chore(lint): require target resolution helpers

packages/cli/AGENTS.md

@@ -677,7 +677,9 @@ Do not call `findProjectsBySlug()` or implement org fallback directly in a
 command. `sentry init` is the intentional not-found exception: it calls the
 classifier with fuzzy recovery disabled, then treats `not-found` as a new
 project name. Issue-short-ID recovery in `commands/issue/utils.ts` is not CLI
-target resolution and may perform its own project lookup.
+target resolution and may perform its own project lookup. The
+`no-direct-target-resolution` Biome plugin enforces this command-layer
+boundary.
 
 ### List Command Infrastructure
 

packages/cli/biome.jsonc

@@ -19,6 +19,7 @@
     "./lint-rules/no-inline-touch-cache.grit",
     "./lint-rules/no-stderr-write-in-commands.grit",
     "./lint-rules/no-args-join-in-release.grit",
+    "./lint-rules/no-direct-target-resolution.grit",
     "./lint-rules/no-generic-is-record.grit",
     "./lint-rules/prefer-paginate-helper.grit"
   ],

packages/cli/lint-rules/no-direct-target-resolution.grit

@@ -0,0 +1,19 @@
+language js
+
+// CLI commands resolve project/org targets through capability helpers in
+// resolve-target.ts. Calling the low-level search or miss classifier directly
+// lets command-specific precedence drift.
+//
+// issue/utils.ts is intentionally excluded: it uses project lookup while
+// resolving issue IDs, not CLI target syntax.
+file($name, $body) where {
+  $name <: r".*src/commands/.*",
+  $name <: not r".*src/commands/issue/utils\.ts$",
+  $body <: contains or {
+    `findProjectsBySlug($args)` as $match,
+    `$api.findProjectsBySlug($args)` as $match,
+    `triageProjectNotFound($args)` as $match,
+    `$resolver.triageProjectNotFound($args)` as $match
+  },
+  register_diagnostic(span=$match, message="Use a capability helper from resolve-target.ts instead of low-level project target resolution (AGENTS.md).")
+}