Dashboard › cli › Distillation
45cbc2c4-338d-4ccd-b810-c5213302c398["lore_tm_v1_HZjkQCx0B2_YLD3B9KBa2UEsDmQzOnSiXFx2tAuMPv4","lore_tm_v1__KtNd1--6ke6YtHILYLZ5bXYts-X2SkAl0i9NqWhCKc","lore_tm_v1_Y__fKDyRJTpERdZ1_TFW2D2BXF3V-lglQzIBSewAHNI","lore_tm_v1_IGOc9XEb5RwFvIvTXtG_yxqxVlKKCMq5Q6sw0E8H9Ng","lore_tm_v1_0XByqhF6isLTwMvn2vMlGEe4F_d2zNOVtqTOENbdKZw","lore_tm_v1_4KeSouSXcYep1KzTt7OWUNJOVlxXu40Lo8r0iNNZLsI"]
Date: September 9, 2026
5xx / timeout / connection reset), whereas a poisoned tag fetches successfully with HTTP 200 and is rejected by validateNightlyChain."network" so they never trigger a false "malformed_chain" poison alert.from-version=<prev>, target checksum annotation sha256-<binaryName>=<hex>, and a patch layer titled <binaryName>.patch; the target image’s <binaryName>.gz layer supplies the full-download size for the ratio gate.filterAndSortChainTags() wraps the injected compareVersions in per-comparison try/catch; comparator exceptions return 0, malformed tags are skipped rather than crashing resolution, and a defensive sort guard prevents future comparator changes from crashing the chain.validateChainStep() classifies a mismatched from-version or missing platform patch layer as "malformed", and a layer exceeding sizeLimit as "over_budget".validateNightlyChain() validates every back-pointer, applies the cumulative budget fullGzSize * SIZE_THRESHOLD_RATIO - totalSize, requires the final tag version to equal targetVersion, and requires the last manifest’s sha256-<binaryName> annotation; failures map to "malformed_chain" or "over_budget"."no_patches" and chains longer than MAX_NIGHTLY_CHAIN_DEPTH as "too_long".Promise.all; successful manifest fetches are stored in Map<string, OciManifest>, and any missing manifest causes a null result after reporting "network" when a fetch failed.ghcrSource() instrumentation step names: "ghcr-token", "fetch-target-manifest", "list-patch-tags", "fetch-chain-manifest", and "download-patch".ghcrSource().resolveChain() treats a missing target <binaryName>.gz layer as "malformed_chain", catches only BinpatchError as "network" and returns null for full-download fallback, while non-BinpatchError programming failures propagate.No files found.https://raw.githubusercontent.com/BYK/binpatch/v0.4.2/src/sources/github-release.ts./home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade/packages/cli/src/lib/delta-upgrade.ts, totaling exactly 627 lines.packages/cli/src/lib/delta-upgrade.ts imports binpatch APIs including applyPatchChainInMemory, extractStableChain, filterAndSortChainTags, validateChainStep, ghcrSource, githubReleaseSource, makeCache, OciClient, resolveAndApply, MAX_NIGHTLY_CHAIN_DEPTH, PATCH_TAG_PREFIX, and SIZE_THRESHOLD_RATIO.nightlySource() configures ghcrSource with registry: "https://ghcr.io", repo: GHCR_REPO, binaryName: getPlatformBinaryName(), targetTag: (version) => \nightly-${version}`, compareVersions, userAgent: `sentry-cli/${CLI_VERSION}`, fetch: customFetch, and instrument`.stableSource() configures githubReleaseSource with releasesUrl: GITHUB_RELEASES_URL, binaryName: getPlatformBinaryName(), userAgent: \sentry-cli/${CLI_VERSION}`, fetch: customFetch, and instrument`.patch-chain:${fromVersion}-${toVersion} and makeCache(join(getConfigDir(), "patch-cache")); cache spans use operations "cache.get" and "cache.put" with attributes cache.key, cache.hit, and cache.item_size.canAttemptDelta() rejects delta upgrades when CLI_VERSION === "0.0.0-dev", when current and target versions are from different nightly/stable channels, or when the target is a downgrade.fetchRecentReleases() requests ${GITHUB_RELEASES_URL}?per_page=12, returns [] for non-OK responses, non-array JSON, or exceptions, and logs malformed responses and fetch failures with log.debug.validateChainStep() preserves richer telemetry reasons "version-mismatch", "missing-layer", and "size-exceeded" instead of binpatch’s coarser "malformed" and "over_budget" reasons.resolveNightlyChain() fetches manifests in parallel, silently returns null on manifest-fetch exceptions, validates cumulative patch size with opts.fullGzSize * SIZE_THRESHOLD_RATIO - totalSize, stamps telemetry_reason on validation failure, downloads blobs in parallel, and returns patches, actual downloaded totalSize, expectedSha256, and ordered steps.applyPatchChain() creates an "apply-patches" / "upgrade.delta.apply" span, records patches.count and patches.total_bytes, calls applyPatchChainInMemory, and throws SHA-256 mismatch after patching: got ${sha256}, expected ${chain.expectedSha256} when verification fails.{ format: "pct" }) because multi-hop apply totals can show 930 MB for a 310 MB install; pre-apply "download" and "read" phases retain byte formatting._source.current, sets delta.source, reports unavailability through telemetry_reason, and preserves source attribution in attemptDeltaUpgrade() even when patch application fails after successful resolution.attemptDeltaUpgrade() records delta.from_version, delta.to_version, delta.patch_bytes, delta.chain_length, delta.result, and delta.error; emits distributions upgrade.delta.patch_bytes and upgrade.delta.chain_length; captures failures as warning-level Sentry exceptions; logs fallback to full download; and returns null on failure.source.resolveChain(CLI_VERSION, targetVersion, signal), and caches it only when chain.steps exists and the signal remains active.<binaryName>, <binaryName>.gz, and <binaryName>.patch./^sha256:([0-9a-f]+)$/i and returns the lowercase hex digest.extractStableChain() classifies absent/misordered current or target releases as "no_patches", chains over MAX_STABLE_CHAIN_DEPTH as "too_long", missing target checksum or patch assets as "malformed_chain", and cumulative patch size above fullGzSize * SIZE_THRESHOLD_RATIO as "over_budget".{ fromVersion, toVersion }.githubReleaseSource() requests exactly MAX_STABLE_CHAIN_DEPTH + 2 releases, instruments release listing as "fetch-releases" and patch downloads as "download-patch", and reports request failures or failed listed-asset downloads as "network".${binaryName}.gz as "malformed_chain" and a missing target release as "no_patches"; patch downloads run in parallel via Promise.all.