Distillation

Date: Sep 9, 2026

• 🔴 [requested-read-only-analysis] (09:30) User requested read-only analysis in /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade; explicitly instructed not to edit files.
• 🟡 (09:30) User asked to analyze packages/cli/install and packages/cli/test/lib/install-script.test.ts.
• 🟡 (09:30) User asked for the smallest shell implementation and deterministic tests covering, in order: stable latest, pinned stable, rolling nightly, and pinned nightly, with Toolkit-first resolution followed by legacy fallback.
• 🔴 (09:30) User specified source fallback is allowed only for an actual HTTP 404.
• 🔴 (09:30) User specified non-404 curl failures, HTTP failures, authentication failures, network failures, and malformed responses must stop installation rather than try another repository.
• 🔴 (09:30) User specified gzip-to-raw fallback is an asset fallback within one selected repository and must not switch repositories prematurely.
• 🔴 (09:30) User specified the selected source must stay fixed for token, manifest, and blob operations.
• 🔴 (09:30) User specified the shell source list must have exact parity with the TypeScript source list.
• 🔴 (09:30) User specified installer telemetry must remain nonblocking and must not propagate failures.
• 🔴 [rejected-scope] (09:30) User directed: “Never address unrelated musl defect.”
• 🟡 (09:30) User requested concrete function/flow changes, a fake curl test design, and relevant shell pitfalls.
• 🟡 (09:30) Repository worktree contains AGENTS.md, .lore.md, packages/, apps/, node_modules/, package.json, pnpm-lock.yaml, and pnpm-workspace.yaml.
• 🔴 [enforced-workflow] (09:31) User requires loading repo-setup before situation skills.
• 🟡 (09:31) AGENTS.md defines the pipeline as triage → explore → plan → implement → review → ship; worker is a deprecated alias of implement.
• 🟡 (09:31) AGENTS.md says target repositories should have their AGENTS.md / CONTRIBUTING.md read first; skills live under .agents/skills/ and are generated from canonical skills/ by scripts/sync-skills.mjs.
• 🟡 (09:31) Current packages/cli/install is a 362-line Bash script using set -euo pipefail.
• 🔴 (09:31) User requires installer telemetry to “never block installation or propagate failures.”
• 🔴 (09:31) User requires telemetry to “never fail the script.”
• 🟡 (09:31) Current telemetry implementation in packages/cli/install uses report_error() in a background subshell at lines 29–63, runs set +e, invokes curl -sf --max-time 2, and supports opt-out via SENTRY_CLI_NO_TELEMETRY=1.
• 🟡 (09:31) Current die() at packages/cli/install:67-72 prints the error, calls report_error, then runs wait 2>/dev/null || true before exiting 1; an ERR trap at line 75 reports unexpected failures.
• 🟡 (09:31) Current installer version input comes from SENTRY_VERSION, -v, or --version; accepted examples include stable versions such as 0.42.2 and the literal nightly.
• 🟡 (09:31) Current nightly flow in packages/cli/install:213-275 is hard-coded to getsentry/cli: fetch anonymous GHCR token with scope repository:getsentry/cli:pull; fetch /v2/getsentry/cli/manifests/nightly; extract version; find the platform .gz layer digest; request /v2/getsentry/cli/blobs/${digest}; then download the unauthenticated redirect URL and pipe it through gunzip.
• 🟡 (09:31) Current nightly redirect handling intentionally does not use curl -L on the authenticated GHCR blob request because forwarding the Authorization header to Azure Blob Storage returns 404.
• 🟡 (09:31) Current stable-latest flow in packages/cli/install:279-284 is hard-coded to https://api.github.com/repos/getsentry/cli/releases/latest and extracts "tag_name" with sed.
• 🟡 (09:31) Current pinned-stable flow sets version="$requested_version" directly, then strips a leading v.
• 🟡 (09:31) Current stable asset URL at packages/cli/install:291-303 is https://github.com/getsentry/cli/releases/download/${version}/sentry-${os}-${arch}${libc_suffix}${suffix}.
• 🟡 (09:31) Current stable download first attempts ${url}.gz through curl -fsSL | gunzip > "$tmp_binary"; on any pipeline failure it attempts the raw $url, so it does not currently distinguish a missing gzip asset (404) from network, auth, malformed gzip, or other failures.
• 🟡 (09:31) Installer delegates to "$tmp_binary" cli setup with --install --method curl --channel stable|nightly, plus optional --no-modify-path, --no-completions, and --no-agent-skills.
• 🟡 (09:32) Current packages/cli/test/lib/install-script.test.ts has 119 lines and uses Vitest plus a temporary fake-tool directory prepended to PATH.
• 🟡 (09:32) Existing fake curl emits a shell script that records setup arguments to SENTRY_TEST_ARGS_FILE; existing fake gunzip simply runs cat.
• 🟡 (09:32) Existing installer test invokes bash packages/cli/install --version 0.31.0 --no-modify-path --no-completions --no-agent-skills and expects exit code 0 plus setup arguments in exact order: cli, setup, --install, --method, curl, --channel, stable, --no-modify-path, --no-completions, --no-agent-skills.
• 🟡 (09:32) Existing parity test expects packages/cli/install to contain a single-line UPGRADE_SOURCES=(...) assignment and compares its whitespace-separated entries with UPGRADE_SOURCES.map((source) => source.githubRepo) from packages/cli/src/lib/binary.js.
• 🟡 (09:32) packages/cli/src/lib/binary.ts:115-127 defines the exact ordered TypeScript source list: 1. Toolkit — githubRepo: "getsentry/toolkit", ghcrRepo: "getsentry/toolkit", tagPrefix: "cli@"; 2. legacy CLI — githubRepo: "getsentry/cli", ghcrRepo: "getsentry/cli", tagPrefix: "".
• 🟡 (09:32) Toolkit stable release asset tags must use the cli@ prefix, while legacy getsentry/cli stable release asset tags have no prefix.
• 🟡 (09:32) getBinaryDownloadUrl() in packages/cli/src/lib/binary.ts:234-240 constructs https://github.com/${source.githubRepo}/releases/download/${source.tagPrefix}${version}/${getPlatformBinaryName()}.
• 🔴 (09:32) User requires successful source probing to reuse its response so the installer “never repeats the request.”
• 🟡 (09:32) The TypeScript source resolver contract in packages/cli/src/lib/binary.ts:260-290 probes each ${getGitHubReleasesUrl(source)}/latest; returns the first successful source together with the successful response; advances only on HTTP 404; aborts on every other HTTP or network failure; and reports an error if every source returns 404.
• 🟡 (09:32) packages/cli/src/lib/binary.ts defines nightly versions as strings containing -dev.; documented format is X.Y.Z-dev.<unix-seconds>.
• 🟡 (09:32) packages/cli/src/lib/upgrade.ts defines rolling nightly tag NIGHTLY_TAG = "nightly" and documents pinned nightly GHCR tags in the form nightly-${version}, such as nightly-0.14.0-dev.1772661724.