diff --git a/apps/cli-docs/src/content/docs/features.md b/apps/cli-docs/src/content/docs/features.md
index 8ed71a987..08bd6869b 100644
--- a/apps/cli-docs/src/content/docs/features.md
+++ b/apps/cli-docs/src/content/docs/features.md
@@ -13,7 +13,7 @@ Selectors tolerate typos in unfinished prefixes: `frone` can find `frontend-web`
 
 ## DSN Auto-Detection
 
-The CLI automatically detects your Sentry project from your codebase, eliminating the need to specify the target for every command. DSN detection is one part of the [resolution priority chain](./configuration/#resolution-priority) — it runs after checking for explicit arguments, environment variables, and `.sentryclirc` config files.
+The CLI automatically detects your Sentry project from your codebase, eliminating the need to specify the target for every command. DSN detection is one part of the [resolution priority chain](../configuration/#resolution-priority) — it runs after checking for explicit arguments, environment variables, and `.sentryclirc` config files.
 
 ### How It Works
 
@@ -26,7 +26,7 @@ DSN detection follows this priority order (highest first):
 When a DSN is found, the CLI resolves it to your organization and project, then caches the result for fast subsequent lookups.
 
 :::tip
-For monorepos or when DSN detection picks up the wrong project, use a [`.sentryclirc` config file](./configuration/#configuration-file-sentryclirc) to pin your org/project explicitly.
+For monorepos or when DSN detection picks up the wrong project, use a [`.sentryclirc` config file](../configuration/#configuration-file-sentryclirc) to pin your org/project explicitly.
 :::
 
 ### Supported Languages
diff --git a/apps/cli-docs/src/content/docs/library-usage.md b/apps/cli-docs/src/content/docs/library-usage.md
index c72bba3cd..6df3f5e0b 100644
--- a/apps/cli-docs/src/content/docs/library-usage.md
+++ b/apps/cli-docs/src/content/docs/library-usage.md
@@ -153,7 +153,7 @@ const sdk = createSentrySDK({ token: "...", text: true, cwd: "/my/project" });
 | `project` | `string` | Auto-detected | Default project slug |
 | `text` | `boolean` | `false` | Return human-readable text instead of parsed JSON (`run()` only) |
 | `cwd` | `string` | `process.cwd()` | Working directory for DSN auto-detection |
-| `headers` | `Record<string, string>` | — | Extra HTTP headers for self-hosted instances behind a reverse proxy (same as [`SENTRY_CUSTOM_HEADERS`](./configuration/#sentry_custom_headers)); ignored for sentry.io |
+| `headers` | `Record<string, string>` | — | Extra HTTP headers for self-hosted instances behind a reverse proxy (same as [`SENTRY_CUSTOM_HEADERS`](../configuration/#sentry_custom_headers)); ignored for sentry.io |
 | `signal` | `AbortSignal` | — | Abort signal for cancelling streaming commands |
 
 ## Return Values
@@ -221,7 +221,7 @@ Calls should be sequential (awaited one at a time).
 - **Node.js >= 20**. On Node.js 22.15+ the built-in `node:sqlite` module is used; on Node.js 20–22.14 the CLI transparently falls back to a bundled WASM SQLite driver, so no native module or extra install step is required.
 
 :::caution
-The WASM SQLite fallback (Node.js 20–22.14) does not support [WAL mode](https://www.sqlite.org/wal.html), so concurrent access from multiple processes is slower and its local cache reads/writes are less efficient. For the best performance and reliability we **strongly recommend** the [standalone binary](/installation/) (which bundles a modern runtime) or running on **Node.js 22.15+** so the native `node:sqlite` driver is used.
+The WASM SQLite fallback (Node.js 20–22.14) does not support [WAL mode](https://www.sqlite.org/wal.html), so concurrent access from multiple processes is slower and its local cache reads/writes are less efficient. For the best performance and reliability we **strongly recommend** the [standalone binary](../getting-started/) (which bundles a modern runtime) or running on **Node.js 22.15+** so the native `node:sqlite` driver is used.
 :::
 
 ## Streaming Commands
diff --git a/apps/cli-docs/src/content/docs/self-hosted.md b/apps/cli-docs/src/content/docs/self-hosted.md
index 9cf6796be..83fbc498b 100644
--- a/apps/cli-docs/src/content/docs/self-hosted.md
+++ b/apps/cli-docs/src/content/docs/self-hosted.md
@@ -108,4 +108,4 @@ sentry cli defaults headers "X-IAP: token"
 | `NODE_EXTRA_CA_CERTS` | Path to PEM file with additional CA certificates (for corporate proxies) |
 <!-- GENERATED:END self-hosted-env-vars -->
 
-See [Configuration](./configuration/) for the full environment variable reference.
+See [Configuration](../configuration/) for the full environment variable reference.
diff --git a/apps/cli-docs/src/fragments/commands/auth.md b/apps/cli-docs/src/fragments/commands/auth.md
index e97536f33..9de402ed6 100644
--- a/apps/cli-docs/src/fragments/commands/auth.md
+++ b/apps/cli-docs/src/fragments/commands/auth.md
@@ -58,7 +58,7 @@ For token-based auth with self-hosted:
 sentry auth --token YOUR_TOKEN --url https://sentry.example.com
 ```
 
-See [Self-Hosted Sentry](../self-hosted/) for details.
+See [Self-Hosted Sentry](../../self-hosted/) for details.
 
 ### Multiple accounts
 
diff --git a/apps/cli-docs/src/fragments/commands/cli.md b/apps/cli-docs/src/fragments/commands/cli.md
index 3006cf4ea..798e84b9c 100644
--- a/apps/cli-docs/src/fragments/commands/cli.md
+++ b/apps/cli-docs/src/fragments/commands/cli.md
@@ -127,7 +127,7 @@ sentry cli feedback i love this tool
 sentry cli feedback the issue view is confusing
 ```
 
-Feedback is sent via Sentry's telemetry system. If telemetry is disabled (`SENTRY_CLI_NO_TELEMETRY=1`), feedback cannot be sent.
+Feedback is sent via Sentry's telemetry system. If telemetry is disabled (`SENTRY_CLI_NO_TELEMETRY=1`, `DO_NOT_TRACK=1`, or `sentry cli defaults telemetry off`), feedback cannot be sent.
 
 ### Fix configuration issues
 
diff --git a/apps/cli-docs/src/fragments/configuration.md b/apps/cli-docs/src/fragments/configuration.md
index c56287585..2be73b3bf 100644
--- a/apps/cli-docs/src/fragments/configuration.md
+++ b/apps/cli-docs/src/fragments/configuration.md
@@ -58,7 +58,7 @@ The first source that provides both org and project wins. For org-only commands,
 Full issue short IDs, such as `sentry issue view FRONT-ABC`, only need the org:
 `SENTRY_ORG`, `.sentryclirc`, and persistent defaults scope the lookup in that order.
 Use `sentry issue view other-org/FRONT-ABC` to override the configured organization.
-Project aliases retain their associated organization. See [View an issue](./commands/issue/#view-an-issue).
+Project aliases retain their associated organization. See [View an issue](../commands/issue/#view-an-issue).
 
 ### Backward Compatibility
 
@@ -78,7 +78,7 @@ sentry cli defaults                      # Show all current defaults
 sentry cli defaults org --clear          # Clear a specific default
 ```
 
-See [`sentry cli defaults`](./commands/cli/#sentry-cli-defaults) for full usage.
+See [`sentry cli defaults`](../commands/cli/#sentry-cli-defaults-key-value) for full usage.
 
 ### Disabling tips
 
@@ -127,7 +127,7 @@ We store credentials and caches in a SQLite database (`cli.db`) inside the confi
 - Region URL mappings
 - Project aliases (for monorepo support)
 
-See [Credential Storage](./commands/auth/#credential-storage) in the auth command docs for more details.
+See [Credential Storage](../commands/auth/#credential-storage) in the auth command docs for more details.
 
 ## Binary Install Location
 
diff --git a/packages/cli/README.md b/packages/cli/README.md
index da80755fd..030e115b2 100644
--- a/packages/cli/README.md
+++ b/packages/cli/README.md
@@ -22,6 +22,12 @@
 curl https://cli.sentry.dev/install -fsS | bash
 ```
 
+### Windows (PowerShell)
+
+```powershell
+irm https://cli.sentry.dev/install.ps1 | iex
+```
+
 ### Homebrew
 
 ```bash
@@ -94,10 +100,13 @@ const sdk = createSentrySDK({ token: "sntrys_..." });
 // Typed methods for every CLI command
 const orgs = await sdk.org.list();
 const issues = await sdk.issue.list({ orgProject: "acme/frontend", limit: 5 });
-const issue = await sdk.issue.view({ issue: "ACME-123" });
+const issue = await sdk.issue.view({}, "ACME-123");
 
 // Nested commands
-await sdk.dashboard.widget.add({ display: "line", query: "count" }, "my-org/my-dashboard");
+await sdk.dashboard.widget.add(
+  { display: "line", query: ["count"] },
+  "acme/", "my-dashboard", "Errors over time"
+);
 
 // Escape hatch for any CLI command
 const version = await sdk.run("--version");
@@ -105,7 +114,7 @@ const text = await sdk.run("issue", "list", "-l", "5");
 ```
 
 Options (all optional):
-- `token` — Auth token. Falls back to `SENTRY_AUTH_TOKEN` / `SENTRY_TOKEN` env vars.
+- `token` — Auth token. Falls back to the stored login from `sentry auth login`, then `SENTRY_AUTH_TOKEN` / `SENTRY_TOKEN` env vars.
 - `url` — Sentry instance URL for self-hosted (e.g., `"sentry.example.com"`).
 - `org` — Default organization slug (avoids passing it on every call).
 - `project` — Default project slug.
diff --git a/packages/cli/src/lib/env-registry.ts b/packages/cli/src/lib/env-registry.ts
index 02ef0f324..2a0ff95f0 100644
--- a/packages/cli/src/lib/env-registry.ts
+++ b/packages/cli/src/lib/env-registry.ts
@@ -88,7 +88,7 @@ export const ENV_VAR_REGISTRY: readonly EnvVarEntry[] = [
   {
     name: "SENTRY_DSN",
     description:
-      "Sentry DSN for project auto-detection. This is the same DSN you use in `Sentry.init()`. The CLI resolves it to determine your organization and project.\n\nThe CLI also detects DSNs from `.env` files and source code automatically — see [DSN Auto-Detection](./features/#dsn-auto-detection).",
+      "Sentry DSN for project auto-detection. This is the same DSN you use in `Sentry.init()`. The CLI resolves it to determine your organization and project.\n\nThe CLI also detects DSNs from `.env` files and source code automatically — see [DSN Auto-Detection](../features/#dsn-auto-detection).",
     example: "https://key@o123.ingest.us.sentry.io/456",
     topLevel: true,
     briefDescription: "DSN used to auto-detect org + project.",
@@ -107,7 +107,7 @@ export const ENV_VAR_REGISTRY: readonly EnvVarEntry[] = [
   {
     name: "SENTRY_HOST",
     description:
-      "Base URL of your Sentry instance. **Only needed for [self-hosted Sentry](./self-hosted/).** SaaS users (sentry.io) should not set this.\n\nWhen set, all API requests (including OAuth login) are directed to this URL instead of `https://sentry.io`. The CLI also sets this automatically when you pass a self-hosted Sentry URL as a command argument.\n\n`SENTRY_HOST` takes precedence over `SENTRY_URL`. Both work identically — use whichever you prefer.",
+      "Base URL of your Sentry instance. **Only needed for [self-hosted Sentry](../self-hosted/).** SaaS users (sentry.io) should not set this.\n\nWhen set, all API requests are directed to this URL instead of `https://sentry.io`. Logging in to a self-hosted instance still requires `sentry auth login --url <your-url>`: the CLI refuses to log in to a self-hosted host that only comes from this variable. The CLI also sets this automatically when you pass a self-hosted Sentry URL as a command argument.\n\n`SENTRY_HOST` takes precedence over `SENTRY_URL`. Both work identically — use whichever you prefer.",
     example: "https://sentry.example.com",
     defaultValue: "https://sentry.io",
     topLevel: true,
@@ -126,7 +126,7 @@ export const ENV_VAR_REGISTRY: readonly EnvVarEntry[] = [
   {
     name: "SENTRY_CLIENT_ID",
     description:
-      "Client ID of a public OAuth application on your Sentry instance. **Required for [self-hosted Sentry](./self-hosted/)** (26.1.0+) to use `sentry auth login` with the device flow. See the [Self-Hosted guide](./self-hosted/#1-create-a-public-oauth-application) for how to create one.",
+      "Client ID of a public OAuth application on your Sentry instance. **Required for [self-hosted Sentry](../self-hosted/)** (26.1.0+) to use `sentry auth login` with the device flow. See the [Self-Hosted guide](../self-hosted/#1-create-a-public-oauth-application) for how to create one.",
     example: "your-oauth-client-id",
     selfHosted: true,
     devGuide: "Sentry OAuth app client ID",
@@ -136,7 +136,7 @@ export const ENV_VAR_REGISTRY: readonly EnvVarEntry[] = [
     name: "SENTRY_CUSTOM_HEADERS",
     description:
       "Custom HTTP headers to include in all requests to your Sentry instance. " +
-      "**Only applies to [self-hosted Sentry](./self-hosted/).** Ignored when targeting sentry.io.\n\n" +
+      "**Only applies to [self-hosted Sentry](../self-hosted/).** Ignored when targeting sentry.io.\n\n" +
       "Use semicolon-separated `Name: Value` pairs. Useful for environments behind " +
       "reverse proxies that require additional headers for authentication " +
       "(e.g., Google IAP, Cloudflare Access).\n\n" +
@@ -165,7 +165,7 @@ export const ENV_VAR_REGISTRY: readonly EnvVarEntry[] = [
   {
     name: "SENTRY_VERSION",
     description:
-      "Pin a specific version for the [install script](./getting-started/#install-script). Accepts a version number (e.g., `0.40.0`) or `nightly`. The `--version` flag takes precedence if both are set.\n\nThis is useful in CI/CD pipelines and Dockerfiles where you want reproducible installations without inline flags.",
+      "Pin a specific version for the [install script](../getting-started/#install-script). Accepts a version number (e.g., `0.40.0`) or `nightly`. The `--version` flag takes precedence if both are set.\n\nThis is useful in CI/CD pipelines and Dockerfiles where you want reproducible installations without inline flags.",
     example: "nightly",
     installOnly: true,
   },
@@ -197,7 +197,7 @@ export const ENV_VAR_REGISTRY: readonly EnvVarEntry[] = [
   {
     name: "SENTRY_PLAIN_OUTPUT",
     description:
-      "Force plain text output (no colors or ANSI formatting). Takes precedence over `NO_COLOR`.",
+      "Force plain text output (no colors or ANSI formatting). Takes precedence over `NO_COLOR`. Set to `0` or `false` to force formatted output, even when piped.",
     example: "1",
   },
   {
@@ -235,7 +235,7 @@ export const ENV_VAR_REGISTRY: readonly EnvVarEntry[] = [
   {
     name: "SENTRY_OUTPUT_FORMAT",
     description:
-      "Force the output format for all commands. Currently only `json` is supported. This is primarily used by the [library API](./library-usage/) (`createSentrySDK()`) to get JSON output without passing `--json` flags.",
+      "Force the output format for all commands. Currently only `json` is supported. This is primarily used by the [library API](../library-usage/) (`createSentrySDK()`) to get JSON output without passing `--json` flags.",
     example: "json",
   },
   // -- Logging & telemetry --
diff --git a/packages/cli/src/lib/sdk-types.ts b/packages/cli/src/lib/sdk-types.ts
index c930df1eb..562aa2c9d 100644
--- a/packages/cli/src/lib/sdk-types.ts
+++ b/packages/cli/src/lib/sdk-types.ts
@@ -12,8 +12,9 @@ import { redactCredentialText } from "./credential-redaction.js";
 /** Options for programmatic CLI invocation. */
 export type SentryOptions = {
   /**
-   * Auth token override. When omitted, falls back to `SENTRY_AUTH_TOKEN`
-   * or `SENTRY_TOKEN` environment variables, then stored credentials.
+   * Auth token override. When omitted, falls back to stored credentials from
+   * `sentry auth login`, then the `SENTRY_AUTH_TOKEN` or `SENTRY_TOKEN`
+   * environment variables (set `SENTRY_FORCE_ENV_TOKEN=1` to prefer them).
    */
   token?: string;