Distillation

Date: Aug 28, 2026

• 🟢 (11:32) Tool search found 29 workspace matches in /home/byk/Code/getsentry/craft-workspace-action-propagation, including action input/configuration in action.yml and src/utils/helpers.ts; workspace propagation tests in src/__tests__/action.test.ts and src/__tests__/config.test.ts; workspace:* dependency handling in src/targets/npm.ts and src/__tests__/versionBump.test.ts; and workspace inputs passed through .github/workflows/release.yml.
• 🟢 (11:35) Targeted Vitest run vitest run -- src/__tests__/action.test.ts src/__tests__/config.test.ts src/commands/workspace_cmds/__tests__/list.test.ts completed successfully: 61 test files passed; 1,147 tests passed; 1 skipped; 1,148 total; duration 27.78s. Logs included expected mocked GitHub release cleanup, duplicate-release, floating-tag, oversized-release-body, and dry-run scenarios.
• 🟢 (11:35) Vite emitted two SSR warnings in src/targets/__tests__/symbolCollector.test.ts (lines 58 and 68): assigning vi.fn() to imported checkExecutableIsPresent will throw because it is an import.
• 🟢 (11:35) Test logs reported failure to fetch remote refs and list remote branches, then used locally cached refs; the test suite still passed.
• 🟢 (11:36) Working tree modifications: action.yml, docs/src/content/docs/targets/github.md, src/__tests__/action.test.ts, src/__tests__/config.test.ts, src/config.ts, src/index.ts, and src/schemas/project_config.ts; untracked additions: src/commands/workspace.ts and src/commands/workspace_cmds/.
• 🟢 (11:36) Bundled review executable /tmp/opencode/craft-workspace-review (9.2 MB) failed at startup with TypeError [ERR_INVALID_ARG_VALUE]: createRequire received undefined instead of a file URL or absolute filename; stack points to /tmp/opencode/craft-workspace-review:234365:88. Node also emitted DEP0040 warning that punycode is deprecated.
• 🟢 (11:37) Inspected build.mjs: esbuild bundles src/index.ts to dist/craft.js for Node 22, injects ./src/utils/import-meta-url.js, defines import.meta.url as import_meta_url, and sets production process.env.NODE_ENV; it conditionally adds @sentry/esbuild-plugin when SENTRY_AUTH_TOKEN exists, for Sentry org sentry, project craft, uploading sourcemaps dist/craft.js / dist/craft.js.map and deleting dist/**/*.map.
• 🟢 (11:37) build.mjs contains jsoncParserEsmPlugin, which redirects jsonc-parser resolution from lib/umd/ to lib/esm/ because the UMD entry performs dynamic sibling require("./impl/format") calls that esbuild cannot bundle; jsonc-parser is transitive through @vercel/client → @vercel/microfrontends.
• 🟢 (11:37) build.mjs post-processing adds a Node shebang if absent, renames dist/craft.js to executable dist/craft, handles ENOENT to tolerate parallel test-build races, chmods dist/craft to 0o755, and removes dist/craft.js.map if still present.
• 🟢 (11:39) A review bundle failed with Error: Cannot find module './impl/format', required by /tmp/opencode/craft-workspace-review; this matches the jsonc-parser UMD dynamic-require bundling failure described in build.mjs. Node also emitted DEP0040 (punycode) and DEP0169 (url.parse()) deprecation warnings.
• 🟢 (11:40) Prototype-key experiment produced [ '__proto__' ] true { releaseBranchPrefix: 'release/proto' }, showing the input contained __proto__ and resolved to an object with releaseBranchPrefix: 'release/proto'.
• 🟢 (11:42) Attempt to run vite-node failed: ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL Command "vite-node" not found; pnpm suggested pnpm exec vite.
• 🟢 (11:45) Tool search found github.projectPath schema guards in src/schemas/project_config.ts: a workspace-level refinement rejects Workspace github.projectPath is not supported., and another rejects base github.projectPath when workspaces are configured with Workspace configurations cannot use github.projectPath. Tests in src/__tests__/config.test.ts cover rejecting workspace projectPath, rejecting base projectPath with workspaces, and allowing it with an empty workspace map.
• 🔴 (11:46) User asserted C..
• 🟢 (11:46) Locale experiment: C and C.utf8 rejected é; en_US.UTF-8 accepted é.
• 🟢 (11:46) Tool search found --config-from in src/config.ts:353, src/commands/prepare.ts:125,796, and an action test using workspace value --config-from=untrusted; expected command output preserves it literally as prepare --workspace=--config-from=untrusted and targets --workspace=--config-from=untrusted.
• 🟢 (11:48) Workspace-name shell-validation experiment rejected names containing newline (cli\n), carriage return (cli\r), CRLF (cli\r\n), Unicode line separator (cli\u2028), Unicode paragraph separator (cli\u2029), and tab (cli\t); Bash also rejected each corresponding quoted value.
• 🟢 (11:51) Git reported error: pathspec 'dist/craft' did not match any file(s) known to git, suggesting it had not been added.
• 🟢 (11:52) Inspected src/utils/strings.ts: formatJson(obj: any) serializes with JSON.stringify(obj, null, 4); for an Error that serializes to '{}', it instead returns util.format(obj). formatArtifactConfigForError(artifactsConfig) returns an empty string for absent config; otherwise it YAML-dumps { artifacts: artifactsConfig } with { indent: 2, flowLevel: 3 }, trims trailing whitespace, and prefixes \n\nYour .craft.yml artifact configuration:\n.
• 🟢 (11:55) Project-config review experiment: "cli" validated and returned workspace names ['cli']; "__proto__" validated but returned []; "constructor" validated and returned ['constructor']; "toString" validated and returned ['toString']; "cli/v2" was rejected at workspaces.cli/v2; "é" was rejected at workspaces.é.
• 🟢 (11:56) Locale experiment confirmed C.utf8 rejected é, ä, İ, ß, and ø, while en_US.utf8 accepted all five.
• 🟡 (12:01) Review finding — HIGH / do-not-merge: workspace key __proto__ is allowed by the workspace-key grammar but silently discarded by Zod record output. workspaces: { __proto__: {} } validates, but getWorkspaceNames() returns [], so workspace selection reports none. Because the root github.projectPath guard uses the now-empty Object.keys() output, this also bypasses the root github.projectPath restriction. Evidence cited: src/schemas/project_config.ts:236-249, src/config.ts:215-225,381-385; existing prototype-name test at src/__tests__/config.test.ts:373-381 does not configure a prototype-named key.
• 🟡 (12:01) Review finding — MEDIUM / do-not-merge: action.yml’s purported ASCII workspace-name validator is locale-dependent. In en_US.utf8, Bash accepts é for ^[A-Za-z0-9_.-]+$, but the schema rejects it; Unicode-control checks do not reject ordinary non-ASCII letters. Consequently an invalid workspace can pass initial action validation and reach later gh/git side effects. Evidence cited: action.yml:84-90 versus src/schemas/project_config.ts:236-238; side effects at action.yml:93-103,179-191; tests only cover ASCII and / at src/__tests__/action.test.ts:193-220.
• 🟢 (12:01) Project-config review output after configuration with root projectPath: "packages/cli" showed {"workspaceKeys":[],"hasOwnProto":false,"projectPath":"packages/cli"}.
• 🟢 (12:01) Follow-up project-config review preserved raw key "__proto__" in input but Zod-produced configuration still showed workspaceKeys: [], hasOwnProto: false, and projectPath: "packages/cli": {"rawKeys":["__proto__"],"workspaceKeys":[],"hasOwnProto":false,"projectPath":"packages/cli"}.