Dashboard › cli › Distillation
0b7c1be4-6c21-4410-b1cf-dbd6c27c4366["lore_tm_v1_VkYjkW87q11pMZJLLFcj4QZPHBBB66d2jDKdUU5BjRg","lore_tm_v1_dS_aBmGGUdzwHYN6uvvfnLNZ2AZjqDn9xyqoQNIJrNY","lore_tm_v1_fsNVpEQNRR45n2Gf3q6-J7r5h3yJ84POw9GglwFiu-8","lore_tm_v1_oNOu_nAhWnJaCSfqdZvFc1mrRrjZkQ1FilzfT-X4kQI","lore_tm_v1_csHHKBh7S3D2uH6zbfMC-QLLsB9pV4YyQL-GVEL5mhA","lore_tm_v1_VAEqjyzDSTibgp8BUiKwntoTyveCC33ocyxk4duNP9k","lore_tm_v1_OWWbsFbHTuBcQFNJsOmrskma8zh09oKpjWjhMpSkGmQ","lore_tm_v1_ASCjB4Pr4ZsiF_yk40FMgYlkiJ5Ga-Fi62BxzeDBH6I","lore_tm_v1_7YhtH1SOSYl6raxYJBoJBSaphnYyXUw5mkA8dW3cz4E"]
Date: Sep 9, 2026
packages/cli/src/lib/delta-upgrade.ts replaced the static GITHUB_RELEASES_URL import with getGitHubReleasesUrl() and added imports for PRIMARY_UPGRADE_SOURCE and UpgradeSource from ./binary.js; the direct GHCR_REPO import from ./ghcr.js was removed so delta-upgrade sources can carry their own repository configuration.packages/cli/src/lib/delta-upgrade.ts added isGitHubRelease(value), a runtime type guard requiring a non-null object with string tag_name and array assets; the narrowed type also permits optional draft and prerelease booleans.nightlySource(source: UpgradeSource) in packages/cli/src/lib/delta-upgrade.ts now passes source.ghcrRepo to ghcrSource() instead of using the former global GHCR_REPO; it retains registry https://ghcr.io, platform-specific getPlatformBinaryName(), tags formatted as nightly-${version}, compareVersions, user agent sentry-cli/${CLI_VERSION}, customFetch, and instrumentation.resolveNightlyChain() in packages/cli/src/lib/delta-upgrade.ts added optional source?: UpgradeSource, defaulting through getPrimaryUpgradeSource(); its OciClient now uses source.ghcrRepo. It obtains tags from preloadedTags or client.listTags(opts.token, PATCH_TAG_PREFIX, opts.signal) and returns null when the filtered chain has 0 entries or exceeds MAX_NIGHTLY_CHAIN_DEPTH.resolveNightlyDelta() in packages/cli/src/lib/delta-upgrade.ts added a final parameter source: UpgradeSource = getPrimaryUpgradeSource() and passes that source to nightlySource(source).validateChainStep() in packages/cli/src/lib/delta-upgrade.ts first verifies that getPatchFromVersion(manifest) equals opts.expectedFrom, returning a version-mismatch failure with expected and actual otherwise. If binpatchValidateChainStep() fails, the adapter distinguishes size-exceeded—including layerSize and budget—from missing-layer—including layerName.resolveDelta() in packages/cli/src/lib/delta-upgrade.ts delegates to resolveAndApply() with CLI_VERSION, target version, old/destination paths, getPatchCache(), offline mode, progress handling, and telemetry; it returns both the delta result and the telemetry-selected source.binpatch found the package at /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade/packages/cli/node_modules/binpatch, containing dist/, LICENSE, package.json, and README.md; generated artifacts are dist/index.d.ts, dist/index.js, and dist/index.js.map.binpatch constants in dist/index.js are CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3, MAX_CHAIN_WALK_DEPTH = 10, MAX_STABLE_CHAIN_DEPTH = 10, MAX_NIGHTLY_CHAIN_DEPTH = 30, SIZE_THRESHOLD_RATIO = 0.6, PATCH_TAG_PREFIX = "patch-", OCI REQUEST_TIMEOUT = 1e4, and MAX_RETRIES = 1.binpatch cache naming sanitizes versions with version.replace(/[^a-zA-Z0-9.-]/g, "_"); patch files use <fromVersion>-<toVersion>.patch, while chain metadata files use chain-<fromVersion>-<toVersion>.json.binpatch makeCache(cacheDir) exposes save, load, cleanup, and clear. Cache writes create the directory recursively with mode 448, write each patch separately, and store metadata containing fromVersion, toVersion, expectedSha256, cachedAt, and ordered patch steps with fromVersion, toVersion, and size.binpatch reconstructs cached chains by loading all chain-*.json metadata, mapping each fromVersion to its next version, walking from current to target with a maximum depth of 10, finding expectedSha256 from metadata ending at the target, and loading every required patch file; a missing step, checksum, or patch file makes the cache lookup return null.binpatch cache cleanup treats metadata older than 7 days as expired, preserves patch files referenced by live metadata, deletes unreferenced expired patches and expired chain metadata, removes malformed metadata files, and ignores ENOENT; clearPatchCache() attempts to unlink every cache file.binpatch resolveAndApply() tries the cache before network resolution; a cache hit reports telemetry source "cache" and applies immediately. An offline cache miss calls telemetry.onOfflineMiss() and returns null. Online resolution reports phase "resolve", defaults the unavailable reason to "no_patches", invokes source.resolveChain(), reports unavailability when no chain exists, asynchronously caches chains containing steps, reports telemetry source "network", and then applies the chain.binpatch applyChain() parses each patch header to estimate total output size, emits apply/verify phase and completion progress events, applies all patches in memory, and verifies the resulting SHA-256. A mismatch throws SHA-256 mismatch after patching: got ${sha256}, expected ${chain.expectedSha256}; success returns sha256, patchBytes: chain.totalSize, and chainLength: chain.patches.length.packages/cli/src/lib/ghcr.ts now imports PRIMARY_UPGRADE_SOURCE and UpgradeSource from ./binary.js, allowing GHCR operations to use source-specific repository configuration.packages/cli/src/lib/ghcr.ts added exported GhcrManifestHttpError extends UpgradeError; it stores the HTTP status, uses reason "network_error", sets name = "GhcrManifestHttpError", and formats its message as Failed to fetch manifest for tag "${tag}": HTTP ${status}.getAnonymousToken() in packages/cli/src/lib/ghcr.ts now accepts either UpgradeSource or AbortSignal as its first argument, defaults to PRIMARY_UPGRADE_SOURCE, accepts a second signal when a source is provided, and constructs the token scope as repository:${source.ghcrRepo}:pull; this preserves the former signal-only call shape.packages/cli/src/lib/ghcr.ts documents GHCR behavior: nightly package access uses anonymous token exchange; nightly version comes from the OCI manifest’s annotations.version; latest-version discovery requires 2 HTTP requests; and GHCR blob downloads return a 307 redirect to Azure Blob Storage that must be followed manually without forwarding the Authorization header, because Azure otherwise returns 404.packages/cli/src/lib/ghcr.ts performs the initial authenticated request with redirect: "manual" and a bounded GHCR-side signal, then follows the redirect using only the user-agent header and the caller’s signal. The Azure fetch deliberately has no fixed AbortSignal.timeout, because a full nightly binary is approximately 30 MB and a 30-second timeout would require sustained throughput of about 8 Mbps.