diff --git a/packages/cli/AGENTS.md b/packages/cli/AGENTS.md
index d238f2dd2..155e16c99 100644
--- a/packages/cli/AGENTS.md
+++ b/packages/cli/AGENTS.md
@@ -677,7 +677,9 @@ Do not call `findProjectsBySlug()` or implement org fallback directly in a
 command. `sentry init` is the intentional not-found exception: it calls the
 classifier with fuzzy recovery disabled, then treats `not-found` as a new
 project name. Issue-short-ID recovery in `commands/issue/utils.ts` is not CLI
-target resolution and may perform its own project lookup.
+target resolution and may perform its own project lookup. The
+`no-direct-target-resolution` Biome plugin enforces this command-layer
+boundary.
 
 ### List Command Infrastructure
 
diff --git a/packages/cli/biome.jsonc b/packages/cli/biome.jsonc
index 88c6b5d00..0457369d8 100644
--- a/packages/cli/biome.jsonc
+++ b/packages/cli/biome.jsonc
@@ -19,6 +19,7 @@
     "./lint-rules/no-inline-touch-cache.grit",
     "./lint-rules/no-stderr-write-in-commands.grit",
     "./lint-rules/no-args-join-in-release.grit",
+    "./lint-rules/no-direct-target-resolution.grit",
     "./lint-rules/no-generic-is-record.grit",
     "./lint-rules/prefer-paginate-helper.grit"
   ],
diff --git a/packages/cli/lint-rules/no-direct-target-resolution.grit b/packages/cli/lint-rules/no-direct-target-resolution.grit
new file mode 100644
index 000000000..09299b4e8
--- /dev/null
+++ b/packages/cli/lint-rules/no-direct-target-resolution.grit
@@ -0,0 +1,19 @@
+language js
+
+// CLI commands resolve project/org targets through capability helpers in
+// resolve-target.ts. Calling the low-level search or miss classifier directly
+// lets command-specific precedence drift.
+//
+// issue/utils.ts is intentionally excluded: it uses project lookup while
+// resolving issue IDs, not CLI target syntax.
+file($name, $body) where {
+  $name <: r".*src/commands/.*",
+  $name <: not r".*src/commands/issue/utils\.ts$",
+  $body <: contains or {
+    `findProjectsBySlug($args)` as $match,
+    `$api.findProjectsBySlug($args)` as $match,
+    `triageProjectNotFound($args)` as $match,
+    `$resolver.triageProjectNotFound($args)` as $match
+  },
+  register_diagnostic(span=$match, message="Use a capability helper from resolve-target.ts instead of low-level project target resolution (AGENTS.md).")
+}