[theycallmeswift]

Glitch Invaders' setup now reads SENTRY_DSN, SENTRY_ORG, SENTRY_PROJECT, and optionally SENTRY_URL (as apiUrl) over sentry.json. This lets an event point at its own Sentry project through challenge_env. sentry.json keeps its values as the default, and behavior with the variables unset is unchanged. Closes #28.

Settled behavior:

• An empty variable counts as unset.
• SENTRY_URL is read only together with the other three. On its own it is ignored. When the three are set without it, apiUrl is https://sentry.io, not sentry.json's.
• A SENTRY_URL that is an origin plus a trailing / (sentry-cli's form) is reduced to the origin before validation.
• Errors name the variable, e.g. invalid runtime config: SENTRY_URL must be https://sentry.io or a subdomain. sentry.json validation and messages are unchanged.

Decide

• Standalone run evidence. The hooks were smoke-run standalone, but the Pi playthrough wasn't run because no GEMINI_API_KEY was available. Recommend: accept the hook-level run, because only setup's settings resolution changed and the Pi side is untouched.

Ready gate

Step	Evidence
Tests and lint	npm run verify: ok for all 4 packages. npm test: 264 pass, 0 fail. npm run lint: 0 issues.
Red run	With server/sentry-config.mjs reverted, these tests fail: env over sentry.json, partial env, malformed env naming the variable, trailing-slash SENTRY_URL. The two apiUrl tests (default without SENTRY_URL, SENTRY_URL alone ignored) pin the intended behavior and pass either way.
Sibling sweep	grep -rn sentry.json outside test/: README, sentry.json's $comment, and server/sentry-config.mjs updated. serve.mjs, the skills, and cleanup don't read the settings.
Docs and specs	challenges/glitch-invaders/README.md ("Files", "Live Sentry mode", "Run without boothstrap") and sentry.json's $comment. No repo docs/ cover this package.
Standalone run	Hooks only. With no SENTRY_* set, setup in a scratch folder is ready on 4373 with the usual token note, the runtime config has only attemptId, the page returns 200, and cleanup exits 0. With only SENTRY_DSN set, setup exits 1 naming SENTRY_ORG, SENTRY_PROJECT. Pi playthrough not run (no GEMINI_API_KEY); see Decide.
Editorial pass	Reread against docs/style/. The env rules are one README paragraph plus the challenge_env example.
Skipped tests	None.
Secrets, permissions	No secret read or written. README and $comment say the token stays in the vault and the variables carry public settings only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VdRNSME2KRqwhfNGNYW9AN

[theycallmeswift]

Review of ac01655: one blocking finding and one nit, inline. Unset variables behave exactly as today, the CSP uses the env DSN, the token never reaches the page, and CI and the local verify/test/lint runs are green.

On the Decide items: empty-as-unset and reading SENTRY_URL only alongside the other three are both fine. The trailing-slash handling and the error wording change, per the inline comment.

Also:

• Nit, tests (~line 1297 of test/glitch-invaders.test.mjs): add two offline tests that assert only the sentry field of runtime-config.json. (a) With the three variables set and no SENTRY_URL, apiUrl becomes https://sentry.io even when sentry.json has its own. (b) SENTRY_URL set on its own is ignored.
• Ready gate, standalone run: the Pi playthrough wasn't run (no GEMINI_API_KEY in this environment). Keep that row honest. The owner will decide whether the hook-level smoke run is enough, since the Pi side is unchanged.

---

Generated by Claude Code