Distillation

Date: Sep 10, 2026

• 🔴 [requested-review] (05:08) User requested a READ-ONLY final security/supply-chain gate for getsentry/cli PR #1569 at exact base ec83887a16f780f32fba4b7d710bad262dba3a22 and head a84012184c79c2566c7466aa6beda5f767199218, using immutable Git objects only and never the worktree. Repository path: /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade.
• 🔴 (05:08) User requires: “Never modify; empty forbidden.” The requested review must return a substantive, non-empty report.
• 🔴 (05:08) User required inspection of every changed source and test file, covering: response-body cancellation identity; transport-vs-malformed classification across GitHub, npm, GHCR token, manifest, and tags; strict token and OCI layer/manifest runtime validation; endpoint shapes and exact tags; fail-closed caches; stable SemVer; provenance and channels; 404/source affinity; trusted pagination; scope; redirects; SHA; delta; cache; offline behavior; installer; and CodeQL.
• 🔴 (05:08) User required findings-first output using PASS / CONCERN / MUST-FIX / BLOCKED, exact-head file:line references, regressions, and residual gaps; the final line must be exactly MERGE or DO-NOT-MERGE.
• 🟡 (05:08) Git inspection reported 17 modified files: 1. packages/cli/src/commands/cli/upgrade.ts, 2. packages/cli/src/lib/binary.ts, 3. packages/cli/src/lib/delta-upgrade.ts, 4. packages/cli/src/lib/errors.ts, 5. packages/cli/src/lib/ghcr.ts, 6. packages/cli/src/lib/release-notes.ts, 7. packages/cli/src/lib/upgrade.ts, 8. packages/cli/src/lib/version-check.ts, 9. packages/cli/test/commands/cli.test.ts, 10. packages/cli/test/commands/cli/upgrade.test.ts, 11. packages/cli/test/lib/binary.test.ts, 12. packages/cli/test/lib/delta-upgrade.mocked.test.ts, 13. packages/cli/test/lib/delta-upgrade.test.ts, 14. packages/cli/test/lib/ghcr.test.ts, 15. packages/cli/test/lib/release-notes.test.ts, 16. packages/cli/test/lib/upgrade.test.ts, 17. packages/cli/test/lib/version-check.test.ts.
• 🟡 (05:08) Git/tool output included commit object IDs 110d6530e57ca4fbfb2a3f98e52013d2668b5b5e and 5f180e7390a7d23a8aad31d24d768d442ffaacbc, plus digest 5b5d53ac76ab3543a9a2f193f3f81d8589c97cc1a5000200e9237a212fdac6a6.
• 🔴 (05:09) User stated work must be “always fetchable from the base repo with github.”
• 🔴 [enforced-workflow] (05:09) User requires the regular PR workflow with minimal, clean diffs for dependency updates: create a properly named branch; commit including .lore.md; open, review, and merge a PR; inspect package.json and lockfile diffs; confirm peer-dependency ranges resolve; prevent unrelated churn; verify the branch tracks the correct remote and push to the correct PR branch; close redundant or duplicate PRs such as replaced Dependabot PRs; ensure all CI checks are green; rerun flaky jobs when necessary; and merge only when everything is clean.
• 🔴 (05:09) User requires Node.js API availability guards at module top level, such as typeof api === 'function', to prevent import-time crashes when newer APIs including zlib.zstdCompress are unavailable on older Node.js versions.
• 🔴 (05:09) User requires debug IDs to always be injected into JavaScript bundles during local builds, even without an auth token; upload should be gated inside the plugin. User also requires that sourcemaps never be shipped to end users in server-side deployments while development debuggability is preserved.
• 🔴 (05:09) User requires delta or multi-step patch chains to separate intermediate writes from source reads: never read and write the same path; use memory or distinct paths for intermediates; write only the final binary to its destination; verify the final SHA-256; and clean every temporary artifact in a finally block, including on failure.
• 🔴 (05:09) User requires Sentry CLI authentication and organization access to be verified before sentry issue list or similar queries: confirm authenticated identity and token expiry, accessible organizations, and the organization/project receiving the relevant telemetry; never assume the mapping. If access is insufficient, switch to an account with correct access, such as from ben@byk.im to byk@sentry.io.
• 🔴 (05:09) User requires packages in this pnpm workspace to be added with pnpm add -D <package> and kept in devDependencies; rationale: esbuild bundles runtime code and pnpm run check:deps enforces this shipped-CLI model, whereas regular dependencies violate it.
• 🔴 (05:09) User requires explicit CLI output and rendering contracts: never emit unsafe binary bytes in errors, never contaminate machine-readable JSON, never allow prompts to block scripts, and prefer graceful fallback over crashes. Terminal graphics fallbacks must preserve intended ordering and layout, avoid holes, and not downgrade eligible widgets without a genuine capability limitation; formatting, plain-mode semantics, categorical-chart support, examples, and edge cases must be validated.