        'const DSN = "https://same@o123.ingest.sentry.io/456";'
+      );
+
+      const results = await scanCodeForDsns(testDir);
+      expect(results).toHaveLength(1);
+    });
+
+    test("returns empty array when no DSNs found", async () => {
+      writeFileSync(join(testDir, "index.ts"), "console.log('hello');");
+
+      const results = await scanCodeForDsns(testDir);
+      expect(results).toEqual([]);
+    });
+  });
+});
diff --git a/test/lib/dsn/languages/go.test.ts b/test/lib/dsn/languages/go.test.ts
deleted file mode 100644
index 22b8ac06..00000000
--- a/test/lib/dsn/languages/go.test.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-/**
- * Go DSN Detector Tests
- *
- * Consolidated tests for extracting DSN from Go source code.
- * Tests cover: ClientOptions struct, variable assignment, raw string, env filtering, detector config.
- */
-
-import { describe, expect, test } from "bun:test";
-import {
-  extractDsnFromGo,
-  goDetector,
-} from "../../../../src/lib/dsn/languages/go.js";
-
-const TEST_DSN = "https://abc123@o456.ingest.sentry.io/789";
-
-describe("Go DSN Detector", () => {
-  test("extracts DSN from sentry.Init with ClientOptions", () => {
-    const code = `
-package main
-
-import "github.com/getsentry/sentry-go"
-
-func main() {
-	err := sentry.Init(sentry.ClientOptions{
-		Dsn:              "${TEST_DSN}",
-		Environment:      "production",
-		TracesSampleRate: 1.0,
-	})
-}
-`;
-    expect(extractDsnFromGo(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN from variable assignment", () => {
-    const code = `
-dsn := "${TEST_DSN}"
-sentry.Init(sentry.ClientOptions{Dsn: dsn})
-`;
-    expect(extractDsnFromGo(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN with backtick raw string literal", () => {
-    const code = `
-dsn := \`${TEST_DSN}\`
-`;
-    expect(extractDsnFromGo(code)).toBe(TEST_DSN);
-  });
-
-  test("returns null for DSN from os.Getenv", () => {
-    const code = `
-sentry.Init(sentry.ClientOptions{
-	Dsn: os.Getenv("SENTRY_DSN"),
-})
-`;
-    expect(extractDsnFromGo(code)).toBeNull();
-  });
-
-  test("detector has correct configuration", () => {
-    expect(goDetector.name).toBe("Go");
-    expect(goDetector.extensions).toContain(".go");
-    expect(goDetector.skipDirs).toContain("vendor");
-    expect(goDetector.extractDsn).toBe(extractDsnFromGo);
-  });
-});
diff --git a/test/lib/dsn/languages/java.test.ts b/test/lib/dsn/languages/java.test.ts
deleted file mode 100644
index 5d7812a8..00000000
--- a/test/lib/dsn/languages/java.test.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * Java/Kotlin DSN Detector Tests
- *
- * Consolidated tests for extracting DSN from Java/Kotlin source code and properties files.
- * Tests cover: Sentry.init, properties file, Kotlin pattern, env filtering, detector config.
- */
-
-import { describe, expect, test } from "bun:test";
-import {
-  extractDsnFromJava,
-  javaDetector,
-} from "../../../../src/lib/dsn/languages/java.js";
-
-const TEST_DSN = "https://abc123@o456.ingest.sentry.io/789";
-
-describe("Java DSN Detector", () => {
-  test("extracts DSN from Sentry.init with setDsn", () => {
-    const code = `
-import io.sentry.Sentry;
-
-public class SentryConfig {
-    public static void init() {
-        Sentry.init(options -> {
-            options.setDsn("${TEST_DSN}");
-            options.setEnvironment("production");
-        });
-    }
-}
-`;
-    expect(extractDsnFromJava(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN from sentry.properties file", () => {
-    const content = `
-# Sentry configuration
-dsn=${TEST_DSN}
-environment=production
-`;
-    expect(extractDsnFromJava(content)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN from Kotlin companion object", () => {
-    const code = `
-companion object {
-    const val dsn = "${TEST_DSN}"
-}
-`;
-    expect(extractDsnFromJava(code)).toBe(TEST_DSN);
-  });
-
-  test("returns null for DSN from System.getenv", () => {
-    const code = `
-Sentry.init(options -> {
-    options.setDsn(System.getenv("SENTRY_DSN"));
-});
-`;
-    expect(extractDsnFromJava(code)).toBeNull();
-  });
-
-  test("detector has correct configuration", () => {
-    expect(javaDetector.name).toBe("Java");
-    expect(javaDetector.extensions).toContain(".java");
-    expect(javaDetector.extensions).toContain(".kt");
-    expect(javaDetector.extensions).toContain(".properties");
-    expect(javaDetector.skipDirs).toContain("target");
-    expect(javaDetector.skipDirs).toContain("build");
-    expect(javaDetector.extractDsn).toBe(extractDsnFromJava);
-  });
-});
diff --git a/test/lib/dsn/languages/javascript.test.ts b/test/lib/dsn/languages/javascript.test.ts
deleted file mode 100644
index d4175315..00000000
--- a/test/lib/dsn/languages/javascript.test.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-/**
- * JavaScript DSN Detector Tests
- *
- * Consolidated tests for extracting DSN from JavaScript/TypeScript source code.
- * Tests cover: basic init, config object, multiple DSNs, env filtering, detector config.
- */
-
-import { describe, expect, test } from "bun:test";
-import {
-  extractDsnFromCode,
-  javascriptDetector,
-} from "../../../../src/lib/dsn/languages/javascript.js";
-
-const TEST_DSN = "https://abc123@o456.ingest.sentry.io/789";
-
-describe("JavaScript DSN Detector", () => {
-  test("extracts DSN from basic Sentry.init", () => {
-    const code = `
-      import * as Sentry from "@sentry/react";
-
-      Sentry.init({
-        dsn: "${TEST_DSN}",
-        tracesSampleRate: 1.0,
-      });
-    `;
-    expect(extractDsnFromCode(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN from config object", () => {
-    const code = `
-      export const sentryConfig = {
-        dsn: "${TEST_DSN}",
-        enabled: true,
-      };
-    `;
-    expect(extractDsnFromCode(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts first DSN when multiple exist", () => {
-    const dsn2 = "https://xyz@o999.ingest.sentry.io/111";
-    const code = `
-      Sentry.init({ dsn: "${TEST_DSN}" });
-      const backup = { dsn: "${dsn2}" };
-    `;
-    expect(extractDsnFromCode(code)).toBe(TEST_DSN);
-  });
-
-  test("returns null for DSN from env variable", () => {
-    const code = `
-      Sentry.init({
-        dsn: process.env.SENTRY_DSN,
-      });
-    `;
-    expect(extractDsnFromCode(code)).toBeNull();
-  });
-
-  test("detector has correct configuration", () => {
-    expect(javascriptDetector.name).toBe("JavaScript");
-    expect(javascriptDetector.extensions).toContain(".ts");
-    expect(javascriptDetector.extensions).toContain(".js");
-    expect(javascriptDetector.skipDirs).toContain("node_modules");
-    expect(javascriptDetector.extractDsn).toBe(extractDsnFromCode);
-  });
-});
diff --git a/test/lib/dsn/languages/php.test.ts b/test/lib/dsn/languages/php.test.ts
deleted file mode 100644
index d2126fa5..00000000
--- a/test/lib/dsn/languages/php.test.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-/**
- * PHP DSN Detector Tests
- *
- * Consolidated tests for extracting DSN from PHP source code.
- * Tests cover: Sentry\init, Laravel config, multiline init, env filtering, detector config.
- */
-
-import { describe, expect, test } from "bun:test";
-import {
-  extractDsnFromPhp,
-  phpDetector,
-} from "../../../../src/lib/dsn/languages/php.js";
-
-const TEST_DSN = "https://abc123@o456.ingest.sentry.io/789";
-
-describe("PHP DSN Detector", () => {
-  test("extracts DSN from Sentry\\init", () => {
-    const code = `
-<?php
-\\Sentry\\init([
-    'dsn' => '${TEST_DSN}',
-    'environment' => 'production',
-]);
-`;
-    expect(extractDsnFromPhp(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN from Laravel config style", () => {
-    const code = `
-<?php
-return [
-    'sentry' => [
-        'dsn' => '${TEST_DSN}',
-    ],
-];
-`;
-    expect(extractDsnFromPhp(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN with double quotes", () => {
-    const code = `
-<?php
-\\Sentry\\init(["dsn" => "${TEST_DSN}"]);
-`;
-    expect(extractDsnFromPhp(code)).toBe(TEST_DSN);
-  });
-
-  test("returns null for DSN from env function", () => {
-    const code = `
-<?php
-\\Sentry\\init(['dsn' => env('SENTRY_DSN')]);
-`;
-    expect(extractDsnFromPhp(code)).toBeNull();
-  });
-
-  test("detector has correct configuration", () => {
-    expect(phpDetector.name).toBe("PHP");
-    expect(phpDetector.extensions).toContain(".php");
-    expect(phpDetector.skipDirs).toContain("vendor");
-    expect(phpDetector.extractDsn).toBe(extractDsnFromPhp);
-  });
-});
diff --git a/test/lib/dsn/languages/python.test.ts b/test/lib/dsn/languages/python.test.ts
deleted file mode 100644
index 1a27128d..00000000
--- a/test/lib/dsn/languages/python.test.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * Python DSN Detector Tests
- *
- * Consolidated tests for extracting DSN from Python source code.
- * Tests cover: basic init, dict config, Django settings, env filtering, detector config.
- */
-
-import { describe, expect, test } from "bun:test";
-import {
-  extractDsnFromPython,
-  pythonDetector,
-} from "../../../../src/lib/dsn/languages/python.js";
-
-const TEST_DSN = "https://abc123@o456.ingest.sentry.io/789";
-
-describe("Python DSN Detector", () => {
-  test("extracts DSN from basic sentry_sdk.init", () => {
-    const code = `
-import sentry_sdk
-
-sentry_sdk.init(
-    dsn="${TEST_DSN}",
-    traces_sample_rate=1.0,
-)
-`;
-    expect(extractDsnFromPython(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN from dict config", () => {
-    const code = `
-SENTRY_CONFIG = {
-    "dsn": "${TEST_DSN}",
-    "environment": "production",
-}
-`;
-    expect(extractDsnFromPython(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN from Django settings style", () => {
-    const code = `
-SENTRY_DSN = "${TEST_DSN}"
-
-LOGGING = {
-    "handlers": {
-        "sentry": {
-            "dsn": "${TEST_DSN}",
-        }
-    }
-}
-`;
-    expect(extractDsnFromPython(code)).toBe(TEST_DSN);
-  });
-
-  test("returns null for DSN from env variable", () => {
-    const code = `
-import os
-sentry_sdk.init(dsn=os.environ.get("SENTRY_DSN"))
-`;
-    expect(extractDsnFromPython(code)).toBeNull();
-  });
-
-  test("detector has correct configuration", () => {
-    expect(pythonDetector.name).toBe("Python");
-    expect(pythonDetector.extensions).toContain(".py");
-    expect(pythonDetector.skipDirs).toContain("venv");
-    expect(pythonDetector.skipDirs).toContain("__pycache__");
-    expect(pythonDetector.extractDsn).toBe(extractDsnFromPython);
-  });
-});
diff --git a/test/lib/dsn/languages/ruby.test.ts b/test/lib/dsn/languages/ruby.test.ts
deleted file mode 100644
index 643c4d31..00000000
--- a/test/lib/dsn/languages/ruby.test.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-/**
- * Ruby DSN Detector Tests
- *
- * Consolidated tests for extracting DSN from Ruby source code.
- * Tests cover: Sentry.init block, Rails initializer, hash patterns, env filtering, detector config.
- */
-
-import { describe, expect, test } from "bun:test";
-import {
-  extractDsnFromRuby,
-  rubyDetector,
-} from "../../../../src/lib/dsn/languages/ruby.js";
-
-const TEST_DSN = "https://abc123@o456.ingest.sentry.io/789";
-
-describe("Ruby DSN Detector", () => {
-  test("extracts DSN from Sentry.init block", () => {
-    const code = `
-Sentry.init do |config|
-  config.dsn = '${TEST_DSN}'
-  config.traces_sample_rate = 1.0
-end
-`;
-    expect(extractDsnFromRuby(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN from Rails initializer style", () => {
-    const code = `
-Sentry.init do |config|
-  config.dsn = '${TEST_DSN}'
-  config.breadcrumbs_logger = [:active_support_logger]
-  config.traces_sample_rate = 0.5
-end
-`;
-    expect(extractDsnFromRuby(code)).toBe(TEST_DSN);
-  });
-
-  test("extracts DSN from symbol key hash", () => {
-    const code = `
-sentry_config = {
-  dsn: '${TEST_DSN}',
-  environment: 'production'
-}
-`;
-    expect(extractDsnFromRuby(code)).toBe(TEST_DSN);
-  });
-
-  test("returns null for DSN from ENV", () => {
-    const code = `
-Sentry.init do |config|
-  config.dsn = ENV['SENTRY_DSN']
-end
-`;
-    expect(extractDsnFromRuby(code)).toBeNull();
-  });
-
-  test("detector has correct configuration", () => {
-    expect(rubyDetector.name).toBe("Ruby");
-    expect(rubyDetector.extensions).toContain(".rb");
-    expect(rubyDetector.skipDirs).toContain("vendor/bundle");
-    expect(rubyDetector.extractDsn).toBe(extractDsnFromRuby);
-  });
-});

From 4c5d2f4598cba3a0557a4b0be7d7713b530ea4e2 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 14:31:19 +0000
Subject: [PATCH 03/19] style: remove ASCII art section dividers from
 code-scanner

---
 src/lib/dsn/code-scanner.ts | 28 ----------------------------
 1 file changed, 28 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index 4d0fed18..ee98beec 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -21,10 +21,6 @@ import pLimit from "p-limit";
 import { createDetectedDsn, inferPackagePath, parseDsn } from "./parser.js";
 import type { DetectedDsn } from "./types.js";
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Constants
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Maximum file size to scan (256KB).
  * Files larger than this are skipped as they're unlikely to be source files
@@ -162,10 +158,6 @@ const COMMENT_PREFIXES = ["//", "#", "--", "<!--", "/*", "*", "'''", '"""'];
 const DSN_PATTERN =
   /https?:\/\/[a-z0-9]+@[a-z0-9.-]+(?:\.sentry\.io|:[0-9]+)\/\d+/gi;
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Types
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Options for collecting files to scan.
  */
@@ -180,10 +172,6 @@ type CollectFilesOptions = {
   depth: number;
 };
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Public API
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Extract all DSN URLs from file content, filtering out commented lines.
  *
@@ -257,10 +245,6 @@ export function extractFirstDsnFromContent(content: string): string | null {
   return dsns[0] ?? null;
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Internal: Line Processing
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Check if a line is commented out based on common comment prefixes.
  */
@@ -307,10 +291,6 @@ function isValidDsnHost(dsn: string): boolean {
   return false;
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Internal: File Collection
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Load .gitignore from a directory and create an ignore instance.
  */
@@ -386,10 +366,6 @@ async function collectFiles(options: CollectFilesOptions): Promise<string[]> {
   return files;
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Internal: File Processing
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Process a single file and extract DSNs.
  *
@@ -497,10 +473,6 @@ async function scanFilesForDsns(
   return { results, filesScanned };
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Internal: Main Scanner
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Main scan implementation with Sentry performance tracing.
  */

From 8900523f6c9f12620370703c81ab2e615f2cba4a Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 14:35:35 +0000
Subject: [PATCH 04/19] fix(dsn): code DSN takes priority over env file DSN

Previously, finding a DSN in .env during walk-up would return immediately,
bypassing code scanning. Now we always do a full scan with correct priority:
code > env_file > env_var.

The .env DSN still stops the walk-up (determines project root) but doesn't
short-circuit detection.
---
 src/lib/dsn/detector.ts       | 42 +++++++++++++----------------------
 test/lib/dsn/detector.test.ts | 10 ++++-----
 2 files changed, 20 insertions(+), 32 deletions(-)

diff --git a/src/lib/dsn/detector.ts b/src/lib/dsn/detector.ts
index dd47a50c..380971f9 100644
--- a/src/lib/dsn/detector.ts
+++ b/src/lib/dsn/detector.ts
@@ -12,7 +12,7 @@
  * Priority: .env with SENTRY_DSN > code > .env files > SENTRY_DSN env var
  */
 
-import { join, relative } from "node:path";
+import { join } from "node:path";
 import { getCachedDsn, setCachedDsn } from "../db/dsn-cache.js";
 import {
   extractFirstDsnFromContent,
@@ -42,37 +42,25 @@ import type {
  * Detect DSN with project root detection and caching support.
  *
  * Algorithm:
- * 1. Find project root by walking up from cwd (checking .env for SENTRY_DSN at each level)
- * 2. If DSN found during walk-up, return immediately (fastest path)
- * 3. Check cache for project root (fast path)
- * 4. Full scan from project root with depth limiting (slow path)
+ * 1. Find project root by walking up from cwd (checks .env for SENTRY_DSN to stop walk)
+ * 2. Check cache for project root (fast path)
+ * 3. Full scan from project root with depth limiting (slow path)
+ *
+ * Priority: code > .env files > SENTRY_DSN env var
+ *
+ * Note: Finding a DSN in .env during walk-up stops the walk (determines project root)
+ * but does NOT short-circuit detection - we still scan for code DSNs which have
+ * higher priority.
  *
  * @param cwd - Directory to start searching from
  * @returns Detected DSN with source info, or null if not found
  */
 export async function detectDsn(cwd: string): Promise<DetectedDsn | null> {
-  // 1. Find project root (may find DSN in .env along the way)
-  const { projectRoot, foundDsn } = await findProjectRoot(cwd);
-
-  // 2. If DSN found during walk-up, cache and return immediately
-  if (foundDsn) {
-    // Make source path relative to project root for caching
-    const sourcePath = foundDsn.sourcePath
-      ? relative(projectRoot, join(cwd, foundDsn.sourcePath)) ||
-        foundDsn.sourcePath
-      : foundDsn.sourcePath;
-
-    await setCachedDsn(projectRoot, {
-      dsn: foundDsn.raw,
-      projectId: foundDsn.projectId,
-      orgId: foundDsn.orgId,
-      source: foundDsn.source,
-      sourcePath,
-    });
-    return foundDsn;
-  }
+  // 1. Find project root (may find DSN in .env along the way, but we don't
+  //    return it immediately - code DSNs take priority)
+  const { projectRoot } = await findProjectRoot(cwd);
 
-  // 3. Check cache for project root (fast path)
+  // 2. Check cache for project root (fast path)
   const cached = await getCachedDsn(projectRoot);
 
   if (cached) {
@@ -100,7 +88,7 @@ export async function detectDsn(cwd: string): Promise<DetectedDsn | null> {
     // Cache invalid, fall through to full scan
   }
 
-  // 4. Full scan from project root (slow path)
+  // 3. Full scan from project root (slow path)
   const detected = await fullScanFirst(projectRoot);
 
   if (detected) {
diff --git a/test/lib/dsn/detector.test.ts b/test/lib/dsn/detector.test.ts
index c7706ee0..6a75a7dd 100644
--- a/test/lib/dsn/detector.test.ts
+++ b/test/lib/dsn/detector.test.ts
@@ -99,7 +99,7 @@ describe("DSN Detector (New Module)", () => {
       expect(cached?.dsn).toBe(dsn2);
     });
 
-    test("env file DSN found during walk-up takes priority over code", async () => {
+    test("code DSN takes priority over env file", async () => {
       const envFileDsn = "https://file@o111.ingest.sentry.io/111";
       const codeDsn = "https://code@o222.ingest.sentry.io/222";
 
@@ -111,11 +111,11 @@ describe("DSN Detector (New Module)", () => {
         `Sentry.init({ dsn: "${codeDsn}" })`
       );
 
-      // With project root detection, .env files are checked during walk-up
-      // and return immediately if SENTRY_DSN is found (fastest path)
+      // Code DSN takes priority over .env file DSN
+      // Priority order: code > env_file > env_var
       const result = await detectDsn(testDir);
-      expect(result?.raw).toBe(envFileDsn);
-      expect(result?.source).toBe("env_file");
+      expect(result?.raw).toBe(codeDsn);
+      expect(result?.source).toBe("code");
     });
 
     test("code DSN takes priority over env var", async () => {

From 3bb7664d4eada15afc6552428a7e4f196fe0f908 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 15:23:59 +0000
Subject: [PATCH 05/19] refactor(dsn): address PR review comments for
 code-scanner

- Optimize extractDsnsFromContent: extract matches first, then check line context
- Add limit parameter for early exit in first-DSN extraction
- Fix host validation: SENTRY_URL set -> only that host; not set -> only *.sentry.io
- Use path.extname() instead of manual lastIndexOf
- Use recursive readdir + incorporate ALWAYS_SKIP_DIRS into gitignore instance
- Document file size check placement (avoids extra stat() calls)
- Simplify createDetectedDsn usage with .filter(Boolean)
- Simplify deduplication with Map<string, DetectedDsn>
- Add Sentry.metrics for filesScanned/filesCollected/dsnsFound
---
 src/lib/dsn/code-scanner.ts       | 370 +++++++++++++++++-------------
 test/lib/dsn/code-scanner.test.ts |  11 +
 2 files changed, 226 insertions(+), 155 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index ee98beec..e13d45c6 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -5,19 +5,20 @@
  * This replaces the language-specific detectors with a unified scanner that:
  *
  * 1. Greps for DSN URL pattern directly: https://KEY@HOST/PROJECT_ID
- * 2. Filters out commented lines using common prefixes
+ * 2. Filters out DSNs appearing in commented lines
  * 3. Respects .gitignore using the `ignore` package
- * 4. Validates DSN hosts (SaaS or self-hosted via SENTRY_URL)
+ * 4. Validates DSN hosts (SaaS when no SENTRY_URL, or self-hosted host when set)
  * 5. Scans concurrently with p-limit for performance
  * 6. Skips large files and known non-source directories
  */
 
 import { readdir } from "node:fs/promises";
-import { join, relative } from "node:path";
+import { extname, join, relative } from "node:path";
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/bun";
 import ignore, { type Ignore } from "ignore";
 import pLimit from "p-limit";
+import { DEFAULT_SENTRY_HOST } from "../constants.js";
 import { createDetectedDsn, inferPackagePath, parseDsn } from "./parser.js";
 import type { DetectedDsn } from "./types.js";
 
@@ -25,6 +26,10 @@ import type { DetectedDsn } from "./types.js";
  * Maximum file size to scan (256KB).
  * Files larger than this are skipped as they're unlikely to be source files
  * with DSN configuration.
+ *
+ * Note: This check happens during file processing rather than collection to
+ * avoid extra stat() calls. Bun.file().size is a cheap operation once we
+ * have the file handle.
  */
 const MAX_FILE_SIZE = 256 * 1024;
 
@@ -44,8 +49,9 @@ const MAX_SCAN_DEPTH = 2;
 /**
  * Directories that are always skipped regardless of .gitignore.
  * These are common dependency/build/cache directories that should never contain DSNs.
+ * Added to the gitignore instance as built-in patterns.
  */
-const ALWAYS_SKIP_DIRS = new Set([
+const ALWAYS_SKIP_DIRS = [
   // Version control
   ".git",
   ".hg",
@@ -71,7 +77,6 @@ const ALWAYS_SKIP_DIRS = new Set([
   "vendor",
   // Ruby
   ".bundle",
-  // PHP - vendor already listed above
   // General build outputs
   "dist",
   "out",
@@ -79,7 +84,7 @@ const ALWAYS_SKIP_DIRS = new Set([
   ".nuxt",
   ".output",
   "coverage",
-]);
+];
 
 /**
  * File extensions to scan for DSNs.
@@ -154,49 +159,59 @@ const COMMENT_PREFIXES = ["//", "#", "--", "<!--", "/*", "*", "'''", '"""'];
  *
  * The public key is typically a 32-character hex string, but we accept any
  * alphanumeric string to support test fixtures and edge cases.
+ *
+ * Uses 'g' flag for global matching - IMPORTANT: reset lastIndex before reuse
+ * or create new RegExp instances when needed.
  */
 const DSN_PATTERN =
-  /https?:\/\/[a-z0-9]+@[a-z0-9.-]+(?:\.sentry\.io|:[0-9]+)\/\d+/gi;
-
-/**
- * Options for collecting files to scan.
- */
-type CollectFilesOptions = {
-  /** Root directory for relative path calculation */
-  cwd: string;
-  /** Current directory being scanned */
-  dir: string;
-  /** Gitignore instance */
-  ig: Ignore;
-  /** Current depth level */
-  depth: number;
-};
+  /https?:\/\/[a-z0-9]+@[a-z0-9.-]+(?:\.[a-z]+|:[0-9]+)\/\d+/gi;
 
 /**
- * Extract all DSN URLs from file content, filtering out commented lines.
+ * Extract DSN URLs from file content, filtering out those in commented lines.
+ *
+ * Algorithm:
+ * 1. Find all DSN matches in the content using regex
+ * 2. For each match, find the line it appears on
+ * 3. Check if that line is commented out
+ * 4. Validate the DSN host is acceptable
  *
  * @param content - File content to scan
+ * @param limit - Maximum number of DSNs to return (undefined = no limit)
  * @returns Array of unique DSN strings found in non-commented lines
  */
-export function extractDsnsFromContent(content: string): string[] {
+export function extractDsnsFromContent(
+  content: string,
+  limit?: number
+): string[] {
   const dsns = new Set<string>();
-  const lines = content.split("\n");
 
-  for (const line of lines) {
-    const trimmed = line.trim();
+  // Find all potential DSN matches
+  for (const match of content.matchAll(DSN_PATTERN)) {
+    const dsn = match[0];
+    const matchIndex = match.index;
+
+    // Skip if we've already found this DSN
+    if (dsns.has(dsn)) {
+      continue;
+    }
+
+    // Find the line this match appears on by looking backwards for newline
+    const lineStart = content.lastIndexOf("\n", matchIndex) + 1;
+    const lineEnd = content.indexOf("\n", matchIndex);
+    const line = content.slice(lineStart, lineEnd === -1 ? undefined : lineEnd);
 
-    // Skip commented lines
-    if (isCommentedLine(trimmed)) {
+    // Skip if the line is commented
+    if (isCommentedLine(line.trim())) {
       continue;
     }
 
-    // Find all DSN matches in this line
-    const matches = trimmed.matchAll(DSN_PATTERN);
-    for (const match of matches) {
-      const dsn = match[0];
-      // Validate it's a real DSN with valid host
-      if (isValidDsnHost(dsn)) {
-        dsns.add(dsn);
+    // Validate it's a DSN with an acceptable host
+    if (isValidDsnHost(dsn)) {
+      dsns.add(dsn);
+
+      // Early exit if we've reached the limit
+      if (limit !== undefined && dsns.size >= limit) {
+        break;
       }
     }
   }
@@ -204,6 +219,18 @@ export function extractDsnsFromContent(content: string): string[] {
   return [...dsns];
 }
 
+/**
+ * Extract the first DSN from file content.
+ * Used by cache verification to check if a DSN is still present in a file.
+ *
+ * @param content - File content
+ * @returns First DSN found or null
+ */
+export function extractFirstDsnFromContent(content: string): string | null {
+  const dsns = extractDsnsFromContent(content, 1);
+  return dsns[0] ?? null;
+}
+
 /**
  * Scan a directory for all DSNs in source code files.
  *
@@ -234,35 +261,46 @@ export async function scanCodeForFirstDsn(
 }
 
 /**
- * Extract the first DSN from file content.
- * Used by cache verification to check if a DSN is still present in a file.
- *
- * @param content - File content
- * @returns First DSN found or null
+ * Check if a line is commented out based on common comment prefixes.
  */
-export function extractFirstDsnFromContent(content: string): string | null {
-  const dsns = extractDsnsFromContent(content);
-  return dsns[0] ?? null;
+function isCommentedLine(trimmedLine: string): boolean {
+  return COMMENT_PREFIXES.some((prefix) => trimmedLine.startsWith(prefix));
 }
 
 /**
- * Check if a line is commented out based on common comment prefixes.
+ * Get the expected Sentry host for DSN validation.
+ *
+ * When SENTRY_URL is set (self-hosted), only DSNs matching that host are valid.
+ * When not set (SaaS), only *.sentry.io DSNs are valid.
+ *
+ * @returns Object with host info for validation
  */
-function isCommentedLine(trimmedLine: string): boolean {
-  for (const prefix of COMMENT_PREFIXES) {
-    if (trimmedLine.startsWith(prefix)) {
-      return true;
+function getExpectedHost(): { host: string; isSaas: boolean } | null {
+  const sentryUrl = process.env.SENTRY_URL;
+
+  if (sentryUrl) {
+    // Self-hosted: only accept DSNs matching the configured host
+    try {
+      const url = new URL(sentryUrl);
+      return { host: url.host, isSaas: false };
+    } catch {
+      // Invalid SENTRY_URL, can't validate
+      return null;
     }
   }
-  return false;
+
+  // SaaS: only accept *.sentry.io
+  return { host: DEFAULT_SENTRY_HOST, isSaas: true };
 }
 
 /**
- * Validate that a DSN has a valid Sentry host.
+ * Validate that a DSN has an acceptable Sentry host.
+ *
+ * When SENTRY_URL is set (self-hosted): only DSNs matching that exact host are valid
+ * When SENTRY_URL is not set (SaaS): only *.sentry.io DSNs are valid
  *
- * Valid hosts are:
- * - SaaS: *.sentry.io (e.g., o123.ingest.us.sentry.io)
- * - Self-hosted: Host from SENTRY_URL environment variable
+ * This ensures we don't detect SaaS DSNs when configured for self-hosted
+ * (they can't be queried against a self-hosted instance) and vice versa.
  */
 function isValidDsnHost(dsn: string): boolean {
   const parsed = parseDsn(dsn);
@@ -270,39 +308,38 @@ function isValidDsnHost(dsn: string): boolean {
     return false;
   }
 
-  // SaaS DSN
-  if (parsed.host.endsWith(".sentry.io")) {
-    return true;
+  const expected = getExpectedHost();
+  if (!expected) {
+    return false;
   }
 
-  // Self-hosted: check SENTRY_URL environment variable
-  const sentryUrl = process.env.SENTRY_URL;
-  if (sentryUrl) {
-    try {
-      const url = new URL(sentryUrl);
-      if (parsed.host === url.host) {
-        return true;
-      }
-    } catch {
-      // Invalid SENTRY_URL, ignore
-    }
+  if (expected.isSaas) {
+    // SaaS: accept sentry.io or any subdomain (e.g., o123.ingest.us.sentry.io)
+    return (
+      parsed.host === expected.host || parsed.host.endsWith(`.${expected.host}`)
+    );
   }
 
-  return false;
+  // Self-hosted: exact host match only
+  return parsed.host === expected.host;
 }
 
 /**
- * Load .gitignore from a directory and create an ignore instance.
+ * Create an ignore instance with built-in skip directories and .gitignore rules.
  */
-async function loadGitignore(cwd: string): Promise<Ignore> {
+async function createIgnoreFilter(cwd: string): Promise<Ignore> {
   const ig = ignore();
 
+  // Add built-in skip directories first
+  ig.add(ALWAYS_SKIP_DIRS);
+
+  // Then add .gitignore rules if present
   try {
     const gitignorePath = join(cwd, ".gitignore");
     const content = await Bun.file(gitignorePath).text();
     ig.add(content);
   } catch {
-    // No .gitignore, use empty ignore instance
+    // No .gitignore, that's fine
   }
 
   return ig;
@@ -312,53 +349,52 @@ async function loadGitignore(cwd: string): Promise<Ignore> {
  * Check if a file should be scanned based on its extension.
  */
 function shouldScanFile(filename: string): boolean {
-  const lastDot = filename.lastIndexOf(".");
-  if (lastDot === -1) {
-    return false;
+  const ext = extname(filename);
+  return ext !== "" && TEXT_EXTENSIONS.has(ext);
+}
+
+/**
+ * Get the depth of a path (number of directory separators).
+ */
+function getPathDepth(relativePath: string): number {
+  if (!relativePath) {
+    return 0;
   }
-  const ext = filename.slice(lastDot);
-  return TEXT_EXTENSIONS.has(ext);
+  return relativePath.split("/").length - 1;
 }
 
 /**
- * Recursively collect files to scan from a directory.
+ * Collect files to scan from a directory using recursive readdir.
  *
- * @param options - Collection options (cwd, dir, ig, depth)
+ * @param cwd - Root directory to scan
+ * @param ig - Ignore filter instance
  * @returns Array of file paths relative to cwd
  */
-async function collectFiles(options: CollectFilesOptions): Promise<string[]> {
-  const { cwd, dir, ig, depth } = options;
-
-  if (depth > MAX_SCAN_DEPTH) {
-    return [];
-  }
-
+async function collectFiles(cwd: string, ig: Ignore): Promise<string[]> {
+  const entries = await readdir(cwd, { withFileTypes: true, recursive: true });
   const files: string[] = [];
-  const entries = await readdir(dir, { withFileTypes: true });
 
   for (const entry of entries) {
-    const entryPath = join(dir, entry.name);
-    const relativePath = relative(cwd, entryPath);
+    // Skip non-files
+    if (!entry.isFile()) {
+      continue;
+    }
+
+    // Build relative path - entry.parentPath is the directory containing the entry
+    const relativePath = relative(cwd, join(entry.parentPath, entry.name));
 
-    // Skip always-skip directories
-    if (entry.isDirectory() && ALWAYS_SKIP_DIRS.has(entry.name)) {
+    // Skip files beyond max depth
+    if (getPathDepth(relativePath) > MAX_SCAN_DEPTH) {
       continue;
     }
 
-    // Skip gitignored paths
+    // Skip ignored paths (includes ALWAYS_SKIP_DIRS and .gitignore patterns)
     if (ig.ignores(relativePath)) {
       continue;
     }
 
-    if (entry.isDirectory()) {
-      const subFiles = await collectFiles({
-        cwd,
-        dir: entryPath,
-        ig,
-        depth: depth + 1,
-      });
-      files.push(...subFiles);
-    } else if (entry.isFile() && shouldScanFile(entry.name)) {
+    // Only include files with scannable extensions
+    if (shouldScanFile(entry.name)) {
       files.push(relativePath);
     }
   }
@@ -371,110 +407,124 @@ async function collectFiles(options: CollectFilesOptions): Promise<string[]> {
  *
  * @param cwd - Root directory
  * @param relativePath - Path relative to cwd
- * @param stopOnFirst - Whether to stop after finding the first DSN
+ * @param limit - Maximum DSNs to extract (undefined = no limit)
  * @returns Array of detected DSNs (may be empty)
  */
 async function processFile(
   cwd: string,
   relativePath: string,
-  stopOnFirst: boolean
+  limit?: number
 ): Promise<DetectedDsn[]> {
   const filepath = join(cwd, relativePath);
 
   try {
     const file = Bun.file(filepath);
 
-    // Skip large files
-    const fileSize = file.size;
-    if (fileSize > MAX_FILE_SIZE) {
+    // Skip large files - check happens here to avoid extra stat() calls during
+    // collection. Bun.file().size is cheap once we have the file handle.
+    if (file.size > MAX_FILE_SIZE) {
       return [];
     }
 
     const content = await file.text();
-    const dsnStrings = extractDsnsFromContent(content);
+    const dsnStrings = extractDsnsFromContent(content, limit);
 
     if (dsnStrings.length === 0) {
       return [];
     }
 
-    const results: DetectedDsn[] = [];
     const packagePath = inferPackagePath(relativePath);
 
-    for (const dsnString of dsnStrings) {
-      const detected = createDetectedDsn(
-        dsnString,
-        "code",
-        relativePath,
-        packagePath
-      );
-      if (detected) {
-        results.push(detected);
-        if (stopOnFirst) {
-          return results;
-        }
-      }
-    }
-
-    return results;
+    // Map DSN strings to DetectedDsn objects, filtering out any that fail to parse
+    return dsnStrings
+      .map((dsn) => createDetectedDsn(dsn, "code", relativePath, packagePath))
+      .filter((d): d is DetectedDsn => d !== null);
   } catch {
     // Skip files we can't read
     return [];
   }
 }
 
+/**
+ * State for concurrent DSN scanning.
+ */
+type ScanState = {
+  results: Map<string, DetectedDsn>;
+  filesScanned: number;
+  earlyExit: boolean;
+};
+
+/**
+ * Process a file and add found DSNs to the scan state.
+ * Returns true if early exit should be triggered.
+ */
+async function processFileAndCollect(
+  cwd: string,
+  file: string,
+  stopOnFirst: boolean,
+  state: ScanState
+): Promise<boolean> {
+  state.filesScanned += 1;
+  const dsns = await processFile(cwd, file, stopOnFirst ? 1 : undefined);
+
+  for (const dsn of dsns) {
+    if (!state.results.has(dsn.raw)) {
+      state.results.set(dsn.raw, dsn);
+      if (stopOnFirst) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
 /**
  * Scan files concurrently and collect DSNs.
  *
  * @param cwd - Root directory
  * @param files - Files to scan (relative paths)
  * @param stopOnFirst - Whether to stop after finding the first DSN
- * @returns Array of detected DSNs and count of files scanned
+ * @returns Map of DSNs (keyed by raw string) and count of files scanned
  */
 async function scanFilesForDsns(
   cwd: string,
   files: string[],
   stopOnFirst: boolean
-): Promise<{ results: DetectedDsn[]; filesScanned: number }> {
+): Promise<{ results: Map<string, DetectedDsn>; filesScanned: number }> {
   const limit = pLimit(CONCURRENCY_LIMIT);
-  const results: DetectedDsn[] = [];
-  const seenDsns = new Set<string>();
-  let filesScanned = 0;
-  let earlyExit = false;
+  const state: ScanState = {
+    results: new Map(),
+    filesScanned: 0,
+    earlyExit: false,
+  };
 
   const tasks = files.map((file) =>
     limit(async () => {
-      // Check if we should stop early
-      if (earlyExit) {
+      if (state.earlyExit) {
         return;
       }
 
-      filesScanned += 1;
-      const dsns = await processFile(cwd, file, stopOnFirst);
-
-      for (const dsn of dsns) {
-        // Deduplicate by raw DSN string
-        if (!seenDsns.has(dsn.raw)) {
-          seenDsns.add(dsn.raw);
-          results.push(dsn);
-
-          if (stopOnFirst) {
-            earlyExit = true;
-            // Clear pending tasks
-            limit.clearQueue();
-            return;
-          }
-        }
+      const shouldExit = await processFileAndCollect(
+        cwd,
+        file,
+        stopOnFirst,
+        state
+      );
+
+      if (shouldExit) {
+        state.earlyExit = true;
+        limit.clearQueue();
       }
     })
   );
 
   await Promise.all(tasks);
 
-  return { results, filesScanned };
+  return { results: state.results, filesScanned: state.filesScanned };
 }
 
 /**
- * Main scan implementation with Sentry performance tracing.
+ * Main scan implementation with Sentry performance tracing and metrics.
  */
 function scanDirectory(
   cwd: string,
@@ -492,20 +542,22 @@ function scanDirectory(
       onlyIfParent: true,
     },
     async (span) => {
-      // Load gitignore
-      const ig = await loadGitignore(cwd);
+      // Create ignore filter with built-in patterns and .gitignore
+      const ig = await createIgnoreFilter(cwd);
 
       // Collect all files to scan
       let files: string[];
       try {
-        files = await collectFiles({ cwd, dir: cwd, ig, depth: 0 });
+        files = await collectFiles(cwd, ig);
       } catch {
-        // Directory might not exist or be readable
         span.setStatus({ code: 2, message: "Directory scan failed" });
         return [];
       }
 
       span.setAttribute("dsn.files_collected", files.length);
+      Sentry.metrics.distribution("dsn.files_collected", files.length, {
+        attributes: { stop_on_first: String(stopOnFirst) },
+      });
 
       if (files.length === 0) {
         span.setStatus({ code: 1 });
@@ -521,11 +573,19 @@ function scanDirectory(
 
       span.setAttributes({
         "dsn.files_scanned": filesScanned,
-        "dsn.dsns_found": results.length,
+        "dsn.dsns_found": results.size,
+      });
+
+      Sentry.metrics.distribution("dsn.files_scanned", filesScanned, {
+        attributes: { stop_on_first: String(stopOnFirst) },
+      });
+      Sentry.metrics.distribution("dsn.dsns_found", results.size, {
+        attributes: { stop_on_first: String(stopOnFirst) },
       });
+
       span.setStatus({ code: 1 });
 
-      return results;
+      return [...results.values()];
     }
   );
 }
diff --git a/test/lib/dsn/code-scanner.test.ts b/test/lib/dsn/code-scanner.test.ts
index bb6e79c3..14ae7a10 100644
--- a/test/lib/dsn/code-scanner.test.ts
+++ b/test/lib/dsn/code-scanner.test.ts
@@ -169,6 +169,17 @@ describe("Code Scanner", () => {
       const dsns = extractDsnsFromContent(content);
       expect(dsns).toEqual(["https://abc@sentry.mycompany.com:9000/123"]);
     });
+
+    test("rejects SaaS DSNs when SENTRY_URL is set (self-hosted mode)", () => {
+      process.env.SENTRY_URL = "https://sentry.mycompany.com:9000";
+      const content = `
+        const SAAS_DSN = "https://abc@o123.ingest.sentry.io/456";
+        const SELF_HOSTED_DSN = "https://def@sentry.mycompany.com:9000/789";
+      `;
+      const dsns = extractDsnsFromContent(content);
+      // Only the self-hosted DSN should be accepted
+      expect(dsns).toEqual(["https://def@sentry.mycompany.com:9000/789"]);
+    });
   });
 
   describe("extractFirstDsnFromContent", () => {

From 9bb2531d9ee8b9c665cf7b1b14619e2978f74c6b Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 17:34:53 +0000
Subject: [PATCH 06/19] fix: address PR review comments for DSN detection

- Use regex pattern for path separators to support Windows
- Fix walkUpDirectories to check starting dir at stop boundary
- Remove unnecessary export from checkEnvForDsn
- Clean up unused exports in dsn/index.ts
---
 src/lib/dsn/code-scanner.ts | 8 +++++++-
 src/lib/dsn/index.ts        | 9 +--------
 src/lib/dsn/project-root.ts | 8 +++++---
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index e13d45c6..0443f69c 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -150,6 +150,11 @@ const TEXT_EXTENSIONS = new Set([
  */
 const COMMENT_PREFIXES = ["//", "#", "--", "<!--", "/*", "*", "'''", '"""'];
 
+/**
+ * Pattern to split paths on both forward and back slashes for cross-platform support.
+ */
+const PATH_SEPARATOR_PATTERN = /[/\\]/;
+
 /**
  * Pattern to match Sentry DSN URLs.
  * Captures the full DSN including protocol, public key, host, and project ID.
@@ -355,12 +360,13 @@ function shouldScanFile(filename: string): boolean {
 
 /**
  * Get the depth of a path (number of directory separators).
+ * Uses regex to split on both forward and back slashes for cross-platform support.
  */
 function getPathDepth(relativePath: string): number {
   if (!relativePath) {
     return 0;
   }
-  return relativePath.split("/").length - 1;
+  return relativePath.split(PATH_SEPARATOR_PATTERN).length - 1;
 }
 
 /**
diff --git a/src/lib/dsn/index.ts b/src/lib/dsn/index.ts
index d8f005c3..72d9db04 100644
--- a/src/lib/dsn/index.ts
+++ b/src/lib/dsn/index.ts
@@ -87,11 +87,4 @@ export {
 // ─────────────────────────────────────────────────────────────────────────────
 
 export type { ProjectRootReason, ProjectRootResult } from "./project-root.js";
-export {
-  findProjectRoot,
-  getStopBoundary,
-  hasBuildSystemMarker,
-  hasLanguageMarker,
-  hasRepoRootMarker,
-  isProjectRoot,
-} from "./project-root.js";
+export { findProjectRoot } from "./project-root.js";
diff --git a/src/lib/dsn/project-root.ts b/src/lib/dsn/project-root.ts
index 2ecc8fe1..cf5be7f8 100644
--- a/src/lib/dsn/project-root.ts
+++ b/src/lib/dsn/project-root.ts
@@ -383,7 +383,7 @@ export function hasBuildSystemMarker(dir: string): Promise<boolean> {
  * @param dir - Directory to check
  * @returns Detected DSN or null
  */
-export function checkEnvForDsn(dir: string): Promise<DetectedDsn | null> {
+function checkEnvForDsn(dir: string): Promise<DetectedDsn | null> {
   return withFsSpan("checkEnvForDsn", async () => {
     // Check all env files in parallel for existence
     const existenceChecks = ENV_FILES.map(async (filename) => {
@@ -551,7 +551,9 @@ async function walkUpDirectories(
     buildSystemAt: null,
   };
 
-  while (state.currentDir !== "/" && state.currentDir !== stopBoundary) {
+  // Use do-while to ensure starting directory is always checked,
+  // even when it equals the stop boundary (e.g., user runs from home dir)
+  do {
     state.levelsTraversed += 1;
 
     const { dsnResult, repoRootResult, hasLang, hasBuild } =
@@ -595,7 +597,7 @@ async function walkUpDirectories(
       break; // Reached filesystem root
     }
     state.currentDir = parentDir;
-  }
+  } while (state.currentDir !== "/" && state.currentDir !== stopBoundary);
 
   // Determine project root from candidates (priority order)
   const selected = selectProjectRoot(

From 9f60492012c3050222276ba83685d28b384345fc Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 19:04:58 +0000
Subject: [PATCH 07/19] fix: address all PR review comments

- Fix priority order in detectAllDsns: code DSNs now have priority
- Fix walkUpDirectories stop boundary: check before moving to parent
- Deduplicate ENV_FILES: import from env-file.ts instead of redefining
- Normalize Windows paths: convert backslashes for ignore package
- Update test to match correct priority order (code > env_file > env_var)
---
 src/lib/dsn/code-scanner.ts   |  7 ++++++-
 src/lib/dsn/detector.ts       | 18 ++++++++++--------
 src/lib/dsn/project-root.ts   | 20 ++++++++------------
 test/lib/dsn/detector.test.ts |  4 ++--
 4 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index 0443f69c..89f18d3f 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -389,13 +389,18 @@ async function collectFiles(cwd: string, ig: Ignore): Promise<string[]> {
     // Build relative path - entry.parentPath is the directory containing the entry
     const relativePath = relative(cwd, join(entry.parentPath, entry.name));
 
+    // Normalize path separators for cross-platform support.
+    // The `ignore` package requires forward slashes for pattern matching,
+    // but Windows returns backslashes from path.relative().
+    const normalizedPath = relativePath.replaceAll("\\", "/");
+
     // Skip files beyond max depth
     if (getPathDepth(relativePath) > MAX_SCAN_DEPTH) {
       continue;
     }
 
     // Skip ignored paths (includes ALWAYS_SKIP_DIRS and .gitignore patterns)
-    if (ig.ignores(relativePath)) {
+    if (ig.ignores(normalizedPath)) {
       continue;
     }
 
diff --git a/src/lib/dsn/detector.ts b/src/lib/dsn/detector.ts
index 380971f9..56d9a4b6 100644
--- a/src/lib/dsn/detector.ts
+++ b/src/lib/dsn/detector.ts
@@ -118,7 +118,7 @@ export async function detectDsn(cwd: string): Promise<DetectedDsn | null> {
  * @returns Detection result with all found DSNs and hasMultiple flag
  */
 export async function detectAllDsns(cwd: string): Promise<DsnDetectionResult> {
-  // Find project root first
+  // Find project root first (may find DSN in .env during walk-up)
   const { projectRoot, foundDsn } = await findProjectRoot(cwd);
 
   const allDsns: DetectedDsn[] = [];
@@ -132,24 +132,26 @@ export async function detectAllDsns(cwd: string): Promise<DsnDetectionResult> {
     }
   };
 
-  // If DSN was found during walk-up, add it first (highest priority)
-  if (foundDsn) {
-    addDsn(foundDsn);
-  }
-
-  // 1. Check all code files from project root
+  // 1. Check all code files from project root (highest priority)
   const codeDsns = await scanCodeForDsns(projectRoot);
   for (const dsn of codeDsns) {
     addDsn(dsn);
   }
 
   // 2. Check all .env files from project root (includes monorepo packages/apps)
+  // Note: foundDsn from walk-up is already included in env file scan results
   const envFileDsns = await detectFromAllEnvFiles(projectRoot);
   for (const dsn of envFileDsns) {
     addDsn(dsn);
   }
 
-  // 3. Check env var (lowest priority)
+  // 3. Add DSN found during walk-up if not already added (deduplication handles this)
+  // This ensures it's included even if env file scan missed it somehow
+  if (foundDsn) {
+    addDsn(foundDsn);
+  }
+
+  // 4. Check env var (lowest priority)
   const envDsn = detectFromEnv();
   if (envDsn) {
     addDsn(envDsn);
diff --git a/src/lib/dsn/project-root.ts b/src/lib/dsn/project-root.ts
index cf5be7f8..9a5fdc73 100644
--- a/src/lib/dsn/project-root.ts
+++ b/src/lib/dsn/project-root.ts
@@ -18,7 +18,7 @@ import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/bun";
-import { extractDsnFromEnvContent } from "./env-file.js";
+import { ENV_FILES, extractDsnFromEnvContent } from "./env-file.js";
 import { createDetectedDsn } from "./parser.js";
 import type { DetectedDsn } from "./types.js";
 
@@ -166,16 +166,6 @@ const BUILD_SYSTEM_MARKERS = [
   "Earthfile",
 ] as const;
 
-/** .env files to check for SENTRY_DSN (in priority order) */
-const ENV_FILES = [
-  ".env.local",
-  ".env.development.local",
-  ".env.production.local",
-  ".env",
-  ".env.development",
-  ".env.production",
-] as const;
-
 /** Regex for detecting root=true in .editorconfig (top-level for performance) */
 const EDITORCONFIG_ROOT_REGEX = /^\s*root\s*=\s*true\s*$/im;
 
@@ -591,13 +581,19 @@ async function walkUpDirectories(
       state.buildSystemAt = state.currentDir;
     }
 
+    // Stop at boundary BEFORE moving to parent - this ensures we don't
+    // traverse past home directory when starting there
+    if (state.currentDir === stopBoundary) {
+      break;
+    }
+
     // Move to parent directory
     const parentDir = dirname(state.currentDir);
     if (parentDir === state.currentDir) {
       break; // Reached filesystem root
     }
     state.currentDir = parentDir;
-  } while (state.currentDir !== "/" && state.currentDir !== stopBoundary);
+  } while (state.currentDir !== "/");
 
   // Determine project root from candidates (priority order)
   const selected = selectProjectRoot(
diff --git a/test/lib/dsn/detector.test.ts b/test/lib/dsn/detector.test.ts
index 6a75a7dd..2daeb8f4 100644
--- a/test/lib/dsn/detector.test.ts
+++ b/test/lib/dsn/detector.test.ts
@@ -246,8 +246,8 @@ describe("DSN Detector (New Module)", () => {
       const result = await detectAllDsns(testDir);
 
       expect(result.hasMultiple).toBe(true);
-      // With project root detection, env file DSN found during walk-up is first
-      expect(result.primary?.raw).toBe(envDsn);
+      // Code DSNs have highest priority (code > env_file > env_var)
+      expect(result.primary?.raw).toBe(codeDsn);
       expect(result.all).toHaveLength(2);
     });
 

From a67aa5091689a1c75c8318c9272966c8b3da90c4 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 19:45:17 +0000
Subject: [PATCH 08/19] fix: handle invalid SENTRY_URL gracefully in code
 scanner

When SENTRY_URL is set to an invalid URL, the code scanner was silently
failing to detect any DSNs because getExpectedHost() returned null.

Now it:
1. Logs a warning (once per process) about the invalid URL
2. Falls back to SaaS behavior (accepting *.sentry.io DSNs)

This is consistent with how other parts of the codebase handle invalid
SENTRY_URL values (they fall back to the default SaaS URL).
---
 src/lib/dsn/code-scanner.ts       | 22 +++++++++++++++-------
 test/lib/dsn/code-scanner.test.ts | 25 +++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 7 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index 89f18d3f..ff76f2bc 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -272,15 +272,20 @@ function isCommentedLine(trimmedLine: string): boolean {
   return COMMENT_PREFIXES.some((prefix) => trimmedLine.startsWith(prefix));
 }
 
+/** Track whether we've already warned about invalid SENTRY_URL (warn once per process) */
+let hasWarnedInvalidSentryUrl = false;
+
 /**
  * Get the expected Sentry host for DSN validation.
  *
  * When SENTRY_URL is set (self-hosted), only DSNs matching that host are valid.
  * When not set (SaaS), only *.sentry.io DSNs are valid.
  *
- * @returns Object with host info for validation
+ * If SENTRY_URL is set but invalid, logs a warning and falls back to SaaS behavior.
+ *
+ * @returns Object with host info for validation (never null)
  */
-function getExpectedHost(): { host: string; isSaas: boolean } | null {
+function getExpectedHost(): { host: string; isSaas: boolean } {
   const sentryUrl = process.env.SENTRY_URL;
 
   if (sentryUrl) {
@@ -289,8 +294,14 @@ function getExpectedHost(): { host: string; isSaas: boolean } | null {
       const url = new URL(sentryUrl);
       return { host: url.host, isSaas: false };
     } catch {
-      // Invalid SENTRY_URL, can't validate
-      return null;
+      // Invalid SENTRY_URL - warn once and fall back to SaaS behavior
+      if (!hasWarnedInvalidSentryUrl) {
+        hasWarnedInvalidSentryUrl = true;
+        console.warn(
+          `Warning: SENTRY_URL "${sentryUrl}" is not a valid URL. Falling back to sentry.io for DSN detection.`
+        );
+      }
+      // Fall through to SaaS default
     }
   }
 
@@ -314,9 +325,6 @@ function isValidDsnHost(dsn: string): boolean {
   }
 
   const expected = getExpectedHost();
-  if (!expected) {
-    return false;
-  }
 
   if (expected.isSaas) {
     // SaaS: accept sentry.io or any subdomain (e.g., o123.ingest.us.sentry.io)
diff --git a/test/lib/dsn/code-scanner.test.ts b/test/lib/dsn/code-scanner.test.ts
index 14ae7a10..1e445ad4 100644
--- a/test/lib/dsn/code-scanner.test.ts
+++ b/test/lib/dsn/code-scanner.test.ts
@@ -180,6 +180,31 @@ describe("Code Scanner", () => {
       // Only the self-hosted DSN should be accepted
       expect(dsns).toEqual(["https://def@sentry.mycompany.com:9000/789"]);
     });
+
+    test("falls back to SaaS when SENTRY_URL is invalid", () => {
+      // Capture console.warn to verify warning is emitted
+      const warnings: string[] = [];
+      const originalWarn = console.warn;
+      console.warn = (msg: string) => warnings.push(msg);
+
+      try {
+        process.env.SENTRY_URL = "not-a-valid-url";
+        const content = `
+          const SAAS_DSN = "https://abc@o123.ingest.sentry.io/456";
+        `;
+        const dsns = extractDsnsFromContent(content);
+
+        // Should accept SaaS DSNs when SENTRY_URL is invalid (fallback behavior)
+        expect(dsns).toEqual(["https://abc@o123.ingest.sentry.io/456"]);
+
+        // Should have warned about the invalid URL
+        expect(warnings.length).toBeGreaterThan(0);
+        expect(warnings[0]).toContain("not-a-valid-url");
+        expect(warnings[0]).toContain("not a valid URL");
+      } finally {
+        console.warn = originalWarn;
+      }
+    });
   });
 
   describe("extractFirstDsnFromContent", () => {

From ea764f365a6f6dc892f2c4a4d9b67f58094abcf3 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 19:55:10 +0000
Subject: [PATCH 09/19] fix: normalize Windows paths early for package path
 inference

The relativePath was being normalized for ig.ignores() but the original
backslash path was pushed to files array. This caused inferPackagePath()
to fail on Windows since it splits by "/" only.

Now we normalize the path immediately after creation, ensuring:
1. The ignore package gets forward-slash paths
2. inferPackagePath() receives forward-slash paths
3. DetectedDsn.sourcePath is consistent across platforms
---
 src/lib/dsn/code-scanner.ts | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index ff76f2bc..604881bc 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -395,12 +395,15 @@ async function collectFiles(cwd: string, ig: Ignore): Promise<string[]> {
     }
 
     // Build relative path - entry.parentPath is the directory containing the entry
-    const relativePath = relative(cwd, join(entry.parentPath, entry.name));
-
-    // Normalize path separators for cross-platform support.
-    // The `ignore` package requires forward slashes for pattern matching,
-    // but Windows returns backslashes from path.relative().
-    const normalizedPath = relativePath.replaceAll("\\", "/");
+    // Normalize to forward slashes for cross-platform consistency.
+    // Windows returns backslashes from path.relative(), but we need forward slashes for:
+    // 1. The `ignore` package pattern matching
+    // 2. inferPackagePath() which splits by "/"
+    // 3. Consistent sourcePath values in DetectedDsn objects
+    const relativePath = relative(
+      cwd,
+      join(entry.parentPath, entry.name)
+    ).replaceAll("\\", "/");
 
     // Skip files beyond max depth
     if (getPathDepth(relativePath) > MAX_SCAN_DEPTH) {
@@ -408,7 +411,7 @@ async function collectFiles(cwd: string, ig: Ignore): Promise<string[]> {
     }
 
     // Skip ignored paths (includes ALWAYS_SKIP_DIRS and .gitignore patterns)
-    if (ig.ignores(normalizedPath)) {
+    if (ig.ignores(relativePath)) {
       continue;
     }
 

From f021ef63ce1185325c7c199642a1ed9eb4d49c8b Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 20:01:45 +0000
Subject: [PATCH 10/19] refactor: remove unused isProjectRoot function

The function was exported but never used in production code - only in tests.
It wasn't part of the public API (not re-exported from index.ts).
The main detection algorithm uses findProjectRoot which handles project
root detection differently, making this function redundant.
---
 src/lib/dsn/project-root.ts       | 24 ------------------------
 test/lib/dsn/project-root.test.ts | 22 ----------------------
 2 files changed, 46 deletions(-)

diff --git a/src/lib/dsn/project-root.ts b/src/lib/dsn/project-root.ts
index 9a5fdc73..04d5d27f 100644
--- a/src/lib/dsn/project-root.ts
+++ b/src/lib/dsn/project-root.ts
@@ -647,27 +647,3 @@ export function findProjectRoot(startDir: string): Promise<ProjectRootResult> {
     }
   );
 }
-
-/**
- * Check if a directory is a project root.
- *
- * A directory is considered a project root if it has any of:
- * - VCS markers (.git, .hg, etc.)
- * - CI/CD markers (.github, etc.)
- * - .editorconfig with root=true
- * - Language/package markers
- * - Build system markers
- *
- * @param dir - Directory to check
- * @returns True if directory appears to be a project root
- */
-export async function isProjectRoot(dir: string): Promise<boolean> {
-  // Check all marker types in parallel
-  const [hasRepo, hasLang, hasBuild] = await Promise.all([
-    hasRepoRootMarker(dir),
-    hasLanguageMarker(dir),
-    hasBuildSystemMarker(dir),
-  ]);
-
-  return hasRepo.found || hasLang || hasBuild;
-}
diff --git a/test/lib/dsn/project-root.test.ts b/test/lib/dsn/project-root.test.ts
index e4477207..c336a143 100644
--- a/test/lib/dsn/project-root.test.ts
+++ b/test/lib/dsn/project-root.test.ts
@@ -14,7 +14,6 @@ import {
   hasBuildSystemMarker,
   hasLanguageMarker,
   hasRepoRootMarker,
-  isProjectRoot,
 } from "../../../src/lib/dsn/project-root.js";
 
 // Test directory structure helper
@@ -162,27 +161,6 @@ describe("project-root", () => {
     });
   });
 
-  describe("isProjectRoot", () => {
-    test("returns true for directory with .git", async () => {
-      createDir(join(testDir, ".git"));
-      expect(await isProjectRoot(testDir)).toBe(true);
-    });
-
-    test("returns true for directory with package.json", async () => {
-      createFile(join(testDir, "package.json"), "{}");
-      expect(await isProjectRoot(testDir)).toBe(true);
-    });
-
-    test("returns true for directory with Makefile", async () => {
-      createFile(join(testDir, "Makefile"), "");
-      expect(await isProjectRoot(testDir)).toBe(true);
-    });
-
-    test("returns false for empty directory", async () => {
-      expect(await isProjectRoot(testDir)).toBe(false);
-    });
-  });
-
   describe("findProjectRoot", () => {
     describe("DSN detection in .env files", () => {
       test("finds DSN in .env file and returns immediately", async () => {

From bdb3625e1351fb72e8b7891f39ea4b195ec43e79 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 20:07:26 +0000
Subject: [PATCH 11/19] fix: properly cache and verify DSN from SENTRY_DSN env
 var

The verifyCachedDsn() function was returning null for source='env',
causing a full directory scan on every invocation when the DSN came
from the SENTRY_DSN environment variable.

Now it properly verifies by checking if the env var still contains
the same DSN value, providing the expected O(1) cache hit performance
instead of O(n) directory scanning.

This is especially important for CI/CD, Docker, and Kubernetes
environments where SENTRY_DSN env var is the primary configuration method.
---
 src/lib/dsn/detector.ts       | 14 ++++++++++++--
 test/lib/dsn/detector.test.ts | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/src/lib/dsn/detector.ts b/src/lib/dsn/detector.ts
index 56d9a4b6..daa58953 100644
--- a/src/lib/dsn/detector.ts
+++ b/src/lib/dsn/detector.ts
@@ -184,12 +184,22 @@ async function verifyCachedDsn(
   cwd: string,
   cached: CachedDsnEntry
 ): Promise<DetectedDsn | null> {
-  // For env source, we already checked above in detectDsn
+  // For env source, verify by checking the env var directly (no file to read)
   if (cached.source === "env") {
+    const envDsn = detectFromEnv();
+    if (envDsn && envDsn.raw === cached.dsn) {
+      // Same DSN in env var - cache is valid
+      return envDsn;
+    }
+    if (envDsn) {
+      // DSN changed - return new one (cache will be updated by caller)
+      return envDsn;
+    }
+    // Env var no longer set - cache is invalid
     return null;
   }
 
-  // Need a source path to verify
+  // Need a source path to verify file-based sources
   if (!cached.sourcePath) {
     return null;
   }
diff --git a/test/lib/dsn/detector.test.ts b/test/lib/dsn/detector.test.ts
index 2daeb8f4..ef60a33d 100644
--- a/test/lib/dsn/detector.test.ts
+++ b/test/lib/dsn/detector.test.ts
@@ -166,6 +166,39 @@ describe("DSN Detector (New Module)", () => {
       expect(result?.source).toBe("env");
     });
 
+    test("env var DSN is cached and verified without full scan", async () => {
+      const envVarDsn = "https://var@o111.ingest.sentry.io/111";
+      const changedDsn = "https://changed@o222.ingest.sentry.io/222";
+
+      // Only set env var
+      process.env.SENTRY_DSN = envVarDsn;
+
+      // First detection - should detect and cache
+      const result1 = await detectDsn(testDir);
+      expect(result1?.raw).toBe(envVarDsn);
+      expect(result1?.source).toBe("env");
+
+      // Verify it's cached
+      const cached = await getCachedDsn(testDir);
+      expect(cached?.dsn).toBe(envVarDsn);
+      expect(cached?.source).toBe("env");
+
+      // Second detection - should use cache verification (not full scan)
+      const result2 = await detectDsn(testDir);
+      expect(result2?.raw).toBe(envVarDsn);
+      expect(result2?.source).toBe("env");
+
+      // Change env var - should detect the change
+      process.env.SENTRY_DSN = changedDsn;
+      const result3 = await detectDsn(testDir);
+      expect(result3?.raw).toBe(changedDsn);
+      expect(result3?.source).toBe("env");
+
+      // Cache should be updated
+      const updatedCache = await getCachedDsn(testDir);
+      expect(updatedCache?.dsn).toBe(changedDsn);
+    });
+
     test("skips node_modules and dist directories", async () => {
       const nodeModulesDsn = "https://nm@o111.ingest.sentry.io/111";
       const distDsn = "https://dist@o222.ingest.sentry.io/222";

From 218abdcb07e912baeb90471ff7bef1b0d253611c Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Tue, 3 Feb 2026 20:30:48 +0000
Subject: [PATCH 12/19] fix: cache verification respects priority order and
 test pollution

1. Cache verification now checks for higher-priority sources:
   - When cached DSN is from env var, checks for code DSNs first
   - When cached DSN is from env file, checks for code DSNs first
   - This ensures adding a code DSN after caching correctly updates priority

2. Fixed module-level state test pollution:
   - Exported _resetInvalidSentryUrlWarning() for testing
   - Tests now reset warning state in afterEach to prevent order dependencies

Added tests for both fixes.
---
 src/lib/dsn/code-scanner.ts       |  9 ++++
 src/lib/dsn/detector.ts           | 89 ++++++++++++++++++++++---------
 test/lib/dsn/code-scanner.test.ts |  2 +
 test/lib/dsn/detector.test.ts     | 33 ++++++++++++
 4 files changed, 108 insertions(+), 25 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index 604881bc..e4955e3a 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -275,6 +275,15 @@ function isCommentedLine(trimmedLine: string): boolean {
 /** Track whether we've already warned about invalid SENTRY_URL (warn once per process) */
 let hasWarnedInvalidSentryUrl = false;
 
+/**
+ * Reset the invalid SENTRY_URL warning state.
+ * Exported for testing only - allows tests to reset state between runs.
+ * @internal
+ */
+export function _resetInvalidSentryUrlWarning(): void {
+  hasWarnedInvalidSentryUrl = false;
+}
+
 /**
  * Get the expected Sentry host for DSN validation.
  *
diff --git a/src/lib/dsn/detector.ts b/src/lib/dsn/detector.ts
index daa58953..a8cb9fe5 100644
--- a/src/lib/dsn/detector.ts
+++ b/src/lib/dsn/detector.ts
@@ -172,34 +172,44 @@ export async function detectAllDsns(cwd: string): Promise<DsnDetectionResult> {
 // ─────────────────────────────────────────────────────────────────────────────
 
 /**
- * Verify cached DSN is still valid by reading ONLY the cached source file
- *
- * This is the key to fast cache hits - we only read ONE file.
- *
- * @param cwd - Directory
- * @param cached - Cached DSN entry
- * @returns Verified DSN or null if cache is invalid
+ * Check if a higher-priority code DSN exists.
+ * Used to invalidate low-priority cached DSNs when code is added.
  */
-async function verifyCachedDsn(
+function checkForHigherPriorityCodeDsn(
+  cwd: string
+): Promise<DetectedDsn | null> {
+  return scanCodeForFirstDsn(cwd);
+}
+
+/**
+ * Verify cached env var DSN is still valid.
+ * Also checks for higher-priority code DSNs.
+ */
+async function verifyEnvVarCache(
   cwd: string,
   cached: CachedDsnEntry
 ): Promise<DetectedDsn | null> {
-  // For env source, verify by checking the env var directly (no file to read)
-  if (cached.source === "env") {
-    const envDsn = detectFromEnv();
-    if (envDsn && envDsn.raw === cached.dsn) {
-      // Same DSN in env var - cache is valid
-      return envDsn;
-    }
-    if (envDsn) {
-      // DSN changed - return new one (cache will be updated by caller)
-      return envDsn;
-    }
-    // Env var no longer set - cache is invalid
-    return null;
+  // First check if a code DSN exists (higher priority than env var)
+  const codeDsn = await checkForHigherPriorityCodeDsn(cwd);
+  if (codeDsn) {
+    return codeDsn;
   }
 
-  // Need a source path to verify file-based sources
+  // No code DSN, verify the env var is still set
+  const envDsn = detectFromEnv();
+  if (envDsn?.raw === cached.dsn) {
+    return envDsn; // Same DSN - cache valid
+  }
+  return envDsn; // DSN changed or removed - return new value (may be null)
+}
+
+/**
+ * Verify cached file-based DSN is still valid.
+ */
+async function verifyFileDsnCache(
+  cwd: string,
+  cached: CachedDsnEntry
+): Promise<DetectedDsn | null> {
   if (!cached.sourcePath) {
     return null;
   }
@@ -211,21 +221,50 @@ async function verifyCachedDsn(
     const foundDsn = extractDsnFromContent(content, cached.source);
 
     if (foundDsn === cached.dsn) {
-      // Same DSN - cache is valid!
       return createDetectedDsn(cached.dsn, cached.source, cached.sourcePath);
     }
 
     if (foundDsn && parseDsn(foundDsn)) {
-      // DSN changed - return new one (cache will be updated by caller)
       return createDetectedDsn(foundDsn, cached.source, cached.sourcePath);
     }
   } catch {
-    // File doesn't exist or can't read - cache is invalid
+    // File doesn't exist or can't read
   }
 
   return null;
 }
 
+/**
+ * Verify cached DSN is still valid.
+ *
+ * For low-priority sources (env, env_file), also checks if higher-priority
+ * code DSNs have been added since caching to maintain correct priority order.
+ *
+ * @param cwd - Directory
+ * @param cached - Cached DSN entry
+ * @returns Verified DSN or null if cache is invalid
+ */
+async function verifyCachedDsn(
+  cwd: string,
+  cached: CachedDsnEntry
+): Promise<DetectedDsn | null> {
+  // Env var source (lowest priority) - check for higher-priority sources
+  if (cached.source === "env") {
+    return verifyEnvVarCache(cwd, cached);
+  }
+
+  // Env file source - check for higher-priority code DSNs first
+  if (cached.source === "env_file") {
+    const codeDsn = await checkForHigherPriorityCodeDsn(cwd);
+    if (codeDsn) {
+      return codeDsn;
+    }
+  }
+
+  // Verify file-based sources (code, env_file, config)
+  return verifyFileDsnCache(cwd, cached);
+}
+
 /**
  * Extract DSN from content based on source type.
  *
diff --git a/test/lib/dsn/code-scanner.test.ts b/test/lib/dsn/code-scanner.test.ts
index 1e445ad4..1fb1d5ed 100644
--- a/test/lib/dsn/code-scanner.test.ts
+++ b/test/lib/dsn/code-scanner.test.ts
@@ -2,6 +2,7 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import {
+  _resetInvalidSentryUrlWarning,
   extractDsnsFromContent,
   extractFirstDsnFromContent,
   scanCodeForDsns,
@@ -18,6 +19,7 @@ describe("Code Scanner", () => {
   afterEach(() => {
     rmSync(testDir, { recursive: true, force: true });
     delete process.env.SENTRY_URL;
+    _resetInvalidSentryUrlWarning();
   });
 
   describe("extractDsnsFromContent", () => {
diff --git a/test/lib/dsn/detector.test.ts b/test/lib/dsn/detector.test.ts
index ef60a33d..a1c9b818 100644
--- a/test/lib/dsn/detector.test.ts
+++ b/test/lib/dsn/detector.test.ts
@@ -199,6 +199,39 @@ describe("DSN Detector (New Module)", () => {
       expect(updatedCache?.dsn).toBe(changedDsn);
     });
 
+    test("cache verification respects priority when code DSN is added after env var", async () => {
+      const envVarDsn = "https://var@o111.ingest.sentry.io/111";
+      const codeDsn = "https://code@o222.ingest.sentry.io/222";
+
+      // First, detect with only env var
+      process.env.SENTRY_DSN = envVarDsn;
+      const result1 = await detectDsn(testDir);
+      expect(result1?.raw).toBe(envVarDsn);
+      expect(result1?.source).toBe("env");
+
+      // Verify it's cached
+      const cached = await getCachedDsn(testDir);
+      expect(cached?.source).toBe("env");
+
+      // Now add a code DSN (higher priority)
+      mkdirSync(join(testDir, "src"), { recursive: true });
+      writeFileSync(
+        join(testDir, "src/config.ts"),
+        `Sentry.init({ dsn: "${codeDsn}" })`
+      );
+
+      // Next detection should find the code DSN (higher priority)
+      // even though env var is still cached
+      const result2 = await detectDsn(testDir);
+      expect(result2?.raw).toBe(codeDsn);
+      expect(result2?.source).toBe("code");
+
+      // Cache should be updated to code DSN
+      const updatedCache = await getCachedDsn(testDir);
+      expect(updatedCache?.dsn).toBe(codeDsn);
+      expect(updatedCache?.source).toBe("code");
+    });
+
     test("skips node_modules and dist directories", async () => {
       const nodeModulesDsn = "https://nm@o111.ingest.sentry.io/111";
       const distDsn = "https://dist@o222.ingest.sentry.io/222";

From c8e7522f6e5892c204e45f5e2ea84913b44c9a0d Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Wed, 4 Feb 2026 12:12:31 +0000
Subject: [PATCH 13/19] refactor: address PR review comments for DSN detection

- Remove ASCII-art section divider comments across all DSN files
- Invalid SENTRY_URL now throws ConfigError instead of warning (fail fast)
- Allow subdomains for self-hosted instances in DSN validation
- Add module-level normalizePath helper for cross-platform consistency
- Optimize path depth check before expensive path manipulation
- Use early-exit patterns in anyExists and anyGlobMatches
- Read files directly instead of stat+exists in checkEditorConfigRoot/checkEnvForDsn
- Remove redundant fileExists function (use pathExists)
- Simplify walkUpDirectories loop with clear exit conditions
- Add JSDoc clarifying Bun.file().size reads metadata not content
---
 src/lib/dsn/code-scanner.ts       |  95 +++++++-------
 src/lib/dsn/detector.ts           |  16 ---
 src/lib/dsn/env-file.ts           |  16 ---
 src/lib/dsn/index.ts              |  64 +++-------
 src/lib/dsn/project-root.ts       | 200 +++++++++---------------------
 src/lib/dsn/scanner.ts            |  22 +---
 src/lib/dsn/types.ts              |  36 +-----
 test/lib/dsn/code-scanner.test.ts |  35 ++----
 8 files changed, 146 insertions(+), 338 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index e4955e3a..2812d331 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -13,7 +13,7 @@
  */
 
 import { readdir } from "node:fs/promises";
-import { extname, join, relative } from "node:path";
+import path from "node:path";
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/bun";
 import ignore, { type Ignore } from "ignore";
@@ -155,6 +155,21 @@ const COMMENT_PREFIXES = ["//", "#", "--", "<!--", "/*", "*", "'''", '"""'];
  */
 const PATH_SEPARATOR_PATTERN = /[/\\]/;
 
+/**
+ * Normalize path separators to forward slashes for cross-platform consistency.
+ * On POSIX systems, this is a no-op (identity function).
+ * On Windows, converts backslashes to forward slashes.
+ *
+ * This is needed for:
+ * 1. The `ignore` package pattern matching (requires forward slashes)
+ * 2. inferPackagePath() which splits by "/"
+ * 3. Consistent sourcePath values in DetectedDsn objects
+ */
+const normalizePath: (p: string) => string =
+  path.sep === path.posix.sep
+    ? (x) => x
+    : (x) => x.replaceAll(path.sep, path.posix.sep);
+
 /**
  * Pattern to match Sentry DSN URLs.
  * Captures the full DSN including protocol, public key, host, and project ID.
@@ -272,17 +287,7 @@ function isCommentedLine(trimmedLine: string): boolean {
   return COMMENT_PREFIXES.some((prefix) => trimmedLine.startsWith(prefix));
 }
 
-/** Track whether we've already warned about invalid SENTRY_URL (warn once per process) */
-let hasWarnedInvalidSentryUrl = false;
-
-/**
- * Reset the invalid SENTRY_URL warning state.
- * Exported for testing only - allows tests to reset state between runs.
- * @internal
- */
-export function _resetInvalidSentryUrlWarning(): void {
-  hasWarnedInvalidSentryUrl = false;
-}
+import { ConfigError } from "../errors.js";
 
 /**
  * Get the expected Sentry host for DSN validation.
@@ -290,8 +295,7 @@ export function _resetInvalidSentryUrlWarning(): void {
  * When SENTRY_URL is set (self-hosted), only DSNs matching that host are valid.
  * When not set (SaaS), only *.sentry.io DSNs are valid.
  *
- * If SENTRY_URL is set but invalid, logs a warning and falls back to SaaS behavior.
- *
+ * @throws {ConfigError} If SENTRY_URL is set but not a valid URL
  * @returns Object with host info for validation (never null)
  */
 function getExpectedHost(): { host: string; isSaas: boolean } {
@@ -303,14 +307,11 @@ function getExpectedHost(): { host: string; isSaas: boolean } {
       const url = new URL(sentryUrl);
       return { host: url.host, isSaas: false };
     } catch {
-      // Invalid SENTRY_URL - warn once and fall back to SaaS behavior
-      if (!hasWarnedInvalidSentryUrl) {
-        hasWarnedInvalidSentryUrl = true;
-        console.warn(
-          `Warning: SENTRY_URL "${sentryUrl}" is not a valid URL. Falling back to sentry.io for DSN detection.`
-        );
-      }
-      // Fall through to SaaS default
+      // Invalid SENTRY_URL - throw immediately since nothing will work
+      throw new ConfigError(
+        `SENTRY_URL "${sentryUrl}" is not a valid URL`,
+        "Set SENTRY_URL to a valid URL (e.g., https://sentry.example.com) or unset it to use sentry.io"
+      );
     }
   }
 
@@ -321,7 +322,7 @@ function getExpectedHost(): { host: string; isSaas: boolean } {
 /**
  * Validate that a DSN has an acceptable Sentry host.
  *
- * When SENTRY_URL is set (self-hosted): only DSNs matching that exact host are valid
+ * When SENTRY_URL is set (self-hosted): DSNs matching host or any subdomain are valid
  * When SENTRY_URL is not set (SaaS): only *.sentry.io DSNs are valid
  *
  * This ensures we don't detect SaaS DSNs when configured for self-hosted
@@ -335,15 +336,12 @@ function isValidDsnHost(dsn: string): boolean {
 
   const expected = getExpectedHost();
 
-  if (expected.isSaas) {
-    // SaaS: accept sentry.io or any subdomain (e.g., o123.ingest.us.sentry.io)
-    return (
-      parsed.host === expected.host || parsed.host.endsWith(`.${expected.host}`)
-    );
-  }
-
-  // Self-hosted: exact host match only
-  return parsed.host === expected.host;
+  // Accept exact match or any subdomain for both SaaS and self-hosted
+  // e.g., for sentry.io: accept sentry.io or o123.ingest.us.sentry.io
+  // e.g., for sentry.example.com: accept sentry.example.com or ingest.sentry.example.com
+  return (
+    parsed.host === expected.host || parsed.host.endsWith(`.${expected.host}`)
+  );
 }
 
 /**
@@ -357,7 +355,7 @@ async function createIgnoreFilter(cwd: string): Promise<Ignore> {
 
   // Then add .gitignore rules if present
   try {
-    const gitignorePath = join(cwd, ".gitignore");
+    const gitignorePath = path.join(cwd, ".gitignore");
     const content = await Bun.file(gitignorePath).text();
     ig.add(content);
   } catch {
@@ -371,7 +369,7 @@ async function createIgnoreFilter(cwd: string): Promise<Ignore> {
  * Check if a file should be scanned based on its extension.
  */
 function shouldScanFile(filename: string): boolean {
-  const ext = extname(filename);
+  const ext = path.extname(filename);
   return ext !== "" && TEXT_EXTENSIONS.has(ext);
 }
 
@@ -404,21 +402,20 @@ async function collectFiles(cwd: string, ig: Ignore): Promise<string[]> {
     }
 
     // Build relative path - entry.parentPath is the directory containing the entry
-    // Normalize to forward slashes for cross-platform consistency.
-    // Windows returns backslashes from path.relative(), but we need forward slashes for:
-    // 1. The `ignore` package pattern matching
-    // 2. inferPackagePath() which splits by "/"
-    // 3. Consistent sourcePath values in DetectedDsn objects
-    const relativePath = relative(
+    const rawRelativePath = path.relative(
       cwd,
-      join(entry.parentPath, entry.name)
-    ).replaceAll("\\", "/");
+      path.join(entry.parentPath, entry.name)
+    );
 
-    // Skip files beyond max depth
-    if (getPathDepth(relativePath) > MAX_SCAN_DEPTH) {
+    // Check depth early before more expensive operations
+    // Uses raw path (may have backslashes on Windows) since getPathDepth handles both
+    if (getPathDepth(rawRelativePath) > MAX_SCAN_DEPTH) {
       continue;
     }
 
+    // Normalize to forward slashes for cross-platform consistency
+    const relativePath = normalizePath(rawRelativePath);
+
     // Skip ignored paths (includes ALWAYS_SKIP_DIRS and .gitignore patterns)
     if (ig.ignores(relativePath)) {
       continue;
@@ -436,6 +433,11 @@ async function collectFiles(cwd: string, ig: Ignore): Promise<string[]> {
 /**
  * Process a single file and extract DSNs.
  *
+ * Note on Bun.file().size: This is a lazy property that reads file metadata
+ * (via stat) only when accessed, not the file content. This is verified in
+ * Bun's source code and is cheaper than a separate stat() call since it uses
+ * the already-created file handle.
+ *
  * @param cwd - Root directory
  * @param relativePath - Path relative to cwd
  * @param limit - Maximum DSNs to extract (undefined = no limit)
@@ -446,13 +448,12 @@ async function processFile(
   relativePath: string,
   limit?: number
 ): Promise<DetectedDsn[]> {
-  const filepath = join(cwd, relativePath);
+  const filepath = path.join(cwd, relativePath);
 
   try {
     const file = Bun.file(filepath);
 
-    // Skip large files - check happens here to avoid extra stat() calls during
-    // collection. Bun.file().size is cheap once we have the file handle.
+    // Skip large files (Bun.file().size reads metadata, not content)
     if (file.size > MAX_FILE_SIZE) {
       return [];
     }
diff --git a/src/lib/dsn/detector.ts b/src/lib/dsn/detector.ts
index a8cb9fe5..fa5ed4f0 100644
--- a/src/lib/dsn/detector.ts
+++ b/src/lib/dsn/detector.ts
@@ -34,10 +34,6 @@ import type {
   DsnSource,
 } from "./types.js";
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Main API
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Detect DSN with project root detection and caching support.
  *
@@ -167,10 +163,6 @@ export async function detectAllDsns(cwd: string): Promise<DsnDetectionResult> {
   };
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Cache Verification
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Check if a higher-priority code DSN exists.
  * Used to invalidate low-priority cached DSNs when code is added.
@@ -287,10 +279,6 @@ function extractDsnFromContent(
   }
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Full Scan
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Full scan to find first DSN (cache miss path)
  *
@@ -321,10 +309,6 @@ async function fullScanFirst(cwd: string): Promise<DetectedDsn | null> {
   return null;
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Helpers
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Get a human-readable description of where DSN was found
  *
diff --git a/src/lib/dsn/env-file.ts b/src/lib/dsn/env-file.ts
index 009c4da1..4992e747 100644
--- a/src/lib/dsn/env-file.ts
+++ b/src/lib/dsn/env-file.ts
@@ -15,10 +15,6 @@ import { scanSpecificFiles } from "./scanner.js";
 import type { DetectedDsn } from "./types.js";
 import { MONOREPO_ROOTS } from "./types.js";
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Constants
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * .env file names to search (in priority order).
  *
@@ -41,10 +37,6 @@ export const ENV_FILES = [
  */
 const ENV_DSN_PATTERN = /^SENTRY_DSN\s*=\s*(['"]?)(.+?)\1\s*(?:#.*)?$/;
 
-// ─────────────────────────────────────────────────────────────────────────────
-// DSN Extraction
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Extract SENTRY_DSN value from .env file content.
  *
@@ -85,10 +77,6 @@ export function extractDsnFromEnvContent(content: string): string | null {
 export const parseEnvFile = extractDsnFromEnvContent;
 export const extractDsnFromEnvFile = extractDsnFromEnvContent;
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Detection Functions
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Detect DSN from .env files in the given directory.
  *
@@ -148,10 +136,6 @@ export async function detectFromAllEnvFiles(
   return results;
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Monorepo Support
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Detect DSN from .env files in monorepo package directories.
  *
diff --git a/src/lib/dsn/index.ts b/src/lib/dsn/index.ts
index 72d9db04..ace7ee28 100644
--- a/src/lib/dsn/index.ts
+++ b/src/lib/dsn/index.ts
@@ -17,62 +17,28 @@
  * }
  */
 
-// ─────────────────────────────────────────────────────────────────────────────
+// Cache Management
+export {
+  clearDsnCache,
+  getCachedDsn,
+  setCachedDsn,
+  updateCachedResolution,
+} from "../db/dsn-cache.js";
 // Main Detection API
-// ─────────────────────────────────────────────────────────────────────────────
-
 export {
   detectAllDsns,
   detectDsn,
   getDsnSourceDescription,
 } from "./detector.js";
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Project Resolution
-// ─────────────────────────────────────────────────────────────────────────────
-
-export { getAccessibleProjects, resolveProject } from "./resolver.js";
-
-// ─────────────────────────────────────────────────────────────────────────────
 // Error Formatting
-// ─────────────────────────────────────────────────────────────────────────────
-
 export {
   formatConflictError,
   formatMultipleProjectsFooter,
   formatNoDsnError,
   formatResolutionError,
 } from "./errors.js";
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Cache Management
-// ─────────────────────────────────────────────────────────────────────────────
-
-export {
-  clearDsnCache,
-  getCachedDsn,
-  setCachedDsn,
-  updateCachedResolution,
-} from "../db/dsn-cache.js";
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Types
-// ─────────────────────────────────────────────────────────────────────────────
-
-export type {
-  CachedDsnEntry,
-  DetectedDsn,
-  DsnDetectionResult,
-  DsnSource,
-  ParsedDsn,
-  ResolvedProject,
-  ResolvedProjectInfo,
-} from "./types.js";
-
-// ─────────────────────────────────────────────────────────────────────────────
 // Utilities (for advanced use)
-// ─────────────────────────────────────────────────────────────────────────────
-
 export {
   createDetectedDsn,
   createDsnFingerprint,
@@ -81,10 +47,18 @@ export {
   isValidDsn,
   parseDsn,
 } from "./parser.js";
-
-// ─────────────────────────────────────────────────────────────────────────────
 // Project Root Detection
-// ─────────────────────────────────────────────────────────────────────────────
-
 export type { ProjectRootReason, ProjectRootResult } from "./project-root.js";
 export { findProjectRoot } from "./project-root.js";
+// Project Resolution
+export { getAccessibleProjects, resolveProject } from "./resolver.js";
+// Types
+export type {
+  CachedDsnEntry,
+  DetectedDsn,
+  DsnDetectionResult,
+  DsnSource,
+  ParsedDsn,
+  ResolvedProject,
+  ResolvedProjectInfo,
+} from "./types.js";
diff --git a/src/lib/dsn/project-root.ts b/src/lib/dsn/project-root.ts
index 04d5d27f..29cfaf62 100644
--- a/src/lib/dsn/project-root.ts
+++ b/src/lib/dsn/project-root.ts
@@ -22,13 +22,7 @@ import { ENV_FILES, extractDsnFromEnvContent } from "./env-file.js";
 import { createDetectedDsn } from "./parser.js";
 import type { DetectedDsn } from "./types.js";
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Types
-// ─────────────────────────────────────────────────────────────────────────────
-
-/**
- * Why a directory was chosen as project root
- */
+/** Why a directory was chosen as project root */
 export type ProjectRootReason =
   | "env_dsn" // Found .env with SENTRY_DSN
   | "vcs" // Version control (.git, .hg, etc.)
@@ -38,9 +32,7 @@ export type ProjectRootReason =
   | "build_system" // Build system marker
   | "fallback"; // No markers found, using cwd
 
-/**
- * Result of project root detection
- */
+/** Result of project root detection */
 export type ProjectRootResult = {
   /** The determined project root directory */
   projectRoot: string;
@@ -52,10 +44,6 @@ export type ProjectRootResult = {
   levelsTraversed: number;
 };
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Marker Definitions
-// ─────────────────────────────────────────────────────────────────────────────
-
 /** VCS directories - definitive repo root */
 const VCS_MARKERS = [
   ".git",
@@ -166,13 +154,12 @@ const BUILD_SYSTEM_MARKERS = [
   "Earthfile",
 ] as const;
 
-/** Regex for detecting root=true in .editorconfig (top-level for performance) */
+/**
+ * Regex for detecting root=true in .editorconfig.
+ * Leading whitespace is valid per EditorConfig spec (allows indentation).
+ */
 const EDITORCONFIG_ROOT_REGEX = /^\s*root\s*=\s*true\s*$/im;
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Telemetry Helpers
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Wrap a file system operation with a span for tracing.
  */
@@ -199,16 +186,12 @@ function withFsSpan<T>(
   );
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// File System Helpers (Parallelized)
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
- * Check if a path exists (file or directory)
+ * Check if a path exists (file or directory) using stat.
  */
-async function pathExists(path: string): Promise<boolean> {
+async function pathExists(filePath: string): Promise<boolean> {
   try {
-    await stat(path);
+    await stat(filePath);
     return true;
   } catch {
     return false;
@@ -216,19 +199,8 @@ async function pathExists(path: string): Promise<boolean> {
 }
 
 /**
- * Check if a file exists (async) - only for regular files
- */
-async function fileExists(path: string): Promise<boolean> {
-  try {
-    return await Bun.file(path).exists();
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Check if any of the given paths exist in a directory (parallel)
- * Works for both files and directories.
+ * Check if any of the given paths exist in a directory.
+ * Uses early exit - returns true as soon as first match is found.
  *
  * @param dir - Directory to check
  * @param names - Array of file/directory names to check
@@ -238,13 +210,17 @@ async function anyExists(
   dir: string,
   names: readonly string[]
 ): Promise<boolean> {
-  const checks = names.map((name) => pathExists(join(dir, name)));
-  const results = await Promise.all(checks);
-  return results.some((exists) => exists);
+  for (const name of names) {
+    if (await pathExists(join(dir, name))) {
+      return true;
+    }
+  }
+  return false;
 }
 
 /**
- * Check if any files matching glob patterns exist in a directory (parallel)
+ * Check if any files matching glob patterns exist in a directory.
+ * Uses early exit - returns true as soon as first match is found.
  *
  * @param dir - Directory to check
  * @param patterns - Glob patterns to match
@@ -254,24 +230,18 @@ async function anyGlobMatches(
   dir: string,
   patterns: readonly string[]
 ): Promise<boolean> {
-  const checks = patterns.map(async (pattern) => {
+  for (const pattern of patterns) {
     const glob = new Bun.Glob(pattern);
     for await (const _match of glob.scan({ cwd: dir, onlyFiles: true })) {
       return true; // Found at least one match
     }
-    return false;
-  });
-
-  const results = await Promise.all(checks);
-  return results.some((found) => found);
+  }
+  return false;
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Marker Detection Functions
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
- * Check if .editorconfig exists and contains root=true
+ * Check if .editorconfig exists and contains root=true.
+ * Reads file directly and handles ENOENT gracefully.
  *
  * @param dir - Directory to check
  * @returns True if .editorconfig with root=true found
@@ -279,19 +249,17 @@ async function anyGlobMatches(
 async function checkEditorConfigRoot(dir: string): Promise<boolean> {
   const editorConfigPath = join(dir, ".editorconfig");
   try {
-    const file = Bun.file(editorConfigPath);
-    if (!(await file.exists())) {
-      return false;
-    }
-    const content = await file.text();
+    const content = await Bun.file(editorConfigPath).text();
     return EDITORCONFIG_ROOT_REGEX.test(content);
   } catch {
+    // File doesn't exist or can't be read
     return false;
   }
 }
 
 /**
- * Determine the type of repo root marker found
+ * Determine the type of repo root marker found.
+ * Returns in priority order: VCS > CI > editorconfig.
  */
 function getRepoRootType(
   hasVcs: boolean,
@@ -340,12 +308,11 @@ export function hasRepoRootMarker(
  */
 export function hasLanguageMarker(dir: string): Promise<boolean> {
   return withFsSpan("hasLanguageMarker", async () => {
-    // Check exact filenames and glob patterns in parallel
-    const [hasExact, hasGlob] = await Promise.all([
-      anyExists(dir, LANGUAGE_MARKERS),
-      anyGlobMatches(dir, LANGUAGE_MARKER_GLOBS),
-    ]);
-    return hasExact || hasGlob;
+    // Check exact filenames first (more common), then glob patterns
+    if (await anyExists(dir, LANGUAGE_MARKERS)) {
+      return true;
+    }
+    return anyGlobMatches(dir, LANGUAGE_MARKER_GLOBS);
   });
 }
 
@@ -361,64 +328,34 @@ export function hasBuildSystemMarker(dir: string): Promise<boolean> {
   );
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// DSN Detection in .env Files
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
- * Check .env files in a directory for SENTRY_DSN
- *
- * Checks files in priority order and returns immediately on first match.
+ * Check .env files in a directory for SENTRY_DSN.
+ * Reads files directly and handles ENOENT gracefully.
  *
  * @param dir - Directory to check
  * @returns Detected DSN or null
  */
 function checkEnvForDsn(dir: string): Promise<DetectedDsn | null> {
   return withFsSpan("checkEnvForDsn", async () => {
-    // Check all env files in parallel for existence
-    const existenceChecks = ENV_FILES.map(async (filename) => {
-      const path = join(dir, filename);
-      const exists = await fileExists(path);
-      return { filename, path, exists };
-    });
-
-    const results = await Promise.all(existenceChecks);
-    const existingFiles = results.filter((r) => r.exists);
-
-    // Read existing files in parallel
-    const contentChecks = existingFiles.map(async ({ filename, path }) => {
+    // Check env files in priority order, stop on first DSN found
+    for (const filename of ENV_FILES) {
+      const filePath = join(dir, filename);
       try {
-        const content = await Bun.file(path).text();
+        const content = await Bun.file(filePath).text();
         const dsn = extractDsnFromEnvContent(content);
-        return dsn ? { dsn, filename } : null;
+        if (dsn) {
+          return createDetectedDsn(dsn, "env_file", filename);
+        }
       } catch {
-        return null;
-      }
-    });
-
-    const dsnResults = await Promise.all(contentChecks);
-
-    // Return first found DSN (respecting priority order)
-    for (const filename of ENV_FILES) {
-      const found = dsnResults.find(
-        (r) => r !== null && r.filename === filename
-      );
-      if (found) {
-        return createDetectedDsn(found.dsn, "env_file", found.filename);
+        // File doesn't exist or can't be read - continue to next file
       }
     }
-
     return null;
   });
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Main API
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Get the stop boundary for project root search.
- *
  * Returns home directory if it exists, otherwise filesystem root.
  */
 export function getStopBoundary(): string {
@@ -453,22 +390,6 @@ async function processDirectoryLevel(
   return { dsnResult, repoRootResult, hasLang, hasBuild };
 }
 
-/**
- * Convert repo root type to project root reason
- */
-function repoRootTypeToReason(
-  type: "vcs" | "ci" | "editorconfig" | undefined
-): ProjectRootReason {
-  switch (type) {
-    case "editorconfig":
-      return "editorconfig";
-    case "ci":
-      return "ci";
-    default:
-      return "vcs";
-  }
-}
-
 /**
  * Determine the final project root from candidates
  */
@@ -486,9 +407,7 @@ function selectProjectRoot(
   return { projectRoot: fallback, reason: "fallback" };
 }
 
-/**
- * State tracked during directory walk-up
- */
+/** State tracked during directory walk-up */
 type WalkState = {
   currentDir: string;
   levelsTraversed: number;
@@ -513,7 +432,8 @@ function createDsnFoundResult(
 }
 
 /**
- * Create result when repo root marker is found
+ * Create result when repo root marker is found.
+ * Maps marker type to reason (defaults to "vcs" for undefined).
  */
 function createRepoRootResult(
   currentDir: string,
@@ -522,13 +442,18 @@ function createRepoRootResult(
 ): ProjectRootResult {
   return {
     projectRoot: currentDir,
-    reason: repoRootTypeToReason(markerType),
+    reason: markerType ?? "vcs",
     levelsTraversed,
   };
 }
 
 /**
- * Walk up directories searching for project root
+ * Walk up directories searching for project root.
+ *
+ * Loop logic:
+ * 1. Always process starting directory (do-while ensures this)
+ * 2. Stop at stopBoundary AFTER processing it (break before moving to parent)
+ * 3. Stop at filesystem root (parentDir === currentDir)
  */
 async function walkUpDirectories(
   resolvedStart: string,
@@ -541,7 +466,7 @@ async function walkUpDirectories(
     buildSystemAt: null,
   };
 
-  // Use do-while to ensure starting directory is always checked,
+  // do-while ensures starting directory is always checked,
   // even when it equals the stop boundary (e.g., user runs from home dir)
   do {
     state.levelsTraversed += 1;
@@ -581,19 +506,16 @@ async function walkUpDirectories(
       state.buildSystemAt = state.currentDir;
     }
 
-    // Stop at boundary BEFORE moving to parent - this ensures we don't
-    // traverse past home directory when starting there
-    if (state.currentDir === stopBoundary) {
-      break;
-    }
-
-    // Move to parent directory
+    // Move to parent directory (or stop if at boundary/root)
     const parentDir = dirname(state.currentDir);
-    if (parentDir === state.currentDir) {
-      break; // Reached filesystem root
+    const shouldStop =
+      state.currentDir === stopBoundary || parentDir === state.currentDir;
+    if (shouldStop) {
+      break;
     }
     state.currentDir = parentDir;
-  } while (state.currentDir !== "/");
+    // biome-ignore lint/correctness/noConstantCondition: loop exits via break
+  } while (true);
 
   // Determine project root from candidates (priority order)
   const selected = selectProjectRoot(
diff --git a/src/lib/dsn/scanner.ts b/src/lib/dsn/scanner.ts
index 025c435c..e68a14ad 100644
--- a/src/lib/dsn/scanner.ts
+++ b/src/lib/dsn/scanner.ts
@@ -8,13 +8,7 @@
 import { join } from "node:path";
 import type { DetectedDsn } from "./types.js";
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Types
-// ─────────────────────────────────────────────────────────────────────────────
-
-/**
- * Result of processing a single file for DSN extraction.
- */
+/** Result of processing a single file for DSN extraction. */
 export type FileProcessResult = {
   /** Extracted DSN string (null if not found) */
   dsn: string | null;
@@ -36,10 +30,6 @@ export type FileProcessor = (
   content: string
 ) => FileProcessResult | null;
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Scanner
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Scan specific files (not glob) and extract DSNs.
  *
@@ -68,14 +58,10 @@ export async function scanSpecificFiles(
 
   for (const filename of filenames) {
     const filepath = join(cwd, filename);
-    const file = Bun.file(filepath);
-
-    if (!(await file.exists())) {
-      continue;
-    }
 
     try {
-      const content = await file.text();
+      // Read file directly - handles ENOENT gracefully
+      const content = await Bun.file(filepath).text();
       const result = processFile(filename, content);
 
       if (result?.dsn) {
@@ -89,7 +75,7 @@ export async function scanSpecificFiles(
         }
       }
     } catch {
-      // Skip files we can't read
+      // File doesn't exist or can't be read - continue to next
     }
   }
 
diff --git a/src/lib/dsn/types.ts b/src/lib/dsn/types.ts
index 3364de1c..7e94a5f1 100644
--- a/src/lib/dsn/types.ts
+++ b/src/lib/dsn/types.ts
@@ -6,10 +6,6 @@
 
 import { z } from "zod";
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Core Types
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Source where DSN was detected from
  *
@@ -51,13 +47,7 @@ export type DetectedDsn = ParsedDsn & {
   resolved?: ResolvedProjectInfo;
 };
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Resolution Types
-// ─────────────────────────────────────────────────────────────────────────────
-
-/**
- * Resolved project information from Sentry API
- */
+/** Resolved project information from Sentry API */
 export type ResolvedProjectInfo = {
   orgSlug: string;
   orgName: string;
@@ -65,19 +55,13 @@ export type ResolvedProjectInfo = {
   projectName: string;
 };
 
-/**
- * Full resolved project with DSN and source info
- */
+/** Full resolved project with DSN and source info */
 export type ResolvedProject = ResolvedProjectInfo & {
   dsn: DetectedDsn;
   /** Human-readable description of where DSN was found */
   sourceDescription: string;
 };
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Cache Types
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Cached DSN entry with full resolution info
  *
@@ -100,9 +84,7 @@ export type CachedDsnEntry = {
   cachedAt: number;
 };
 
-/**
- * Zod schema for ResolvedProjectInfo
- */
+/** Zod schema for ResolvedProjectInfo */
 export const ResolvedProjectInfoSchema = z.object({
   orgSlug: z.string(),
   orgName: z.string(),
@@ -110,9 +92,7 @@ export const ResolvedProjectInfoSchema = z.object({
   projectName: z.string(),
 });
 
-/**
- * Zod schema for cached DSN entries (for config validation)
- */
+/** Zod schema for cached DSN entries (for config validation) */
 export const CachedDsnEntrySchema = z.object({
   dsn: z.string(),
   projectId: z.string(),
@@ -123,10 +103,6 @@ export const CachedDsnEntrySchema = z.object({
   cachedAt: z.number(),
 });
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Detection Result Types
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Result of DSN detection with support for monorepos.
  *
@@ -144,10 +120,6 @@ export type DsnDetectionResult = {
   language?: string;
 };
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Constants
-// ─────────────────────────────────────────────────────────────────────────────
-
 /**
  * Common monorepo root directories to scan for packages/apps with their own DSN.
  * Used by both env-file detection and package path inference.
diff --git a/test/lib/dsn/code-scanner.test.ts b/test/lib/dsn/code-scanner.test.ts
index 1fb1d5ed..d89fa5b2 100644
--- a/test/lib/dsn/code-scanner.test.ts
+++ b/test/lib/dsn/code-scanner.test.ts
@@ -2,7 +2,6 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import {
-  _resetInvalidSentryUrlWarning,
   extractDsnsFromContent,
   extractFirstDsnFromContent,
   scanCodeForDsns,
@@ -19,7 +18,6 @@ describe("Code Scanner", () => {
   afterEach(() => {
     rmSync(testDir, { recursive: true, force: true });
     delete process.env.SENTRY_URL;
-    _resetInvalidSentryUrlWarning();
   });
 
   describe("extractDsnsFromContent", () => {
@@ -183,29 +181,16 @@ describe("Code Scanner", () => {
       expect(dsns).toEqual(["https://def@sentry.mycompany.com:9000/789"]);
     });
 
-    test("falls back to SaaS when SENTRY_URL is invalid", () => {
-      // Capture console.warn to verify warning is emitted
-      const warnings: string[] = [];
-      const originalWarn = console.warn;
-      console.warn = (msg: string) => warnings.push(msg);
-
-      try {
-        process.env.SENTRY_URL = "not-a-valid-url";
-        const content = `
-          const SAAS_DSN = "https://abc@o123.ingest.sentry.io/456";
-        `;
-        const dsns = extractDsnsFromContent(content);
-
-        // Should accept SaaS DSNs when SENTRY_URL is invalid (fallback behavior)
-        expect(dsns).toEqual(["https://abc@o123.ingest.sentry.io/456"]);
-
-        // Should have warned about the invalid URL
-        expect(warnings.length).toBeGreaterThan(0);
-        expect(warnings[0]).toContain("not-a-valid-url");
-        expect(warnings[0]).toContain("not a valid URL");
-      } finally {
-        console.warn = originalWarn;
-      }
+    test("throws ConfigError when SENTRY_URL is invalid", () => {
+      process.env.SENTRY_URL = "not-a-valid-url";
+      const content = `
+        const SAAS_DSN = "https://abc@o123.ingest.sentry.io/456";
+      `;
+
+      // Invalid SENTRY_URL should throw immediately since nothing will work
+      expect(() => extractDsnsFromContent(content)).toThrow(
+        /SENTRY_URL.*not a valid URL/
+      );
     });
   });
 

From a84bec3020ef31786481433ad7d3e4703ed7dc58 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Wed, 4 Feb 2026 12:15:06 +0000
Subject: [PATCH 14/19] refactor: remove unnecessary String() casts in metrics
 attributes

---
 src/lib/dsn/code-scanner.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index 2812d331..ed2c62cc 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -588,7 +588,7 @@ function scanDirectory(
 
       span.setAttribute("dsn.files_collected", files.length);
       Sentry.metrics.distribution("dsn.files_collected", files.length, {
-        attributes: { stop_on_first: String(stopOnFirst) },
+        attributes: { stop_on_first: stopOnFirst },
       });
 
       if (files.length === 0) {
@@ -609,10 +609,10 @@ function scanDirectory(
       });
 
       Sentry.metrics.distribution("dsn.files_scanned", filesScanned, {
-        attributes: { stop_on_first: String(stopOnFirst) },
+        attributes: { stop_on_first: stopOnFirst },
       });
       Sentry.metrics.distribution("dsn.dsns_found", results.size, {
-        attributes: { stop_on_first: String(stopOnFirst) },
+        attributes: { stop_on_first: stopOnFirst },
       });
 
       span.setStatus({ code: 1 });

From cdda86003e0f487dff61227ef95493206ffe4900 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Wed, 4 Feb 2026 12:19:47 +0000
Subject: [PATCH 15/19] chore: add TODO comments for debug logging

---
 src/lib/dsn/code-scanner.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index ed2c62cc..3debca42 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -455,6 +455,7 @@ async function processFile(
 
     // Skip large files (Bun.file().size reads metadata, not content)
     if (file.size > MAX_FILE_SIZE) {
+      // TODO: Add debug log when logging infrastructure is available
       return [];
     }
 
@@ -472,7 +473,7 @@ async function processFile(
       .map((dsn) => createDetectedDsn(dsn, "code", relativePath, packagePath))
       .filter((d): d is DetectedDsn => d !== null);
   } catch {
-    // Skip files we can't read
+    // TODO: Add warning log for unreadable files when logging infrastructure is available
     return [];
   }
 }

From 2ad60ad7600aa9091d34e4560b4ba52177ba66c8 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Wed, 4 Feb 2026 12:21:14 +0000
Subject: [PATCH 16/19] perf: run anyExists and anyGlobMatches in parallel with
 early exit

Instead of sequential for-loop, now runs all checks in parallel
and resolves immediately when any returns true.
---
 src/lib/dsn/project-root.ts | 71 +++++++++++++++++++++++++++----------
 1 file changed, 53 insertions(+), 18 deletions(-)

diff --git a/src/lib/dsn/project-root.ts b/src/lib/dsn/project-root.ts
index 29cfaf62..551dfae9 100644
--- a/src/lib/dsn/project-root.ts
+++ b/src/lib/dsn/project-root.ts
@@ -200,43 +200,78 @@ async function pathExists(filePath: string): Promise<boolean> {
 
 /**
  * Check if any of the given paths exist in a directory.
- * Uses early exit - returns true as soon as first match is found.
+ * Runs checks in parallel and resolves as soon as any returns true.
  *
  * @param dir - Directory to check
  * @param names - Array of file/directory names to check
  * @returns True if any path exists
  */
-async function anyExists(
-  dir: string,
-  names: readonly string[]
-): Promise<boolean> {
-  for (const name of names) {
-    if (await pathExists(join(dir, name))) {
-      return true;
-    }
+function anyExists(dir: string, names: readonly string[]): Promise<boolean> {
+  if (names.length === 0) {
+    return Promise.resolve(false);
   }
-  return false;
+
+  return new Promise((done) => {
+    let pending = names.length;
+
+    const checkDone = () => {
+      pending -= 1;
+      if (pending === 0) {
+        done(false);
+      }
+    };
+
+    for (const name of names) {
+      pathExists(join(dir, name))
+        .then((exists) => {
+          if (exists) {
+            done(true);
+          } else {
+            checkDone();
+          }
+        })
+        .catch(checkDone);
+    }
+  });
 }
 
 /**
  * Check if any files matching glob patterns exist in a directory.
- * Uses early exit - returns true as soon as first match is found.
+ * Runs pattern checks in parallel and resolves as soon as any finds a match.
  *
  * @param dir - Directory to check
  * @param patterns - Glob patterns to match
  * @returns True if any matching file exists
  */
-async function anyGlobMatches(
+function anyGlobMatches(
   dir: string,
   patterns: readonly string[]
 ): Promise<boolean> {
-  for (const pattern of patterns) {
-    const glob = new Bun.Glob(pattern);
-    for await (const _match of glob.scan({ cwd: dir, onlyFiles: true })) {
-      return true; // Found at least one match
-    }
+  if (patterns.length === 0) {
+    return Promise.resolve(false);
   }
-  return false;
+
+  return new Promise((done) => {
+    let pending = patterns.length;
+
+    const checkDone = () => {
+      pending -= 1;
+      if (pending === 0) {
+        done(false);
+      }
+    };
+
+    for (const pattern of patterns) {
+      const glob = new Bun.Glob(pattern);
+      (async () => {
+        for await (const _match of glob.scan({ cwd: dir, onlyFiles: true })) {
+          done(true);
+          return;
+        }
+        checkDone();
+      })().catch(checkDone);
+    }
+  });
 }
 
 /**

From af47dce56566053e29677659243ac4e13523294f Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Wed, 4 Feb 2026 12:43:31 +0000
Subject: [PATCH 17/19] refactor: move import to top, remove unused isSaas
 field, add stopOnFirst comment

- Move ConfigError import from middle of file to import block
- Simplify getExpectedHost() to return string instead of object with unused isSaas
- Add comment explaining stopOnFirst deduplication logic in processFileAndCollect
---
 src/lib/dsn/code-scanner.ts | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index 3debca42..3bb740ea 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -19,6 +19,7 @@ import * as Sentry from "@sentry/bun";
 import ignore, { type Ignore } from "ignore";
 import pLimit from "p-limit";
 import { DEFAULT_SENTRY_HOST } from "../constants.js";
+import { ConfigError } from "../errors.js";
 import { createDetectedDsn, inferPackagePath, parseDsn } from "./parser.js";
 import type { DetectedDsn } from "./types.js";
 
@@ -287,8 +288,6 @@ function isCommentedLine(trimmedLine: string): boolean {
   return COMMENT_PREFIXES.some((prefix) => trimmedLine.startsWith(prefix));
 }
 
-import { ConfigError } from "../errors.js";
-
 /**
  * Get the expected Sentry host for DSN validation.
  *
@@ -296,16 +295,16 @@ import { ConfigError } from "../errors.js";
  * When not set (SaaS), only *.sentry.io DSNs are valid.
  *
  * @throws {ConfigError} If SENTRY_URL is set but not a valid URL
- * @returns Object with host info for validation (never null)
+ * @returns The expected host domain for DSN validation
  */
-function getExpectedHost(): { host: string; isSaas: boolean } {
+function getExpectedHost(): string {
   const sentryUrl = process.env.SENTRY_URL;
 
   if (sentryUrl) {
     // Self-hosted: only accept DSNs matching the configured host
     try {
       const url = new URL(sentryUrl);
-      return { host: url.host, isSaas: false };
+      return url.host;
     } catch {
       // Invalid SENTRY_URL - throw immediately since nothing will work
       throw new ConfigError(
@@ -316,7 +315,7 @@ function getExpectedHost(): { host: string; isSaas: boolean } {
   }
 
   // SaaS: only accept *.sentry.io
-  return { host: DEFAULT_SENTRY_HOST, isSaas: true };
+  return DEFAULT_SENTRY_HOST;
 }
 
 /**
@@ -334,13 +333,13 @@ function isValidDsnHost(dsn: string): boolean {
     return false;
   }
 
-  const expected = getExpectedHost();
+  const expectedHost = getExpectedHost();
 
   // Accept exact match or any subdomain for both SaaS and self-hosted
   // e.g., for sentry.io: accept sentry.io or o123.ingest.us.sentry.io
   // e.g., for sentry.example.com: accept sentry.example.com or ingest.sentry.example.com
   return (
-    parsed.host === expected.host || parsed.host.endsWith(`.${expected.host}`)
+    parsed.host === expectedHost || parsed.host.endsWith(`.${expectedHost}`)
   );
 }
 
@@ -503,6 +502,9 @@ async function processFileAndCollect(
   for (const dsn of dsns) {
     if (!state.results.has(dsn.raw)) {
       state.results.set(dsn.raw, dsn);
+      // When stopOnFirst is true, processFile returns at most 1 DSN per file.
+      // This check triggers early exit when we find the first *unique* DSN,
+      // handling the case where the same DSN appears in multiple files.
       if (stopOnFirst) {
         return true;
       }

From 3185989c66d07124cd8b87a2f95e3c83da9d1f61 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Wed, 4 Feb 2026 12:45:18 +0000
Subject: [PATCH 18/19] refactor: clarify task construction and add JSDoc for
 getRepoRootType

- Extract processWithLimit for clearer rate-limited file processing
- Add JSDoc explaining why getRepoRootType only handles VCS/CI/editorconfig
---
 src/lib/dsn/code-scanner.ts | 8 ++++----
 src/lib/dsn/project-root.ts | 4 ++++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/lib/dsn/code-scanner.ts b/src/lib/dsn/code-scanner.ts
index 3bb740ea..0e20f8b8 100644
--- a/src/lib/dsn/code-scanner.ts
+++ b/src/lib/dsn/code-scanner.ts
@@ -533,7 +533,8 @@ async function scanFilesForDsns(
     earlyExit: false,
   };
 
-  const tasks = files.map((file) =>
+  // Create a rate-limited processor that handles early exit
+  const processWithLimit = (file: string) =>
     limit(async () => {
       if (state.earlyExit) {
         return;
@@ -550,10 +551,9 @@ async function scanFilesForDsns(
         state.earlyExit = true;
         limit.clearQueue();
       }
-    })
-  );
+    });
 
-  await Promise.all(tasks);
+  await Promise.all(files.map(processWithLimit));
 
   return { results: state.results, filesScanned: state.filesScanned };
 }
diff --git a/src/lib/dsn/project-root.ts b/src/lib/dsn/project-root.ts
index 551dfae9..4172debc 100644
--- a/src/lib/dsn/project-root.ts
+++ b/src/lib/dsn/project-root.ts
@@ -295,6 +295,10 @@ async function checkEditorConfigRoot(dir: string): Promise<boolean> {
 /**
  * Determine the type of repo root marker found.
  * Returns in priority order: VCS > CI > editorconfig.
+ *
+ * Note: This only handles "definitive" repo root markers (VCS, CI, editorconfig).
+ * Language and build markers are handled separately in walkUpDirectories() because
+ * they indicate project boundaries but don't definitively mark the repository root.
  */
 function getRepoRootType(
   hasVcs: boolean,

From 6194d53a236714c7f10b1ba9285148a2363ef385 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Wed, 4 Feb 2026 13:05:39 +0000
Subject: [PATCH 19/19] refactor: add explicit error handling for file system
 operations

- Add fs-utils.ts with isIgnorableFileError and handleFileError helpers
- Replace blanket catch blocks with explicit ENOENT/EACCES checks
- Report unexpected file system errors to Sentry for investigation
- Applied to scanSpecificFiles, checkEditorConfigRoot, checkEnvForDsn
---
 src/lib/dsn/fs-utils.ts     | 51 +++++++++++++++++++++++++++++++++++++
 src/lib/dsn/project-root.ts | 12 ++++++---
 src/lib/dsn/scanner.ts      |  8 ++++--
 3 files changed, 65 insertions(+), 6 deletions(-)
 create mode 100644 src/lib/dsn/fs-utils.ts

diff --git a/src/lib/dsn/fs-utils.ts b/src/lib/dsn/fs-utils.ts
new file mode 100644
index 00000000..216107dc
--- /dev/null
+++ b/src/lib/dsn/fs-utils.ts
@@ -0,0 +1,51 @@
+/**
+ * File System Utilities for DSN Detection
+ *
+ * Shared utilities for handling file system errors during scanning.
+ */
+
+// biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
+import * as Sentry from "@sentry/bun";
+
+/**
+ * Check if an error is an expected file system error that should be silently ignored.
+ *
+ * Expected errors during file scanning:
+ * - ENOENT: File or directory does not exist
+ * - EACCES: Permission denied (e.g., no read access)
+ *
+ * All other errors are unexpected and should be reported to Sentry.
+ *
+ * @param error - The error to check
+ * @returns True if the error is expected and should be ignored
+ */
+export function isIgnorableFileError(error: unknown): boolean {
+  if (error instanceof Error && "code" in error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    return code === "ENOENT" || code === "EACCES";
+  }
+  return false;
+}
+
+/**
+ * Handle a file system error by either ignoring it (for expected errors)
+ * or capturing it to Sentry (for unexpected errors).
+ *
+ * @param error - The error that occurred
+ * @param context - Additional context for Sentry (e.g., file path, operation)
+ */
+export function handleFileError(
+  error: unknown,
+  context: { operation: string; path?: string }
+): void {
+  if (!isIgnorableFileError(error)) {
+    Sentry.captureException(error, {
+      tags: {
+        operation: context.operation,
+      },
+      extra: {
+        path: context.path,
+      },
+    });
+  }
+}
diff --git a/src/lib/dsn/project-root.ts b/src/lib/dsn/project-root.ts
index 4172debc..f0dcbbe0 100644
--- a/src/lib/dsn/project-root.ts
+++ b/src/lib/dsn/project-root.ts
@@ -19,6 +19,7 @@ import { dirname, join, resolve } from "node:path";
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/bun";
 import { ENV_FILES, extractDsnFromEnvContent } from "./env-file.js";
+import { handleFileError } from "./fs-utils.js";
 import { createDetectedDsn } from "./parser.js";
 import type { DetectedDsn } from "./types.js";
 
@@ -286,8 +287,11 @@ async function checkEditorConfigRoot(dir: string): Promise<boolean> {
   try {
     const content = await Bun.file(editorConfigPath).text();
     return EDITORCONFIG_ROOT_REGEX.test(content);
-  } catch {
-    // File doesn't exist or can't be read
+  } catch (error) {
+    handleFileError(error, {
+      operation: "checkEditorConfigRoot",
+      path: editorConfigPath,
+    });
     return false;
   }
 }
@@ -385,8 +389,8 @@ function checkEnvForDsn(dir: string): Promise<DetectedDsn | null> {
         if (dsn) {
           return createDetectedDsn(dsn, "env_file", filename);
         }
-      } catch {
-        // File doesn't exist or can't be read - continue to next file
+      } catch (error) {
+        handleFileError(error, { operation: "checkEnvForDsn", path: filePath });
       }
     }
     return null;
diff --git a/src/lib/dsn/scanner.ts b/src/lib/dsn/scanner.ts
index e68a14ad..868051a8 100644
--- a/src/lib/dsn/scanner.ts
+++ b/src/lib/dsn/scanner.ts
@@ -6,6 +6,7 @@
  */
 
 import { join } from "node:path";
+import { handleFileError } from "./fs-utils.js";
 import type { DetectedDsn } from "./types.js";
 
 /** Result of processing a single file for DSN extraction. */
@@ -74,8 +75,11 @@ export async function scanSpecificFiles(
           }
         }
       }
-    } catch {
-      // File doesn't exist or can't be read - continue to next
+    } catch (error) {
+      handleFileError(error, {
+        operation: "scanSpecificFiles",
+        path: filepath,
+      });
     }
   }