Distillation

Date: Sep 9, 2026

• 🔴 [enforced-workdir] (12:25) User directed work in /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade for getsentry/cli#1244.
• 🔴 [enforced-scope] (12:25) User directed implementation ONLY in packages/cli/install and packages/cli/test/lib/install-script.test.ts; no TypeScript source files may be edited besides the installer test.
• 🔴 [requested-code] (12:25) User explicitly requested writing code rather than only reviewing or planning.
• 🔴 (12:25) User required an exact ordered source list: 1. getsentry/toolkit, 2. getsentry/cli.
• 🔴 (12:25) User required the source list to appear in a marked, single-line UPGRADE_SOURCES=(...) declaration that the parity test can inspect.
• 🔴 (12:25) User specified stable Toolkit tags use cli@VERSION, while legacy tags use VERSION.
• 🔴 (12:25) User required latest-stable discovery to select CLI releases in getsentry/toolkit without relying on repository-wide /latest, because that endpoint may identify an MCP release; legacy getsentry/cli may use /latest.
• 🔴 (12:25) User required pinned-stable behavior to probe the exact release/tag.
• 🔴 (12:25) User required nightly source selection to use a GitHub endpoint capable of returning a genuine HTTP 404 before obtaining the source-specific GHCR token, because GHCR HTTP 401/403 responses are ambiguous.
• 🔴 (12:25) User required nightly selection to use an exact/relevant GitHub probe and select the source once.
• 🔴 (12:25) User required fallback to legacy getsentry/cli ONLY on HTTP 404.
• 🔴 (12:25) User required HTTP 401, 403, 429, 5xx, network errors, and fetch failures to stop installation and fail rather than fall through.
• 🔴 (12:25) User required primary-source success to never contact legacy.
• 🔴 (12:25) User required preserving same-source gzip-to-raw asset fallback.
• 🔴 (12:25) User required preserving setup arguments.
• 🔴 (12:25) User required telemetry to remain fire-and-forget; telemetry never blocks installation or propagates failures.
• 🔴 [requested-tests] (12:25) User requested deterministic installer tests using the existing fake curl harness for, in exact requested order: 1. primary success, 2. HTTP 404 fallback, 3. non-404 stop, 4. network stop, 5. latest prefix filtering, 6. pinned stable, 7. nightly, 8. exact request order, 9. source affinity where practical.
• 🔴 [requested-tests] (12:25) User required running the focused test packages/cli/test/lib/install-script.test.ts.
• 🔴 [requested-report] (12:25) User required reporting exact focused-test results and the changed files.
• 🔴 [enforced-workflow] (12:25) Repository guidance states: always load repo-setup before situation skills.
• 🔴 [enforced-workflow] (12:25) Package guidance states: always check package.json for the latest scripts; commands run from the package context described by repository guidance.
• 🔴 [enforced-workflow] (12:25) Package guidance states that when adding a package, always use pnpm add -D <package> with the -D flag.
• 🟡 (12:25) Root AGENTS.md describes the pipeline as triage → explore → plan → implement → review → ship; worker is a deprecated alias of implement.
• 🟡 (12:25) Relevant repository files discovered include packages/cli/install, packages/cli/test/lib/install-script.test.ts, packages/cli/package.json, packages/cli/AGENTS.md, package.json, pnpm-workspace.yaml, pnpm-lock.yaml, .lore.md, and AGENTS.md.
• 🟡 (12:25) Existing packages/cli/test/lib/install-script.test.ts imports UPGRADE_SOURCES from ../../src/lib/binary.js and has a parity test matching /^UPGRADE_SOURCES=\(([^)]*)\)$/m, then comparing its whitespace-separated entries with UPGRADE_SOURCES.map((source) => source.githubRepo).
• 🟡 (12:25) Existing installer test "passes --no-agent-skills through to sentry cli setup" invokes bash packages/cli/install --version 0.31.0 --no-modify-path --no-completions --no-agent-skills through a fake curl/gunzip harness and expects setup arguments in this exact order: cli, setup, --install, --method, curl, --channel, stable, --no-modify-path, --no-completions, --no-agent-skills.
• 🟡 (12:25) Existing fake curl harness writes a generated shell script whose arguments are recorded in $SENTRY_TEST_ARGS_FILE; fake gunzip runs cat.
• 🟡 (12:25) Existing packages/cli/install comments already characterize telemetry as fire-and-forget and state it never blocks installation or propagates failures.