fix: token logic for getCliClient()

[binoy14]

Fixes issue with the token and requireUser logic which broke telemetry reporting (mostly).

The issue was that if you have requireUser: false then it does not look up stored token and without token API call to check telemetry consent fails. This fixes that logic to use provided or look it up always.

Also added extensive tests for apiClient

[claude]

Claude finished @binoy14's task in 1m 4s —— View job

---

Code Review Complete

• Read modified apiClient.ts
• Read new test file
• Review diff against main
• Analyze token logic fix
• Check test coverage and quality
• Post review findings

Review Findings

The PR successfully fixes the token lookup logic. The code and tests look solid with 100% coverage. No issues found that require fixing.

The fix correctly addresses the problem where requireUser: false would skip token lookup entirely, breaking telemetry. Now tokens are always retrieved (if not provided), which is the correct behavior.

Test coverage is comprehensive and includes all critical paths including edge cases for both client types, error scenarios, and middleware behavior.

[binoy14]

• refactor: move telemetry files into service #320
• fix: token logic for getCliClient() #322 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	71.07%	5702 / 8023
🔵	Statements	70.41%	5850 / 8308
🔵	Functions	59.12%	875 / 1480
🔵	Branches	58.78%	2523 / 4292

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/@sanity/cli-core/src/services/apiClient.ts	100%	100%	100%	100%

Generated in workflow #1664 for commit b5ecfcf by the Vitest Coverage Report Action

[rexxars]

To me this technically already "works as intended" - sometimes you want to send unauthenticated requests, and with this that is no longer a possibility, I think?

[binoy14]

To me this technically already "works as intended" - sometimes you want to send unauthenticated requests, and with this that is no longer a possibility, I think?

In a way yes, but this is different from the current CLI logic and it breaks the telemetry calls. The problem is that telemetry has requireUser: false so current it does not attach token and fails with 401 due to missing authorization.

[rexxars]

Fair enough.