Dashboard › cli › Distillation
33f571ec-b0ff-4042-b512-01f263e84ed7["lore_tm_v1_R1J7Kq2trmSdYqekOieiffo5Ef1P78dd9AZjMtTpNeE","lore_tm_v1_mfVoA2hzvC9JV39DvPzHWV3CRfGE5hp2Nzwd2vVyQp0","lore_tm_v1_lmuPzOCJzLHRe5hKqCtndozkLAm12rlUSmZZbsHAHWk","lore_tm_v1_ZVhBAZQpVgRHTjtRbqSSFdMLRfdNoU_WzTDNxVHkxiY","lore_tm_v1_7jAw5gj39LaYs_gbvBaavD6L_4rrimOSWdgxMxa1DOA"]
Date: Sep 9, 2026
bd065083c and exact head 4094ae9a7, using worktree /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade.PASS, CONCERN, or MUST-FIX, with exact file:line evidence, a deterministic regression for each defect, and a concrete fix; if no defect exists, report PASS and residual risks; end exactly with MERGE or DO-NOT-MERGE..craft.yml, .git, .github/, .gitignore, .lore.md, .nojekyll, .npmrc, AGENTS.md, apps/, CHANGELOG.md, codemods/, docs/, LICENSE.md, node_modules/, package.json, packages/, pnpm-lock.yaml, pnpm-workspace.yaml, and README.md.AGENTS.md:25-29: long-term Outpost knowledge lives in .lore.md when present; target repositories require reading AGENTS.md / CONTRIBUTING.md first; skills are under .agents/skills/, generated from canonical skills/ by scripts/sync-skills.mjs; always load repo-setup before situation skills.AGENTS.md:18-19 is triage → explore → plan → implement → review → ship; worker is a deprecated alias of implement.bd065083c3b82677747b97a6cc7f5cf57532d3bc; head/current revision 4094ae9a7670f2bf46898fc7d5b8c7d89cf70819..github/workflows/ci.yml (+1); package.json (+3/-1); packages/cli/install (+192 with substantial rewrite); packages/cli/package.json (+3/-1); packages/cli/src/commands/cli/upgrade.ts (+114); packages/cli/src/lib/binary.ts (+146); packages/cli/src/lib/delta-upgrade.ts (+81); packages/cli/src/lib/ghcr.ts (+48); packages/cli/src/lib/release-notes.ts (+119); packages/cli/src/lib/upgrade.ts (+313); packages/cli/src/lib/version-check.ts (+21); packages/cli/test/commands/cli/upgrade.test.ts (+71); packages/cli/test/lib/binary.test.ts (+128); packages/cli/test/lib/delta-upgrade.test.ts (+173); packages/cli/test/lib/ghcr.test.ts (+26); packages/cli/test/lib/install-script.test.ts (+333); packages/cli/test/lib/release-notes.test.ts (+113); packages/cli/test/lib/upgrade.test.ts (+249); packages/cli/test/lib/version-check.test.ts (+125)..github/workflows/ci.yml adds pnpm run check:upgrade-sources to the lint job after pnpm run check:stale-refs.package.json adds script "check:upgrade-sources": "pnpm --filter sentry run check:upgrade-sources"; packages/cli/package.json maps it to vitest run test/lib/install-script.test.ts -t 'embeds the shared ordered upgrade source list'.packages/cli/install defines the ordered source parity marker # UPGRADE_SOURCES_SYNC: keep these github|ghcr|tag-prefix entries in sync with src/lib/binary.ts. and exact list UPGRADE_SOURCES=('getsentry/toolkit|getsentry/toolkit|cli@' 'getsentry/cli|getsentry/cli|').report_error() runs in a background subshell, respects SENTRY_CLI_NO_TELEMETRY=1, uses set +e, sends with curl -sf --max-time 2, and must never block installation, propagate failures, or fail the script.packages/cli/install removes wait 2>/dev/null || true from die(), so it reports telemetry and immediately exits with status 1 rather than waiting for background telemetry.packages/cli/install temp artifacts are tmp_binary="${tmpdir}/sentry-install-$$${suffix}", github_response="${tmpdir}/sentry-install-github-response-$$", and nightly_manifest_file="${tmpdir}/sentry-install-nightly-manifest-$$"; the EXIT trap removes all three via rm -f.packages/cli/install adds github_get(), which runs curl -sS -L -o "$github_response" -w '%{http_code}' "$url"; transport failure calls die "Failed to connect to GitHub while fetching ${url}" "gh-fetch", while callers inspect http_status.packages/cli/install adds source parsing helpers source_tag_prefix(), source_github_repo(), and source_ghcr_repo(), each splitting a github|ghcr|tag-prefix entry with cut -d'|'.select_nightly_source() iterates UPGRADE_SOURCES in order, probes https://api.github.com/repos/${github_repo}, falls through only on GitHub 404, rejects other non-2xx statuses, fetches an anonymous GHCR pull token scoped to repository:${ghcr_repo}:pull, fetches https://ghcr.io/v2/${ghcr_repo}/manifests/nightly, falls through on manifest 404, rejects other non-2xx statuses, requires a nonempty manifest, then fixes selected_source and selected_ghcr_source; if every source returns 404 it dies with No CLI upgrade source was found: every source returned HTTP 404.select_stable_source() iterates UPGRADE_SOURCES in order. For the Toolkit source with tag prefix cli@, latest resolution queries /releases?per_page=100; for the legacy source with no prefix it queries /releases/latest; explicit versions query /releases/tags/${tag_path}, replacing @ with %40. Only 404 falls through; other non-2xx statuses fail.tag_name matching exact awk regex ^cli@v?[0-9]+\.[0-9]+\.[0-9]+(\+[0-9A-Za-z.-]+)?$, strips cli@, then strips a leading v; legacy parsing takes the first tag_name and strips a leading v.tag="${selected_tag_prefix}${version}" and url="https://github.com/${selected_source}/releases/download/${tag}/${filename}"; download first attempts ${url}.gz piped to gunzip, then falls back to the raw $url.401 or 403 for both missing and inaccessible packages. After selection, manifest version and platform layer digest are parsed with awk; expected asset is sentry-${os}-${arch}${libc_suffix}${suffix}.gz.Authorization: Bearer $GHCR_TOKEN only to https://ghcr.io/v2/${selected_ghcr_source}/blobs/${digest}, extracts %{redirect_url}, and downloads the Azure redirect URL separately without the authorization header before piping through gunzip > "$tmp_binary".packages/cli/install runs chmod +x "$tmp_binary", constructs setup_args="--install --method curl --channel $channel" plus optional --no-modify-path, --no-completions, and --no-agent-skills, removes $github_response, disables the EXIT trap, and invokes "$tmp_binary" cli setup $setup_args.