fix(log): use 30d default period and show newest logs first

The default statsPeriod of 90d exceeded log retention (30 days),
causing the Explore/Events API to return stale/incomplete data.
Also changes the default sort to newest-first for one-shot queries
(matching typical dashboard behavior) and adds a --sort flag.

- Change DEFAULT_PROJECT_PERIOD from 90d to 30d (log/list)
- Change listLogs fallback from 7d to 14d (api/logs)
- Default to newest-first for one-shot queries (no reverse)
- Keep oldest-first (chronological) for --follow mode
- Add --sort flag (newest/oldest) to log list and trace logs
- Update tests for new period and ordering defaults

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sergical

src/commands/log/list.ts

@@ -41,11 +41,15 @@ import {
 } from "../../lib/trace-target.js";
 import { getUpdateNotification } from "../../lib/version-check.js";
 
+/** Sort direction for log output */
+type SortDirection = "newest" | "oldest";
+
 type ListFlags = {
   readonly limit: number;
   readonly query?: string;
   readonly follow?: number;
   readonly period?: string;
+  readonly sort: SortDirection;
   readonly json: boolean;
   readonly fresh: boolean;
   readonly fields?: string[];
@@ -97,6 +101,20 @@ function parseLimit(value: string): number {
   return validateLimit(value, MIN_LIMIT, MAX_LIMIT);
 }
 
+/** Valid sort direction values */
+const VALID_SORT_DIRECTIONS: readonly SortDirection[] = ["newest", "oldest"];
+
+/**
+ * Parse --sort flag value.
+ * @throws Error if value is not "newest" or "oldest"
+ */
+function parseSort(value: string): SortDirection {
+  if (!VALID_SORT_DIRECTIONS.includes(value as SortDirection)) {
+    throw new Error(`--sort must be "newest" or "oldest", got "${value}"`);
+  }
+  return value as SortDirection;
+}
+
 /**
  * Parse --follow flag value.
  * Supports: -f (empty string → default interval), -f 10 (explicit interval)
@@ -154,8 +172,10 @@ function parseLogListArgs(
   return parseDualModeArgs(args, TRACE_USAGE_HINT);
 }
 
-/** Default time period for project-scoped log queries */
-const DEFAULT_PROJECT_PERIOD = "90d";
+/** Default time period for project-scoped log queries.
+ * Log retention is 30 days (https://docs.sentry.io/security-legal-pii/security/data-retention-periods/).
+ * Periods >30d hit a degraded API path that returns stale/incomplete data. */
+const DEFAULT_PROJECT_PERIOD = "30d";
 
 /**
  * Execute a single fetch of logs (non-streaming mode).
@@ -179,15 +199,16 @@ async function executeSingleFetch(
     return { result: { logs: [], hasMore: false }, hint: "No logs found." };
   }
 
-  // Reverse for chronological order (API returns newest first, tail shows oldest first)
-  const chronological = [...logs].reverse();
+  // API returns newest first. Reverse only when user wants oldest-first.
+  const ordered =
+    flags.sort === "oldest" ? [...logs].reverse() : logs;
 
   const hasMore = logs.length >= flags.limit;
   const countText = `Showing ${logs.length} log${logs.length === 1 ? "" : "s"}.`;
   const tip = hasMore ? " Use --limit to show more, or -f to follow." : "";
 
   return {
-    result: { logs: chronological, hasMore },
+    result: { logs: ordered, hasMore },
     hint: `${countText}${tip}`,
   };
 }
@@ -444,14 +465,15 @@ async function executeTraceSingleFetch(
     };
   }
 
-  const chronological = [...logs].reverse();
+  const ordered =
+    flags.sort === "oldest" ? [...logs].reverse() : logs;
 
   const hasMore = logs.length >= flags.limit;
   const countText = `Showing ${logs.length} log${logs.length === 1 ? "" : "s"} for trace ${traceId}.`;
   const tip = hasMore ? " Use --limit to show more." : "";
 
   return {
-    result: { logs: chronological, traceId, hasMore },
+    result: { logs: ordered, traceId, hasMore },
     hint: `${countText}${tip}`,
   };
 }
@@ -633,15 +655,22 @@ export const listCommand = buildListCommand(
           kind: "parsed",
           parse: String,
           brief:
-            'Time period (e.g., "90d", "14d", "24h"). Default: 90d (project mode), 14d (trace mode)',
+            'Time period (e.g., "30d", "14d", "24h"). Default: 30d (project mode), 14d (trace mode)',
           optional: true,
         },
+        sort: {
+          kind: "parsed",
+          parse: parseSort,
+          brief: 'Sort order: "newest" (default) or "oldest"',
+          default: "newest",
+        },
       },
       aliases: {
         n: "limit",
         q: "query",
         f: "follow",
         t: "period",
+        s: "sort",
       },
     },
     async *func(this: SentryContext, flags: ListFlags, ...args: string[]) {

src/commands/trace/logs.ts

@@ -25,12 +25,16 @@ import {
   warnIfNormalized,
 } from "../../lib/trace-target.js";
 
+/** Sort direction for log output */
+type SortDirection = "newest" | "oldest";
+
 type LogsFlags = {
   readonly json: boolean;
   readonly web: boolean;
   readonly period: string;
   readonly limit: number;
   readonly query?: string;
+  readonly sort: SortDirection;
   readonly fresh: boolean;
   readonly fields?: string[];
 };
@@ -87,6 +91,20 @@ function parseLimit(value: string): number {
   return validateLimit(value, 1, MAX_LIMIT);
 }
 
+/** Valid sort direction values */
+const VALID_SORT_DIRECTIONS: readonly SortDirection[] = ["newest", "oldest"];
+
+/**
+ * Parse --sort flag value.
+ * @throws Error if value is not "newest" or "oldest"
+ */
+function parseSort(value: string): SortDirection {
+  if (!VALID_SORT_DIRECTIONS.includes(value as SortDirection)) {
+    throw new Error(`--sort must be "newest" or "oldest", got "${value}"`);
+  }
+  return value as SortDirection;
+}
+
 export const logsCommand = buildCommand({
   docs: {
     brief: "View logs associated with a trace",
@@ -147,6 +165,12 @@ export const logsCommand = buildCommand({
         brief: "Additional filter query (Sentry search syntax)",
         optional: true,
       },
+      sort: {
+        kind: "parsed",
+        parse: parseSort,
+        brief: 'Sort order: "newest" (default) or "oldest"',
+        default: "newest",
+      },
       fresh: FRESH_FLAG,
     },
     aliases: {
@@ -155,6 +179,7 @@ export const logsCommand = buildCommand({
       t: "period",
       n: "limit",
       q: "query",
+      s: "sort",
     },
   },
   async *func(this: SentryContext, flags: LogsFlags, ...args: string[]) {
@@ -183,16 +208,17 @@ export const logsCommand = buildCommand({
         })
     );
 
-    // Reverse to chronological order (API returns newest-first)
-    const chronological = [...logs].reverse();
-    const hasMore = chronological.length >= flags.limit;
+    // API returns newest-first. Reverse only when user wants oldest-first.
+    const ordered =
+      flags.sort === "oldest" ? [...logs].reverse() : logs;
+    const hasMore = ordered.length >= flags.limit;
 
     const emptyMessage =
       `No logs found for trace ${traceId} in the last ${flags.period}.\n\n` +
       `Try a longer period: sentry trace logs --period 30d ${traceId}`;
 
     return yield new CommandOutput({
-      logs: chronological,
+      logs: ordered,
       traceId,
       hasMore,
       emptyMessage,

src/lib/api/logs.ts

@@ -83,7 +83,7 @@ export async function listLogs(
       project: isNumericProject ? [Number(projectSlug)] : undefined,
       query: fullQuery || undefined,
       per_page: options.limit || API_MAX_PER_PAGE,
-      statsPeriod: options.statsPeriod ?? "7d",
+      statsPeriod: options.statsPeriod ?? "14d",
       sort: "-timestamp",
     },
   });

test/commands/log/list.test.ts

@@ -135,12 +135,14 @@ function mockWithProgress(
 const BATCH_FLAGS = {
   json: true,
   limit: 100,
+  sort: "newest",
 } as const;
 
 /** Human-mode flags for non-follow batch mode (period omitted = use mode default) */
 const HUMAN_FLAGS = {
   json: false,
   limit: 100,
+  sort: "newest",
 } as const;
 
 /** Sample project-scoped logs (SentryLog) */
@@ -270,7 +272,7 @@ describe("listCommand.func — standard mode", () => {
     expect(parsed.data).toHaveLength(3);
   });
 
-  test("outputs JSON in chronological order (oldest first)", async () => {
+  test("outputs JSON in newest-first order by default", async () => {
     // API returns newest first: item003, item002, item001
     const newestFirst = [...sampleLogs].reverse();
     listLogsSpy.mockResolvedValue(newestFirst);
@@ -282,7 +284,27 @@ describe("listCommand.func — standard mode", () => {
 
     const output = stdoutWrite.mock.calls.map((c) => c[0]).join("");
     const parsed = JSON.parse(output);
-    // After reversal, oldest should be first
+    // Default sort=newest preserves API order (newest first)
+    expect(parsed.data[0]["sentry.item_id"]).toBe("item003");
+    expect(parsed.data[2]["sentry.item_id"]).toBe("item001");
+  });
+
+  test("outputs JSON in oldest-first order with sort=oldest", async () => {
+    const newestFirst = [...sampleLogs].reverse();
+    listLogsSpy.mockResolvedValue(newestFirst);
+    resolveOrgProjectSpy.mockResolvedValue({ org: ORG, project: PROJECT });
+
+    const { context, stdoutWrite } = createMockContext();
+    const func = await listCommand.loader();
+    await func.call(
+      context,
+      { ...BATCH_FLAGS, sort: "oldest" },
+      `${ORG}/${PROJECT}`
+    );
+
+    const output = stdoutWrite.mock.calls.map((c) => c[0]).join("");
+    const parsed = JSON.parse(output);
+    // sort=oldest reverses to chronological order
     expect(parsed.data[0]["sentry.item_id"]).toBe("item001");
     expect(parsed.data[2]["sentry.item_id"]).toBe("item003");
   });
@@ -358,14 +380,14 @@ describe("listCommand.func — standard mode", () => {
     const func = await listCommand.loader();
     await func.call(
       context,
-      { json: false, limit: 50, query: "level:error" },
+      { json: false, limit: 50, query: "level:error", sort: "newest" },
       `${ORG}/${PROJECT}`
     );
 
     expect(listLogsSpy).toHaveBeenCalledWith(ORG, PROJECT, {
       query: "level:error",
       limit: 50,
-      statsPeriod: "90d",
+      statsPeriod: "30d",
     });
   });
 
@@ -441,7 +463,7 @@ describe("listCommand.func — trace mode", () => {
     expect(parsed.data).toHaveLength(3);
   });
 
-  test("outputs JSON in chronological order (oldest first)", async () => {
+  test("outputs JSON in newest-first order by default (trace mode)", async () => {
     const newestFirst = [...sampleTraceLogs].reverse();
     listTraceLogsSpy.mockResolvedValue(newestFirst);
     resolveTraceOrgSpy.mockResolvedValue({ traceId: TRACE_ID, org: ORG });
@@ -452,8 +474,9 @@ describe("listCommand.func — trace mode", () => {
 
     const output = stdoutWrite.mock.calls.map((c) => c[0]).join("");
     const parsed = JSON.parse(output);
-    expect(parsed.data[0].id).toBe("log001");
-    expect(parsed.data[2].id).toBe("log003");
+    // Default sort=newest preserves API order (newest first)
+    expect(parsed.data[0].id).toBe("log003");
+    expect(parsed.data[2].id).toBe("log001");
   });
 
   test("shows empty-trace message in human mode", async () => {
@@ -667,7 +690,7 @@ describe("listCommand.func — period flag", () => {
   test("trace mode uses 14d default when period is omitted", async () => {
     const { context } = createMockContext();
     const func = await listCommand.loader();
-    await func.call(context, { json: true, limit: 100 }, TRACE_ID);
+    await func.call(context, { json: true, limit: 100, sort: "newest" }, TRACE_ID);
 
     expect(listTraceLogsSpy).toHaveBeenCalledWith(ORG, TRACE_ID, {
       query: undefined,
@@ -681,7 +704,7 @@ describe("listCommand.func — period flag", () => {
     const func = await listCommand.loader();
     await func.call(
       context,
-      { json: true, limit: 100, period: "30d" },
+      { json: true, limit: 100, period: "30d", sort: "newest" },
       TRACE_ID
     );
 
@@ -817,6 +840,7 @@ describe("listCommand.func — follow mode (standard)", () => {
     json: false,
     limit: 100,
     follow: 1,
+    sort: "newest",
   } as const;
 
   test("writes initial logs then resolves on SIGINT", async () => {
@@ -1108,6 +1132,7 @@ describe("listCommand.func — follow mode (trace)", () => {
     json: false,
     limit: 100,
     follow: 1,
+    sort: "newest",
   } as const;
 
   test("writes initial trace logs then resolves on SIGINT", async () => {