feat(dsn): extend --fresh flag to bypass DSN detection cache

After the scanner fix, stale cached results (with fewer DSNs) survive
because mtime validation only checks files that were previously found.
Users had no way to force a re-scan short of manually clearing SQLite.

Add disableDsnCache()/enableDsnCache() following the same pattern as
disableResponseCache(), and wire it into applyFreshFlag() so --fresh
now bypasses both HTTP response cache and DSN detection cache.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: betegon

src/lib/db/dsn-cache.ts

@@ -19,6 +19,30 @@ import { runUpsert } from "./utils.js";
 /** Cache TTL in milliseconds (24 hours) */
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 
+/**
+ * Module-level flag to disable DSN cache reads.
+ * When true, getCachedDsn() and getCachedDetection() return undefined.
+ * Cache writes still proceed so the re-scanned result gets stored.
+ */
+let dsnCacheDisabled = false;
+
+/**
+ * Disable DSN cache reads for this invocation.
+ * Called when `--fresh` is set to force a full re-scan.
+ */
+export function disableDsnCache(): void {
+  dsnCacheDisabled = true;
+}
+
+/**
+ * Re-enable DSN cache reads after `disableDsnCache()` was called.
+ * Only needed in tests to prevent one test's `--fresh` flag from
+ * leaking into subsequent tests.
+ */
+export function enableDsnCache(): void {
+  dsnCacheDisabled = false;
+}
+
 /** Row type matching the dsn_cache table schema (including v4 columns) */
 type DsnCacheRow = {
   directory: string;
@@ -116,6 +140,10 @@ function touchCacheEntry(directory: string): void {
 export async function getCachedDsn(
   directory: string
 ): Promise<CachedDsnEntry | undefined> {
+  if (dsnCacheDisabled) {
+    return;
+  }
+
   const db = getDatabase();
 
   const row = db
@@ -301,6 +329,10 @@ async function validateDirMtimes(
 export async function getCachedDetection(
   projectRoot: string
 ): Promise<CachedDetection | undefined> {
+  if (dsnCacheDisabled) {
+    return;
+  }
+
   const db = getDatabase();
 
   const row = db

src/lib/dsn/index.ts

@@ -20,6 +20,8 @@
 // Cache Management
 export {
   clearDsnCache,
+  disableDsnCache,
+  enableDsnCache,
   getCachedDsn,
   setCachedDsn,
   updateCachedResolution,

src/lib/list-command.ts

@@ -17,6 +17,7 @@ import type { Aliases, Command, CommandContext } from "@stricli/core";
 import type { SentryContext } from "../context.js";
 import { parseOrgProjectArg } from "./arg-parsing.js";
 import { buildCommand, numberParser } from "./command.js";
+import { disableDsnCache } from "./dsn/index.js";
 import { warning } from "./formatters/colors.js";
 import type { CommandOutput, OutputConfig } from "./formatters/output.js";
 import {
@@ -110,7 +111,7 @@ export const LIST_JSON_FLAG = {
  */
 export const FRESH_FLAG = {
   kind: "boolean" as const,
-  brief: "Bypass cache and fetch fresh data",
+  brief: "Bypass cache, re-detect projects, and fetch fresh data",
   default: false,
 } as const;
 
@@ -140,6 +141,7 @@ export const FRESH_ALIASES = { f: "fresh" } as const;
 export function applyFreshFlag(flags: { readonly fresh: boolean }): void {
   if (flags.fresh) {
     disableResponseCache();
+    disableDsnCache();
   }
 }
 

test/lib/db/dsn-cache.test.ts

@@ -9,6 +9,8 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import {
   clearDsnCache,
+  disableDsnCache,
+  enableDsnCache,
   getCachedDetection,
   getCachedDsn,
   setCachedDetection,
@@ -36,6 +38,7 @@ beforeEach(async () => {
 });
 
 afterEach(async () => {
+  enableDsnCache();
   delete process.env.SENTRY_CLI_CONFIG_DIR;
   await cleanupTestDir(testConfigDir);
 });
@@ -173,10 +176,6 @@ describe("clearDsnCache", () => {
   });
 });
 
-// =============================================================================
-// Full Detection Cache Tests (v4 functionality)
-// =============================================================================
-
 const createTestDsn = (overrides: Partial<DetectedDsn> = {}): DetectedDsn => ({
   protocol: "https",
   publicKey: "testkey",
@@ -189,6 +188,81 @@ const createTestDsn = (overrides: Partial<DetectedDsn> = {}): DetectedDsn => ({
   ...overrides,
 });
 
+// =============================================================================
+// Cache Bypass Tests (--fresh flag support)
+// =============================================================================
+
+describe("disableDsnCache / enableDsnCache", () => {
+  test("getCachedDsn returns undefined when cache is disabled", async () => {
+    await setCachedDsn(testProjectDir, {
+      dsn: "https://abc@o123.ingest.sentry.io/456",
+      projectId: "456",
+      orgId: "123",
+      source: "code",
+    });
+
+    // Verify it exists before disabling
+    expect(await getCachedDsn(testProjectDir)).toBeDefined();
+
+    disableDsnCache();
+    expect(await getCachedDsn(testProjectDir)).toBeUndefined();
+
+    // Re-enable and verify it's still there
+    enableDsnCache();
+    expect(await getCachedDsn(testProjectDir)).toBeDefined();
+  });
+
+  test("getCachedDetection returns undefined when cache is disabled", async () => {
+    const testDsn = createTestDsn();
+    const sourceMtimes = {
+      "src/app.ts": Bun.file(join(testProjectDir, "src/app.ts")).lastModified,
+    };
+    const { stat } = await import("node:fs/promises");
+    const rootStats = await stat(testProjectDir);
+    const rootDirMtime = Math.floor(rootStats.mtimeMs);
+
+    await setCachedDetection(testProjectDir, {
+      fingerprint: "test-fp",
+      allDsns: [testDsn],
+      sourceMtimes,
+      dirMtimes: {},
+      rootDirMtime,
+    });
+
+    // Verify it exists before disabling
+    expect(await getCachedDetection(testProjectDir)).toBeDefined();
+
+    disableDsnCache();
+    expect(await getCachedDetection(testProjectDir)).toBeUndefined();
+
+    enableDsnCache();
+    expect(await getCachedDetection(testProjectDir)).toBeDefined();
+  });
+
+  test("cache writes still work when disabled", async () => {
+    disableDsnCache();
+
+    // Write while disabled
+    await setCachedDsn(testProjectDir, {
+      dsn: "https://abc@o123.ingest.sentry.io/456",
+      projectId: "456",
+      source: "code",
+    });
+
+    // Can't read while disabled
+    expect(await getCachedDsn(testProjectDir)).toBeUndefined();
+
+    // Re-enable and verify the write persisted
+    enableDsnCache();
+    const result = await getCachedDsn(testProjectDir);
+    expect(result?.dsn).toBe("https://abc@o123.ingest.sentry.io/456");
+  });
+});
+
+// =============================================================================
+// Full Detection Cache Tests (v4 functionality)
+// =============================================================================
+
 describe("getCachedDetection", () => {
   test("returns undefined when no cache entry exists", async () => {
     const result = await getCachedDetection("/nonexistent/path");