Distillation

🔴 (09:29) User directive: Always preserve strict API output-mode and binary-safety contracts. sentry api must preserve rawApiRequest() status text; empty textual non-2xx bodies must fall back to HTTP status/request context; JSON mode must expose {status, statusText, body}; binary Uint8Array successes bypass formatters and remain raw; binary errors expose only status/content-type/byte-count summaries, never bytes or JSON coercion; prompts must not block scripted runs or interleave with stdout JSON. 🔴 (09:29) @sentry/symbolic@13.4.0 exports Archive, FileEntry, ObjectFile, SourceBundleWriter, and SourceFileDescriptor. SourceBundleWriter.writeObject(object: ObjectFile, object_name: string, filter: Function, provider: Function): Uint8Array | undefined supports callback-based source bundling; bundle-sources is implementable with a disk-reading provider, while print-sources is blocked because ObjectFile lacks sourceFiles() enumeration. SourceFileDescriptor properties are contents, debugId, path, sourceMappingUrl, url, and type; confirmed by Dav1dde, Sebastian Zivota’s colleague, on June 23, 2026. 🔴 (09:29) Linux-x64 Node 24 LTS binary composition: Node.js runtime is 121 MiB and bundled code is about 6.3 MiB, so runtime is 94.5%. strip --strip-unneeded yields 99 MiB (-17 MiB raw, -4 MiB compressed); fossilize 0.7.0 strips the copied binary before postject injection. After strip+SEA+binpunch the binary is about 108 MiB raw/30 MiB gzip versus 125 MiB/34 MiB unstripped. .rodata is 52.5 MB, including about 12 MB V8 snapshot and about 28 MB full ICU data. 🔴 (09:29) Binary-size alternatives: UPX reaches 25 MiB but was rejected because it destroys ELF notes; --with-intl=small-icu saves about 26–28 MiB and is the largest custom-build win; --without-lief breaks SEA; --without-sqlite breaks the CLI; --disable-single-executable-application breaks everything. Custom builds were deferred for poor cost/benefit: about 3.5 hours versus 5 minutes for fossilize. Final performance versus Bun: 30 MiB download versus 32 MiB, --version about 1.0s versus 1.9s, completions about 150ms versus 180ms. 🔴 (09:29) binpatch TRDIFF10 wire format uses 8-byte magic TRDIFF10\x00, then little-endian sign-magnitude int64 controlLen, diffLen, and newSize; 24-byte control tuples contain readDiffBy, readExtraBy, and seekBy; control/diff/extra blocks are zstd-compressed. 🔴 (09:29) OCI delta tags are <repo>:nightly (mutable pointer), <repo>:nightly-<version> (immutable), and <repo>:patch-<version> (patches). Annotations are from-version=<prev> as a pointer rather than a hash, sha256-<binaryName>=<hex> for the final binary hash only, and org.opencontainers.image.title; artifact type is application/vnd.<prefix>.patch. 🔴 (09:29) Delta security constants are MAX_OUTPUT_SIZE=2_147_483_648 (2 GiB), MAX_NIGHTLY_CHAIN_DEPTH=30, MAX_STABLE_CHAIN_DEPTH=10, and SIZE_THRESHOLD_RATIO=0.6. Patch chains hash only the final output, not intermediate hops, for performance. 🔴 (09:29) bspatch.ts core patching was refactored into callback-based transformPatch(oldFile, patchData, onChunk). Public APIs are: applyPatchToFile(oldPath, patchData, destPath)→SHA-256 for the final disk sink; applyPatchToMemory(oldFile, patchData)→Uint8Array for intermediate hops; and applyPatchChainInMemory(oldPath, patches[], destPath)→SHA-256 for full-chain orchestration. applyPatch() remains a backward-compatible thin wrapper. 🔴 (09:29) Patch orchestration belongs in bspatch.ts, not delta-upgrade.ts, to encapsulate buffer handling. onChunk checks a writeError flag set by the writer’s error event and throws immediately. applyPatchToMemory preallocates a Uint8Array of newSize; a corrupt huge size causes RangeError and triggers full-download fallback. 🔴 (09:29) User directive: applyPatch() ALWAYS computes SHA-256 inline and returns it—there is no separate verification step. 🔴 (09:29) TRDIFF10 application in bspatch.ts uses a 32-byte header (magic plus controlLen, diffLen, newSize, all i64 LE). The control block is fully decompressed with zstdDecompressSync for random access; diff and extra blocks stream through createZstdStreamReader using Node Transform → Web ReadableStream → BufferedStreamReader. 🔴 (09:29) loadOldBinary() copies to a temporary file with COPYFILE_FICLONE (CoW reflink, regular-copy fallback) before reading into memory. cleanupPatchResources() runs every cleanup step despite prior failures. Writer errors are captured with writer.on('error') to avoid ERR_UNHANDLED_ERROR on ENOSPC/EIO. 🔴 (09:29) script/check-fragments.ts performs Checks 1–4 against actual route names and Check 5 for fragment coverage of every subcommand on routes with more than one command. Coverage can be a heading outside fenced code blocks or a sentry <route> <subcommand> code reference; bare sentry <route> covers the default command, detected from route-index defaultCommand. Warnings are default; --strict makes them errors. Run with pnpm run check:fragments; CI check-generated runs it when changes.outputs.skill == 'true'. 🔴 (09:29) script/check-stale-references.ts derives stale package managers from packageManager in package.json (for example pnpm@10.11.0) and scans developer docs/scripts for stale <pm> run, <pm> remove, <pm> add -d, requires <pm>, and <pm> installed references. It excludes global-install examples (install -g/add -g fenced blocks), node_modules/, and itself to avoid JSDoc false positives. It is generic across package-manager migrations and is included in the CI lint job. 🔴 (09:29) PR #1329 fixed .github/workflows/ci.yml generate-patches same-series selection. Root cause: sort -V placed 0.41 nightlies after all 0.40 nightlies, so 0.40 builds could select a 0.41.x-dev.Y predecessor. Fix: derive MAJOR_MINOR=$(echo "${VERSION}" | cut -d. -f1,2), filter with SAME_SERIES_TAGS=$(printf '%s\n' "$TAGS" | grep "^nightly-${MAJOR_MINOR}\\." || true), and walk only SAME_SERIES_TAGS. PREV_TAG flows to publish-nightly, which strips nightly-/v for from-version. 🔴 (09:29) Same-series delta filtering was verified end-to-end for 0.40.0-dev.1785526951→0.40.0-dev.1785546241: 2 patches totaling 249.9 KB rather than about 31 MB for a full download. 🔴 (09:29) In src/commands/issue/list.ts, LIFETIME_FIELDS = new Set(['count','userCount','firstSeen','lastSeen']). buildListApiOptions(json, fields) enables collapseLifetime only when json && fields !== undefined && fields.length > 0 && !fields.some(f => LIFETIME_FIELDS.has(f)); human output never collapses lifetime. 🔴 (09:29) User directive: buildIssueListCollapse() always starts with ['filtered','unhandled'], then conditionally adds 'lifetime' and 'stats'. 🔴 (09:29) ISSUE_DETAIL_COLLAPSE can include 'lifetime' because the detail endpoint preserves top-level fields. IssueViewOutputSchema in src/types/sentry.ts extends SentryIssueSchema with event, org, replayIds, and trace from jsonTransformIssueView; view.ts wires it through schema: IssueViewOutputSchema. count, userCount, firstSeen, and lastSeen remain present for issue view and may be absent only from collapsed issue list. 🔴 (09:29) Consola is the chosen CLI logger with Sentry createConsolaReporter integration. Reporters are FancyReporter on stderr plus Sentry structured logs; level comes from SENTRY_LOG_LEVEL. buildCommand injects hidden --log-level and --verbose; withTag() creates independent instances and setLogLevel() propagates through a registry. User-facing output must use consola rather than raw stderr; HandlerContext intentionally omits stderr. 🔴 (09:29) Telemetry opt-out priority is: 1. SENTRY_CLI_NO_TELEMETRY=1, 2. DO_NOT_TRACK=1, 3. metadata.defaults.telemetry, 4. default enabled. Shell completions set SENTRY_CLI_NO_TELEMETRY=1 in bin.ts before imports. Completion timings queue in SQLite table completion_telemetry_queue; normal runs drain with DELETE ... RETURNING. 🔴 (09:29) ENV_VAR_REGISTRY in src/lib/env-registry.ts is the source of truth for honored environment variables. topLevel: true plus briefDescription exposes a variable in --help; install-script-only variables use installOnly: true. 🔴 (09:29) Custom CA resolution in src/lib/custom-ca.ts prioritizes: 1. SQLite sentry cli defaults ca-cert, 2. NODE_EXTRA_CA_CERTS. Resolution is process-cached with hasResolved; resolve() appends custom PEM to rootCertificates. tryReadPem() never throws: missing files warn and return undefined. injectIntoNodeTls() uses tls.setDefaultCACertificates() on Node 24+ and is a no-op on Node 22. 🔴 (09:29) TLS_ERROR_PATTERNS has 5 patterns: local issuer, verify first cert, UNABLE_TO_VERIFY_LEAF_SIGNATURE, DEPTH_ZERO_SELF_SIGNED_CERT, and SELF_SIGNED_CERT_IN_CHAIN; it excludes CERT_HAS_EXPIRED and ERR_TLS_CERT_ALTNAME_INVALID. getTlsCertErrorMessage() walks error.cause with cycle detection. SaaS plus env-sourced CA produces a one-time warning; a stored default suppresses it. __resetForTests() clears all cached state. 🔴 (09:29) delta-upgrade.ts supports stable GitHub Releases and nightly GHCR patch-<version> deltas in TRDIFF10 format. Stable resolution fetches releases/assets in one API call and downloads with parallel Promise.all; nightly resolution lists tags, filters a semver range, fetches manifests, then downloads blobs in parallel. tryLoadCachedChain() is cache-first with key patch-chain:{from}-{to}; canAttemptDelta() blocks dev versions, cross-channel transitions, and downgrades. 🔴 (09:29) Legacy applyPatchesSequentially() alternates ${destPath}.patching.a and ${destPath}.patching.b to avoid reading and writing the same mmap-backed path. SHA-256 is verified once after all patches, not for intermediates. 🔴 (09:29) script/generate-docs-sections.ts is 555+ lines and injects generated content into committed files between HTML markers <!-- GENERATED:START name --> for .md and MDX markers {/* GENERATED:START name */} for .mdx. --check is a dry run that exits 1 when stale. extractPnpmVersion and extractNodeVersion throw on mismatch rather than falling back. 🔴 (09:29) generate-docs-sections.ts owns 13 sections across 5 files: contributing.md (project-structure, dev-prereq, build-commands); DEVELOPMENT.md (oauth-scopes, dev-env-vars, dev-prereq, build-toolchain); self-hosted.md (oauth-scopes, self-hosted-env-vars); README.md (dev-prereq, library-prereq, dev-scripts); and getting-started.mdx (platform-support). No Bun references remain; CI check-generated uses --check. 🔴 (09:29) User directive for generateProjectStructure(): groups (route directories) always use the ├── prefix regardless of position because standalone entries always follow groups. Standalones include manually added help.ts; the last standalone uses └── and others use ├──. Groups and standalones are alphabetically sorted within their sections; output is a fenced cli/ tree. 🔴 (09:29) Lore describes the generate:docs master sequence as: 1. generate:parser → script/generate-parser.ts, 2. generate:command-docs → script/generate-command-docs.ts, 3. generate:skill → script/generate-skill.ts, 4. generate:docs-sections → script/generate-docs-sections.ts. It is a prerequisite for dev, build, build:all, bundle, typecheck, test:unit, test:changed, and test:e2e. 🔴 (09:29) Generated-output ownership: docs/src/content/docs/commands/ and docs/src/content/docs/configuration.md are fully generated and gitignored; docs/src/fragments/ is committed hand-written source of truth; DEVELOPMENT.md, README.md, contributing.md, self-hosted.md, and getting-started.mdx are committed with generated marker sections. 🔴 (09:29) GitHub data sources for getsentry/cli: /repos/getsentry/cli/security-advisories was empty, while /repos/getsentry/cli/dependabot/alerts was the source of truth with 13 open and 15 fixed alerts as of August 1, 2026. Alerts represent stale lockfile entries with no source manifest or transitive dependencies with no direct upgrade path. pnpm.overrides in package.json is the canonical transitive-vulnerability fix; direct upgrades cascade through the lockfile. pnpm audit has additional scope, such as @ai-sdk/provider-utils@<=3.0.97 LOW CVE-2026-8769, requiring a package upgrade rather than an override. (meaning Aug 1, 2026) 🔴 (09:29) getsentry/symbolic WASM uses C zstd through zstd-sys on every target, including wasm32-unknown-unknown; zstd-sys supplies wasm-shim/, and build.rs enables it for wasm32. CI wasm-build installs clang lld llvm. ruzstd was rejected because it is significantly slower per the crate author and Sebastian Zivota. 🔴 (09:29) Symbolic WASM ownership uses self_cell with SelfCell<ByteView<'static>, di::Archive<'static>>. The JavaScript export rename is #[wasm_bindgen(js_name = "ObjectFile")]. Canonical names use .name() lowercase values such as elf and x86_64, not {:?} debug formatting. Smoke tests live in symbolic-wasm/npm/ so npm test works there. Symbolic PRs #988 and #992 had to merge and republish before the CLI bundle-sources PR. 🔴 (09:29) InkUI.tearDown() must execute 6 ordered steps, each in try/catch: 1. stop tip-rotation interval; 2. detach SIGINT listener and call store.setRequestCancel(undefined); 3. instance.clear(); 4. instance.unmount(); 5. restore alternate screen with \x1b[?1049l; 6. call freshStdin.setRawMode(false), .pause(), and .destroy(). torndown: boolean prevents double unmount; a second Ctrl+C when cancelRequested exits with code 130. 🔴 (09:29) src/lib/sentry-urls.ts intentionally separates isSentrySaasUrl(url) from isSaaSTrustOrigin(url). isSentrySaasUrl checks only hostname (sentry.io or *.sentry.io) and accepts any protocol/port for routing/UX uses. isSaaSTrustOrigin also requires HTTPS and the default port for credential/security decisions. Both implementations must stay synchronized on hostname matching; hostname-only checks avoid breaking TLS-terminating proxies using http://sentry.io. 🔴 (09:29) In src/commands/issue/list.ts, local sort constraints are SortValue (line 141, @internal) and VALID_SORT_VALUES (line 143). API type IssueSort in src/lib/api/issues.ts lines 40–42 derives from NonNullable<NonNullable<ListAnOrganizationSissuesData['query']>['sort']> and already supports 'date' | 'freq' | 'inbox' | 'new' | 'recommended' | 'trends' | 'user'. 🔴 (09:29) Adding an issue sort value requires: 1. update SortValue and VALID_SORT_VALUES; 2. add a getComparator() switch case (default falls back to date); 3. update the flag brief; 4. change default if needed. appendIssueFlags() omits --sort only when flags.sort !== 'date', so that guard must change if the default changes. 🔴 (09:29) PrepareDifsOptions.maxZipTotalSize defaults to DEFAULT_MAX_ZIP_TOTAL_SIZE = 2GiB; it is a cumulative uncompressed extraction budget per .zip plus a container size cap for peak-memory safety. It differs from per-entry server policy maxFileSize. Commands need not pass it because prepareDifs applies the default. 0 disables the budget. It passes through prepareZipDifs → readZipDifEntries as maxTotalSize. 🔴 (09:29) The preprod/build API has no list endpoint. api-schema.json contains only 4 relevant paths: organizations/{org}/preprodartifacts/{artifact_id}/install-details/, organizations/{org}/preprodartifacts/{artifact_id}/size-analysis/, projects/{org}/{project}/preprod/size-analysis/status-check-rules/, and projects/{org}/{project}/preprodartifacts/build-distribution/latest/. @sentry/api also exposes no list operation, so build list requires a new server endpoint. 🔴 (09:29) rawApiRequest() preserves Response.statusText; API output treats every status outside 200–299 as failure, including 304. Empty/whitespace textual errors fall back to HTTP <status> <statusText> — <method> /api/0/<endpoint>. JSON errors preserve {status,statusText,body}; binary errors provide only status/content-type/byte-count; binary successes remain raw Uint8Array. 🔴 (09:29) Dashboard sixel rendering chose one complete canvas via renderCompleteDashboardAsSixel rather than individual sixel widgets because sixel DCS advances the terminal cursor and cannot coexist safely with the character framebuffer. The compositor preserves adjacent widgets on their original grid row and rasterizes text/table/error content. If pixel geometry is unavailable, it returns the full established character rendering; partial sixel replacement is forbidden because it serializes or misaligns layout. 🔴 (09:29) createAuthenticatedFetch provides auth headers, a 30-second timeout, at most 2 retries, 401 refresh, and span tracing. buildAttemptFactory clones Request; it must not materialize FormData because that removes the boundary. Endpoints can override timeout, such as /autofix/ at 120 seconds. 🔴 (09:29) Authenticated GET 2xx responses cache under ~/.sentry/cache/responses/ with RFC 7234 behavior and TTL tiers: stable 5 minutes, volatile 60 seconds, immutable 24 hours. If the @sentry/api SDK supplies a Request with undefined init, headers must fall back to input.headers to avoid stripping Content-Type and causing HTTP 415. Guard Array.isArray(data) before .map() because the SDK may return {} for 204/empty. 🔴 (09:29) Fetch-mocking tests must run useTestConfigDir(), setAuthToken(), resetCacheState(), disableResponseCache(), and resetAuthenticatedFetch() in beforeEach; the GET cache is checked before fetch, so prior cache hits can cause 0 mock calls. 🔴 (09:29) Target resolution priority is: 1. CLI flags, 2. SENTRY_ORG/SENTRY_PROJECT, 3. SQLite defaults, 4. DSN autodetection, 5. directory-name inference. SENTRY_PROJECT may be org/project, in which case SENTRY_ORG is ignored. Schema v13 merged defaults into metadata keys defaults.org, defaults.project, defaults.telemetry, and defaults.url; non-trivial caches should use dedicated SQLite tables and migrations rather than metadata KV. 🔴 (09:29) Hidden global --org/--project flags are injected by mergeGlobalFlags() in command.ts; applyOrgProjectFlags() writes SENTRY_ORG/SENTRY_PROJECT before the auth guard. No short -p alias because of conflicts. SDK types should be wrapped in src/lib/api/*.ts with as unknown as SentryX and not leak into commands; unwrapResult/unwrapPaginatedResult remain CLI-owned. apiRequestToRegion auto-sets JSON Content-Type; rawApiRequest preserves strings. 🔴 (09:29) Agent-skill source is plugins/sentry-cli/skills/sentry-cli/SKILL.md (602 lines) plus 28 per-command files under references/. installAgentSkills() in src/lib/agent-skills.ts installs only to ~/.agents/skills/sentry-cli/ and ~/.claude/skills/sentry-cli/; OpenCode is never an installation target. 🔴 (09:29) OpenCode detection via OPENCODE_CLIENT in src/lib/detect-agent.ts is telemetry-only. .opencode/ and opencode.json* are gitignored at lines 72–74. Cursor links at .cursor/skills/sentry-cli/ point into plugins/, but OpenCode scans ~/.claude/skills/**/SKILL.md and ~/.agents/**/SKILL.md, not .cursor/. 🔴 (09:29) installAgentSkills() does not create top-level agent roots because their existence is the detection signal. Skills update on every version bump. Writes are atomic: .<name>.<pid>.<rand>.tmp in the same directory followed by rename(). 🔴 (09:29) SQLite uses a dual-driver architecture: built-in node:sqlite on Node 22.15+ and node-sqlite3-wasm fallback on Node 18.0–22.14. A single-driver approach was rejected because node:sqlite is unavailable before Node 22.15. The standalone SEA binary must not contain the WASM driver. 🔴 (09:29) User directive: the WASM SQLite driver always uses spread for bind parameters, never passes undefined (defensively maps it to null), and uses a manual transaction wrapper. sqlite.ts needs an adapter because node-sqlite3-wasm and node:sqlite differ on array versus spread parameter passing. 🔴 (09:29) src/lib/init/stdin-reopen.ts exports forwardFreshTtyToStdin(deps?) returning an always-non-null Disposable/TtyForwardingHandle, allowing using tty = forwardFreshTtyToStdin() without a null check. Repeated calls return NOOP_HANDLE, so secondary callers cannot tear down the primary installation. 🔴 (09:29) Fresh-TTY setup captures previousIsTty; if undefined, it uses Object.defineProperty to define isTTY: true, writable: true, configurable: true, because Ink/clack gates setRawMode(true) on input.isTTY. pause and resume are replaced with no-ops to avoid Bun kqueue EINVAL on fd-0 transitions. TtyDeps injects openTty and isTty for testing. 🔴 (09:29) Dav1dde’s symbolic WASM PR #992 uses SelfCell<ByteView<'static>, di::Archive<'static>>, not re-parsing. derived_from_cell! uses std::mem::transmute plus SelfCell::from_raw to clone the owner, letting objects() return owned Object cells sharing one ByteView. PR #991’s Rc<Vec<u8>> plus re-parse design was closed in favor of this. 🔴 (09:29) Symbolic Object getters are debugId, codeId, arch, fileFormat, kind, hasSymbols, hasDebugInfo, hasUnwindInfo, and hasSources. Archive methods are new(data), peek(data)->Option<String>, fileFormat, objectCount, and objects()->Result<Vec<ObjectFile>>. Rust struct Object must export as JavaScript ObjectFile through #[wasm_bindgen(js_name = "ObjectFile")]. 🔴 (09:29) il2cppLineMapping(object, provider) is a free WASM function rather than an ObjectFile method, per Sebastian Zivota. provider receives a path and must return Uint8Array or null/undefined. provider_bytes() in utils.rs validates with dyn_ref::<js_sys::Uint8Array>(); js_sys::Uint8Array::new was rejected because it silently zero-fills numbers or empty-fills plain objects. Empty mapping returns JavaScript undefined. Object::as_debuginfo() is pub(crate) for sibling-module access without re-exposing it through WASM. 🔴 (09:29) Symbolic PR history: #988 (feat/source-bundle-provider) merged write_object_with_source_provider plus write_object_with_filter delegation; #989 (fix/symbolic-followups) merged workspace deps, cfg-zstd, and required wasm-opt conventions in @sentry/symbolic@13.3.1; #990 merged C zstd on WASM and removal of ruzstd; #991 (feat/wasm-api-classes) closed in favor of #992; #992 was open with Dav1dde’s self-cell API, +392/-101 over 11 files. 🔴 (09:29) Branch prototype/wasm-artifact-smoke, based on PR #992 head fd94b6fe, added an artifact smoke test and ObjectFile rename fix across 5 files (+122/-6). SourceBundleWriter was planned by end of day June 23, 2026. BYK planned to migrate debug-files check after republishing. (meaning Jun 23, 2026) 🔴 (09:29) Banner-art decision: source sentry-ref.webp is 2048×805 pixels and encodes the SENTRY wordmark using monospace digit cells (1 on, 0 off). Chosen method detects cell width by autocorrelation at about 17.5px and directly reads a 97×13 grid. Rejected methods: area-averaging downsampling because it filled E arms and the R counter; striped ▀ half-blocks because 50/50 duty cycle dissolved E arms; solid █ because it lost scanline texture. Post-processing removes isolated orthogonal-neighbor-free cells and small connected components near the Y’s right arm. 🔴 (09:29) User prefers Cloudflare over Vercel for scalable website deployment. 🔴 (09:29) User chose a version bump over a force flag. 🔴 (09:29) bundle-sources was chosen before print-sources because SourceBundleWriter.writeObject() in @sentry/symbolic@13.4.0 matches a disk-backed callback provider. print-sources remains deferred pending a future ObjectFile.sourceFiles() enumeration API. Symbolic PRs #988–#993 merged, @sentry/symbolic@13.4.0 was published, and CLI PR #1124 merged. 🔴 (09:29) User decided to use job ID instead. 🔴 (09:29) User chose to merge CLI and MCP repositories into a new repository named toolkit. 🔴 (09:29) User migrated from Bun to Node. 🔴 (09:29) User migrated to pnpm + Node + Vitest. 🔴 (09:29) Node SEA size flags considered: --with-intl=small-icu saves about 26–28 MiB and is safe because the CLI uses hardcoded en-US/sv-SE; --with-intl=none saves about 28–30 MiB but was rejected because it breaks Intl.NumberFormat and String.normalize(); --without-inspector saves about 2–4 MiB; --without-amaro about 0.5 MiB; --v8-disable-maglev about 1–2 MiB; --enable-lto about 3–5 MiB. 🔴 (09:29) Node SEA flags forbidden: --without-ssl breaks HTTPS, --without-lief breaks SEA, --without-sqlite breaks node:sqlite use, --disable-single-executable-application breaks everything, and --v8-lite-mode is about 10× slower. A custom build was deferred indefinitely because it requires 5 native CI runners and about 3.5 hours cold versus 5 minutes for fossilize; Linux-to-Darwin cross-compilation is not officially supported. 🔴 (09:29) User chose the 56×8 quadrant block-art wordmark and deferred sixel for a future follow-up rather than rejecting it permanently. 🔴 (09:29) User switched the project from Python to TypeScript and no longer uses Python. 🔴 (09:29) Symbolic WASM scope decision with Dav1dde: it may live in the symbolic repository only as a general-purpose API base analogous to the Python package; CLI-specific orchestration such as collect_il2cpp and CLI-semantic source-bundle writing belongs in getsentry/cli to avoid library/CLI coupling. 🔴 (09:29) Earlier symbolic PR C design used Archive owning Rc<Vec<u8>>, cached metadata, and Object fields cached at construction with on-demand session re-read for source_files()/create_source_bundle(). Callback APIs use js_sys::Function with getSource(path) → Uint8Array | null. Free functions list_source_files and create_source_bundle were removed; parse_debug_file and peek_format remained for backward compatibility. 🔴 (09:29) --fields must filter API response.body while preserving the envelope {status,statusText,body}. Filtering the envelope itself breaks expected body and array-element selection. Nested dot notation and arrays must work without source mutation while preserving literal keys that contain dots. 🔴 (09:29) For @stricli/core, -H is intentionally retained for curl-style --header/--host. The in-repository patch removes -H from the reserved alias list. Lore references target 1.2.7, pinning exactly rather than ^1.2.8, and commit 78c9b04a5; command files must not remove -H. Cursor Bugbot and Seer treat such removal as blocking. 🔴 (09:29) API telemetry and output must share the exported HTTP-success predicate because success is exactly 200–299. Using only status >= 400 loses api_error attributes for 199 and 3xx. Boundary regression tests must cover 199, 200, 299, and 300. 🔴 (09:29) Verbose API logs must include both numeric status and statusText, for example HTTP 404 Not Found, because empty-body errors depend on status text for useful routing context; regression coverage is required. 🔴 (09:29) BatchProvider.submit() currently returning null for non-401/403 errors causes unsupported /v1/messages/batches providers such as MiniMax to retry a wasted 404 request every 30 seconds. Fix design: return "not-found" on 404 from both Anthropic and OpenAI submitters; in submitBatch(), disable the provider via disabledBatchProviders: Set<string> keyed by provider name, persist with setKV() in kv_meta, restore at startup, and bypass quickly in both flush() and prompt(). Provider-level disable is chosen because URL is fixed at construction and there is one provider per process. 🔴 (09:29) Biome enforces noParameterProperties; TypeScript class constructors must not use parameter properties such as constructor(private readonly handle: FileHandle). Classes under src/lib/**/*.ts must declare fields explicitly and assign them in the constructor. This produced 4 Biome errors in bspatch.ts lines 281, 310, 311, and 312 during FileOldReader/MemoryOldReader work. 🔴 (09:29) biome check --stdin-file-path=<file> may falsely exit 1 with “contents aren't fixed” despite --write producing no diff. Authoritative checks must invoke Biome directly on the file path: biome check <file>. 🔴 (09:29) .github/workflows/ci.yml build-binary does use actions/setup-node@v6 at lines 261–263; PR #1145 changed node-version: "22" to ${{ env.NODE_VERSION_22 }}. Job names must not be used to infer runtime setup; grep ci.yml for setup-node. 🔴 (09:29) bundle-sources.ts:145 directly sets this.process.exitCode = 1 for no sources, relying on cli.ts:622-649 not resetting it. Correct robust behavior would use OutputError code 60, though the direct assignment was retained for check.ts consistency with a comment. 🔴 (09:29) Progress rendering in packages/cli/src/lib/progress.ts is cosmetic-only and must never abort work. Both onProgress and done() stay wrapped in try/catch; mutation tests show removing the catch makes the never-throws test fail. 🔴 (09:29) check.ts hasId() tests o.codeId !== null, while @sentry/symbolic@13.4.0 ObjectFile.codeId is string | undefined. parseDebugFile must normalize with obj.codeId ?? null so existing !== null logic remains valid; mapping to undefined would let undefined pass the guard. 🔴 (09:29) CI Node versions must be exact patch pins, not floating majors, because GitHub Actions may cache vulnerable patch versions. Required pattern: workflow-level NODE_VERSION_22: "22.23.1" and NODE_VERSION_24: "24.18.0" with rationale, referenced as ${{ env.NODE_VERSION_22 }}; matrices use ${{ matrix.node == '24' && env.NODE_VERSION_24 || env.NODE_VERSION_22 }}. Example security reason: CVE-2026-48931. 🔴 (09:29) .github/workflows/ci.yml:539-568 set-prev-release-tag has a separate stable-release bug: it selects the newest non-prerelease/non-draft among 5 releases chronologically, which can choose 0.40.1 after 0.41.0 and produce the wrong predecessor for release/0.41. The fix must derive the previous series from the branch (release/0.41 → 0.40), unlike PR #1329’s nightly same-series fix. This was explicitly out of scope for PR #1329. 🔴 (09:29) Dashboard --sixel must be invocation-scoped via environment registry/context rather than writing process.env.SENTRY_DASHBOARD_SIXEL = "1". SDK invocations replace getEnv() with isolated environments, so direct process writes do not enable their render and can leak into later same-process CLI commands; CLI mode must not call setEnv(). 🔴 (09:29) Dependabot may auto-close an intervened PR and open a duplicate, as with getsentry/cli #1322 → #1325. The original must remain canonical: reopen it and close the duplicate so review history and squash merge remain on the intended PR. 🔴 (09:29) User treats a PR as squash-mergeable when mergeStateStatus is UNSTABLE, mergeable=MERGEABLE, and only non-gate checks such as Socket Security, dependency review, nightly publish, skill evaluation, or delta patches are failing/pending. Transient org-managed dependency-review failures should not block merging after verifying they are non-gate. 🔴 (09:29) Hand-written prose in DEVELOPMENT.md is not covered by any staleness check. 🔴 (09:29) The docs-regen workflow can force-advance getsentry/cli PR branches after pushes with a chore: regenerate docs commit from github-actions[bot]. In PR #1254, pushed head 30ad8b075 became 605e8318d, modifying 33 skill-document .md files plus packages/cli/script/bundle.ts. After rebase/force-push, re-fetch and fast-forward to the bot-advanced remote head, then rerun checks; do not revert the generated bot commit. 🔴 (09:29) In event/view.ts, parse project/<hex-event-id> with parseSingleArg plus HEX_ID_RE before parseSlashSeparatedArg(). The generic parser misclassifies any one-slash argument as incomplete org/project and throws ContextError; the specific parser must precede the generic one. 🔴 (09:29) fossilize@0.10.1 can break pnpm run build:all by generating a comma-joined multi-platform Node URL such as https://nodejs.org/dist/v24.18.1/node-v24.18.1-darwin-arm64,darwin-x64,linux-arm64,linux-x64,win-x64.tar.xz, which returns 404. This is not a rebase regression and is not CI-relevant because CI builds only linux-x64. Local rebase verification should use the CI-matching single-platform build; observed result was Build complete: 1 succeeded, 0 failed. 🔴 (09:29) The Frontify portal https://brand.getsentry.com/share/wLssCFiQ5ZzmQmKCWym4 is an authenticated JavaScript SPA, not a programmatically extractable static asset source. /api/share/… and /api/shares/… probes return 404 or HTML; media.ffycdn.net URLs in the shell are portal chrome, not brand files. Downloads require https://brand.getsentry.com/api/screen/download/<signed-token> with an authenticated/user-provided token, so users must supply direct asset URLs or download tokens. 🔴 (09:29) getCurlInstallPaths() in src/lib/upgrade.ts must validate the directory of a SQLite-stored install path using existsSync(dirname(stored.path)), since macOS may clear /tmp or users may delete install directories. On failure it falls back to a process.execPath starts-with check against KNOWN_CURL_DIRS = ['.local/bin','bin','.sentry/bin'], then defaults to ~/.sentry/bin. Do not prefer execPath over a valid stored path because that breaks npm-to-nightly migration. 🔴 (09:29) After git rm docs/pnpm-lock.yaml, git commit docs/pnpm-lock.yaml fails because the deleted path no longer matches. Use no-argument git commit to commit all staged additions and deletions.