Distillation

Date: Sep 10, 2026

• 🔴 [requested-review] (03:45) User requested a READ-ONLY correctness merge gate for getsentry/cli PR #1569 at exact base ec83887a16f780f32fba4b7d710bad262dba3a22 and head f1c10a6cb1a753b8c4b8c613cd78735c3f12cba6, using repo /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade.
• 🔴 [enforced-workflow] (03:45) User required inspection of immutable Git objects only via git show head:path and git diff base..head; never inspect worktree contents or state and never modify anything.
• 🔴 (03:45) User stated: “never worktree contents/state.”
• 🔴 (03:45) User required every changed file and test to be inspected.
• 🔴 (03:45) User required verification of all prior blockers: exact pins bypass latest; target-driven Homebrew/npm routing; one-off pinned nightly preserves the tracking channel while using nightly changelog/source; stable semantic prereleases are excluded from latest/delta/recent/changelog for Toolkit and legacy; branded normalized prefetch provenance uses a structural source key; raw cross-source data is rejected; exact stable/nightly metadata; 404-only behavior, affinity, pagination, GHCR arbitrary failure/abort behavior, redirect authentication, SHA, delta, cache, offline behavior, and API compatibility.
• 🔴 (03:45) User required non-empty, findings-first output with PASS/CONCERN/MUST-FIX/BLOCKED, exact-head file:line references, a deterministic regression for each defect, residual gaps, and a final line exactly MERGE or DO-NOT-MERGE.
• 🟡 (03:46) Git inspection identified 16 changed files: packages/cli/src/commands/cli/upgrade.ts, packages/cli/src/lib/binary.ts, packages/cli/src/lib/delta-upgrade.ts, packages/cli/src/lib/ghcr.ts, packages/cli/src/lib/release-notes.ts, packages/cli/src/lib/upgrade.ts, packages/cli/src/lib/version-check.ts, packages/cli/test/commands/cli.test.ts, packages/cli/test/commands/cli/upgrade.test.ts, packages/cli/test/lib/binary.test.ts, packages/cli/test/lib/delta-upgrade.mocked.test.ts, packages/cli/test/lib/delta-upgrade.test.ts, packages/cli/test/lib/ghcr.test.ts, packages/cli/test/lib/release-notes.test.ts, packages/cli/test/lib/upgrade.test.ts, and packages/cli/test/lib/version-check.test.ts.
• 🟡 (03:46) Diff statistics for PR #1569: 16 files changed, 2,539 insertions, and 383 deletions. Per-file changes: packages/cli/src/commands/cli/upgrade.ts 176 lines; packages/cli/src/lib/binary.ts 154; packages/cli/src/lib/delta-upgrade.ts 170; packages/cli/src/lib/ghcr.ts 102; packages/cli/src/lib/release-notes.ts 132; packages/cli/src/lib/upgrade.ts 443; packages/cli/src/lib/version-check.ts 21; packages/cli/test/commands/cli.test.ts 40; packages/cli/test/commands/cli/upgrade.test.ts 283; packages/cli/test/lib/binary.test.ts 130; packages/cli/test/lib/delta-upgrade.mocked.test.ts 14; packages/cli/test/lib/delta-upgrade.test.ts 220; packages/cli/test/lib/ghcr.test.ts 123; packages/cli/test/lib/release-notes.test.ts 217; packages/cli/test/lib/upgrade.test.ts 572; packages/cli/test/lib/version-check.test.ts 125.
• 🔴 (03:46) User stated large artifacts are always written with pipeline() into createWriteStream(), rather than buffering the complete payload in memory, to avoid memory peaks and preserve backpressure for shipped CLI workloads.
• 🔴 (03:46) User stated ValidationError must always pass field; omitting it collapses unfielded errors into one fingerprint.
• 🔴 (03:46) User stated per-object extraction errors are always swallowed and never abort the surrounding upload in src/lib/dif/scan.ts and src/lib/dif/index.ts. This applies to embedded PPDB extraction via extractEmbeddedPpdb, IL2CPP mappings via createIl2cppLineMapping, and source bundles; errors are caught per object and logged at debug level.
• 🔴 (03:46) User stated PeekResult.format is never 'unknown'; unrecognized formats return null from peekHeader.
• 🔴 (03:46) User stated nested ZIP archives are never recursively scanned, regardless of the scanZips setting.
• 🔴 (03:46) User stated content is always fetchable from the base repo with GitHub.
• 🔴 (03:46) User stated ApiError type must be preserved so classifySilenced in src/lib/error-reporting.ts can silence HTTP 401–499 errors; wrapping it in generic CliError loses status and causes errors such as 403 responses to be captured. The prescribed rethrow is new ApiError(msg, error.status, error.detail, error.endpoint), with a terse message because ApiError.format() appends detail and endpoint.
• 🔴 (03:46) User stated ApiError fingerprinting keys by api_status + command, and fingerprint-rule changes do not retroactively re-fingerprint existing events, so new groups must be manually merged into canonical old parents.
• 🔴 (03:46) User stated GitHub Actions workflows in sentry-cli centralize Node pins as workflow-level environment variables NODE_VERSION_22: "22.23.1" and NODE_VERSION_24: "24.18.0"; actions/setup-node must reference ${{ env.NODE_VERSION_22 }} or ${{ env.NODE_VERSION_24 }}, not bare "22" or "24". Matrix jobs use ${{ matrix.node == '24' && env.NODE_VERSION_24 || env.NODE_VERSION_22 }}.
• 🔴 (03:46) User stated the npm-package Node matrix convention uses NODE_VERSION_20: "20.20.2" for the WASM-SQLite floor, NODE_VERSION_22: "22.23.1", and NODE_VERSION_24: "24.18.0"; build on the development Node floor of 22.15+ using env.NODE_VERSION_22, then smoke-test matrix Node versions with the fallback path exercised in CI.
• 🔴 (03:46) User stated Node 24.17.0 and 22.23.0 contained the ERR_STREAM_PREMATURE_CLOSE regression associated with the CVE-2026-48931 http.Agent fix, corrected in Node 24.18.0 and 22.23.1 under nodejs/node#64004.
• 🔴 (03:46) User stated that when reconciling stale branches, state must first be verified with Git/GitHub primitives: compare recent git log output for origin/main and the local branch, inspect missing/extra commits, run git worktree list, check PR state with gh pr view <#> --json mergeable,state,headRefOid,baseRefOid, run git status, and classify conflicts by UU/AU/DU/D/A before resolution.
• 🔴 (03:46) User stated Git conflict resolution must stage explicit file paths and never use git add -A, to avoid silently staging generated, unrelated, or sensitive files.