Dashboard › cli › Distillation
56e3c6a0-49a9-431e-b976-0cfa86eb2f6c["lore_tm_v1_cQ1WlEkJWF4MY4GBLHgYjzNwPL4VWHwE4p4Yay5xCx4","lore_tm_v1_dHCkl7tMoNypizm1Bdyb9S-w_wJ0Qo3YC1vF6-TRgMo","lore_tm_v1_OiHutgbgEd1vqYhvCNrw3pMDQvStl5hHluHjh7UO2ec","lore_tm_v1_eAxEgKT8LQj1c7i3vIFvqmgammFosStOeeubqzE-KDY","lore_tm_v1_GZFfIa9PGhYjffy180XE7KkrDqFmIDUMZnKbRCls6wM","lore_tm_v1_cElSDMTrpVob8dIPpzFQmV_BuEAvYafz9BPAl82XeUw","lore_tm_v1_moa51Z3Lmvox-BhR0-5qlxa_VUewuyqJa772f1U2X9U","lore_tm_v1_dEvq2WWwklEUTwFUu6TPo50HpoSEgpQzD3Ww5aKShw0","lore_tm_v1_tVh8eevWtkffLyrAJazh7crLjzuK0VUU7g5pA2FIznY"]
tryReadPem() in src/lib/custom-ca.ts NEVER throws; a missing CA file logs a warning and returns undefined.src/lib/custom-ca.ts uses priority (1) sentry cli defaults ca-cert from SQLite, then (2) NODE_EXTRA_CA_CERTS; resolution is cached per process using module-level state including hasResolved.resolve() concatenates the custom PEM with Node’s rootCertificates because Bun otherwise replaces the Mozilla CA bundle.injectIntoNodeTls() uses tls.setDefaultCACertificates() on Node 24+ and is a no-op on Node 22.TLS_ERROR_PATTERNS contains exactly 5 patterns: local issuer, verify first cert, UNABLE_TO_VERIFY_LEAF_SIGNATURE, DEPTH_ZERO_SELF_SIGNED_CERT, and SELF_SIGNED_CERT_IN_CHAIN; it deliberately excludes CERT_HAS_EXPIRED and ERR_TLS_CERT_ALTNAME_INVALID.getTlsCertErrorMessage() traverses the error.cause chain with cycle detection.__resetForTests() resets all cached state.createAuthenticatedFetch with auth headers, a 30s timeout, at most 2 retries, 401 refresh, and span tracing.buildAttemptFactory clones Request and must not materialize FormData, because doing so strips its boundary./autofix/.~/.sentry/cache/responses/, caches only successful GET 2xx responses, and uses TTL tiers stable=5min, volatile=60s, immutable=24h.@sentry/api may pass a Request without init; treating undefined init as empty headers strips Content-Type and causes HTTP 415, so code must fall back to input.headers when init is undefined.Array.isArray(data) before .map() because the SDK returns {} for HTTP 204/empty responses.useTestConfigDir(), setAuthToken(), resetCacheState(), disableResponseCache(), and resetAuthenticatedFetch() in beforeEach; the GET response cache is checked before fetch, so prior-test cache hits otherwise produce 0 fetch calls.SENTRY_ORG/SENTRY_PROJECT, 3. SQLite defaults, 4. DSN auto-detection, 5. directory-name inference.SENTRY_PROJECT accepts an org/project combination and, when set that way, SENTRY_ORG is ignored.defaults table into the metadata key-value table using defaults.org, defaults.project, defaults.telemetry, and defaults.url; getters/setters live in src/lib/db/defaults.ts.metadata key-value entries for non-trivial caches.--org/--project flags are injected by mergeGlobalFlags() in command.ts, and applyOrgProjectFlags() writes them to SENTRY_ORG/SENTRY_PROJECT before the auth guard; there are no short aliases because -p conflicts.@sentry/api SDK types must be wrapped in src/lib/api/*.ts using as unknown as SentryX casts and must never leak to commands.unwrapResult and unwrapPaginatedResult must remain CLI-owned; apiRequestToRegion automatically sets JSON Content-Type, while rawApiRequest preserves strings.toolkit.symbolic-wasm may remain in the symbolic repository only when it exposes a full general-purpose API base analogous to the Python package; CLI-specific shortcuts and orchestration such as collect_il2cpp and source-bundle writing with CLI semantics belong in getsentry/cli.feat/wasm-api-classes, uses a class-based API: Archive owns Rc<Vec<u8>> and caches metadata; Object caches fields at construction but reopens the debug session on demand for source_files() and create_source_bundle().js_sys::Function with getSource(path) → Uint8Array | null; free functions list_source_files and create_source_bundle were removed, while parse_debug_file and peek_format remain for backward compatibility.22.x; current required examples are NODE_VERSION_22: "22.23.1" and NODE_VERSION_24: "24.18.0" because a cached floating version may fail to pick up a CVE fix such as CVE-2026-48931.env: block containing both exact Node version constants and a rationale comment, referenced through ${{ env.NODE_VERSION_22 }}; matrix jobs use ${{ matrix.node == '24' && env.NODE_VERSION_24 || env.NODE_VERSION_22 }}.InstanceState.make memoizes skill discovery once per instance at session start and does not hot-reload skill files or SKILL.md changes.opencode debug skill invocation is required to verify the live count, which in the cited case was 7 including sentry-cli, versus 6 in the stale session.object.has_sources() in @sentry/symbolic reports only embedded sources, not referenced files; detection of any source must use debug_session.files().next().is_none().Archive::parse(&data) → archive.objects() → object.debug_session()?.files() → FileEntry.abs_path_str() → debug_session.source_by_path(abs_path) → SourceFileDescriptor, whose relevant methods are contents(), url(), debug_id(), and source_mapping_url(); PE files with embedded PDBs also require pe.embedded_ppdb().idle.ts, not in a centralized evictSession() in pipeline.ts.idle.ts imports evictSession as evictGradientSession from @loreai/core, deleteSessionAuth and clearAuthStale from ./auth, deleteSessionCosts from ./cost-tracker, deleteBillingPrefix from ./cch, and clearWarmupAuthDisabled from ./cache-warmer.startIdleScheduler uses onEvict?: (sessionID: string) => void, whereas the branch uses onEvictSession?: (sessionID: string) => boolean.onEvict in pipeline.ts cleans exactly 5 Maps: headerSessionIndex, ltmSessionCache, ltmPinnedText, stableLtmCache, and cwdWarned; merges should adopt upstream’s per-function approach and add missing cleanup calls.src/lib/dif/scan.ts and src/lib/dif/index.ts are always caught, debug-logged, and swallowed, and must never abort the surrounding scan or upload; this applies to extractEmbeddedPpdb, createIl2cppLineMapping, and source-bundle extraction and mirrors legacy Rust sentry-cli behavior.PeekResult.format is never 'unknown'; peekHeader returns null for unrecognized formats.scanZips setting.malformed_chain, cache hit vs. miss, and in-memory vs. disk—and rejects fuzzy or hybrid classifications..download binary directly to distinguish delta-patch failure from spawn/replace failure, rather than broad refactors.binpatch switchover, replacing a vendored crate with @sentry/symbolic, a custom OpenCode build replacing a downloaded release, and the acquireLock path in sentry cli upgrade.ec83887a16f780f32fba4b7d710bad262dba3a22 and exact head dbee7e9f2a4555e044f74dfebad002cccfa43a1f, after the prior review returned an empty response.PASS, CONCERN, or MUST-FIX, cite exact current file:line evidence, include deterministic regressions for defects, and include residual risks/test gaps when no defects exist.BLOCKED and name the exact tool/error, and required the report to end exactly MERGE or DO-NOT-MERGE; user prohibited performing or proposing mutations.04867eaf9 feat(cli): add toolkit upgrade bridge, 9c874298e fix(cli): address toolkit bridge review, 723375b6c fix(cli): address upgrade review findings, and dbee7e9f2 test(cli): update toolkit upgrade fixtures.04867eaf9 changed 19 files with 1,933 insertions and 326 deletions, including .github/workflows/ci.yml, package.json, packages/cli/install, packages/cli/package.json, upgrade-related libraries and commands, and their tests.9c874298e changed 13 files with 246 insertions and 520 deletions; commit 723375b6c changed 3 files with 49 insertions and 23 deletions; commit dbee7e9f2 changed packages/cli/test/commands/cli.test.ts with 13 insertions and 10 deletions.ec83887a16f780f32fba4b7d710bad262dba3a22 and exact head dbee7e9f2a4555e044f74dfebad002cccfa43a1f; the inspected artifact hash shown was a84a52f92f46526431f9d1572166676d68542683797142d9116d2bee61de48ea.packages/cli/src/lib/delta-upgrade.ts:84-86, patchCacheKey(fromVersion, toVersion) returns exactly patch-chain:${fromVersion}-${toVersion}, with no release-source component.packages/cli/src/lib/delta-upgrade.ts:88-110, instrumentCache(base) uses that source-agnostic key for tracing in both load(currentVersion, targetVersion) and save(chain, steps); load calls base.load(currentVersion, targetVersion) and records cache.hit plus cache.item_size, while save derives the key from the first step’s fromVersion and last step’s toVersion.packages/cli/src/lib/delta-upgrade.ts imports makeCache, PatchCache, source strategies, and patch-chain operations from binpatch; it imports PRIMARY_UPGRADE_SOURCE and UpgradeSource from ./binary.js and customFetch from ./custom-ca.js.getPrimaryUpgradeSource() in packages/cli/src/lib/delta-upgrade.ts:74-79 throws Error("No primary upgrade source is configured") when PRIMARY_UPGRADE_SOURCE is absent.DeltaResult in packages/cli/src/lib/delta-upgrade.ts:66-70 contains sha256: string, patchBytes: number, and chainLength: number.packages/cli/src/lib/binary.ts; UPGRADE_SOURCES is documented at lines 115-116 as ordered and falling through only on HTTP 404, and PRIMARY_UPGRADE_SOURCE at lines 129-130 is UPGRADE_SOURCES[0].getBinaryDownloadUrl() in packages/cli/src/lib/binary.ts:234-239 defaults its source to PRIMARY_UPGRADE_SOURCE, constructs the tag as ${source.tagPrefix}${version}, and returns a GitHub release URL using source.githubRepo and getPlatformBinaryName().packages/cli/src/lib/binary.ts:332-344 probes ordered sources, advances only on HTTP 404, and treats every other HTTP or network response as non-fallback behavior; fetchUpgradeProbe uses options.fetch ?? customFetch.