Dashboard › cli › Distillation
573a13dc-2f75-43c7-86c8-86c1c2fc033e["lore_tm_v1_sWN9rv07Yv2VxutR7UP0Uw6rzs2qeSJwFyYa2MwHJzs"]
sentry api, rawApiRequest() status text must be preserved; empty textual non-2xx bodies must fall back to HTTP status/request details; JSON mode must expose {status, statusText, body}; successful binary Uint8Array responses must bypass formatters and remain raw; binary errors must emit only status/content-type/byte-count summaries, never bytes or JSON coercion; prompts must not block scripted runs or interleave with stdout JSON.@sentry/symbolic@13.4.0 exports Archive, FileEntry, ObjectFile, SourceBundleWriter, and SourceFileDescriptor; SourceBundleWriter.writeObject(object: ObjectFile, object_name: string, filter: Function, provider: Function): Uint8Array | undefined enables bundle-sources, while print-sources is blocked because ObjectFile lacks sourceFiles() enumeration. Dav1dde confirmed this API limitation. (meaning Jun 23, 2026)strip --strip-unneeded reduces the runtime to 99 MiB, and strip+SEA+binpunch yields approximately 108 MiB raw/30 MiB gzip versus 125 MiB raw/34 MiB gzip unstripped.--with-intl=small-icu saves approximately 26–28 MiB and is the biggest viable custom-build win; UPX reaches 25 MiB but was rejected because it destroys ELF notes; --without-lief was rejected because it breaks SEA; --without-sqlite was rejected because it breaks the CLI; --disable-single-executable-application was rejected because it breaks everything. A custom Node build was deferred for poor cost/benefit: approximately 3.5 hours versus 5 minutes for fossilize.--version approximately 1.0 seconds versus Bun 1.9 seconds; completions approximately 150 ms versus Bun 180 ms.TRDIFF10 binpatch wire format uses 8-byte magic TRDIFF10\x00, followed by sign-magnitude little-endian int64 controlLen, diffLen, and newSize; 24-byte control tuples hold readDiffBy, readExtraBy, and seekBy; control, diff, and extra blocks are zstd-compressed.<repo>:nightly for the mutable pointer, <repo>:nightly-<version> for immutable nightly tags, and <repo>:patch-<version> for patches. Annotations are from-version=<prev>, sha256-<binaryName>=<hex>, and org.opencontainers.image.title; artifact type is application/vnd.<prefix>.patch.MAX_OUTPUT_SIZE=2_147_483_648, MAX_NIGHTLY_CHAIN_DEPTH=30, MAX_STABLE_CHAIN_DEPTH=10, and SIZE_THRESHOLD_RATIO=0.6; patch trust uses the SHA-256 of the final output only, with no intermediate-hop hashing for performance.bspatch.ts core patching was refactored into transformPatch(oldFile, patchData, onChunk) with 3 public APIs: applyPatchToFile(oldPath, patchData, destPath)→SHA-256, applyPatchToMemory(oldFile, patchData)→Uint8Array, and applyPatchChainInMemory(oldPath, patches[], destPath)→SHA-256; applyPatch() remains a thin compatibility wrapper.applyPatch() ALWAYS computes SHA-256 inline and returns it—there is no separate verification step.bspatch.ts fully decompresses the TRDIFF10 control block with zstdDecompressSync for random access, while diff and extra blocks stream through createZstdStreamReader via Node Transform → Web ReadableStream → BufferedStreamReader.loadOldBinary() creates a temporary copy with COPYFILE_FICLONE, falling back to an ordinary copy, then reads it into memory; cleanupPatchResources() runs every cleanup step despite prior failures; writer errors are captured through writer.on('error') to prevent unhandled ENOSPC/EIO.applyPatchToMemory() preallocates a Uint8Array of newSize; a corrupt patch claiming an excessively large size raises RangeError, which triggers full-download fallback.script/check-fragments.ts performs Checks 1–4 against actual route names and Check 5 for subcommand coverage. For routes with more than 1 command, each subcommand must appear in a heading outside fenced code or in a sentry <route> <subcommand> reference; a bare sentry <route> covers the route-map defaultCommand. Warnings are default, while --strict makes them errors; invocation is pnpm run check:fragments.script/check-stale-references.ts derives the active package manager from packageManager in package.json and dynamically detects stale package-manager commands/prose. It excludes global user-install examples, itself, and node_modules/; it is included in the CI lint job, and must exclude itself to avoid its own JSDoc examples causing false positives.#1329 fixed .github/workflows/ci.yml generate-patches selecting a cross-series nightly predecessor. Root cause: sort -V placed 0.41 nightlies after all 0.40 nightlies, allowing a 0.40 build to select 0.41.x-dev.Y.#1329 computes MAJOR_MINOR=$(echo "${VERSION}" | cut -d. -f1,2), filters with SAME_SERIES_TAGS=$(printf '%s\n' "$TAGS" | grep "^nightly-${MAJOR_MINOR}\\." || true), and walks only SAME_SERIES_TAGS; end-to-end verification upgraded 0.40.0-dev.1785526951→0.40.0-dev.1785546241 using 2 patches totaling 249.9 KB KB KB KB versus approximately 31 MB for a full download.src/commands/issue/list.ts, LIFETIME_FIELDS = new Set(['count','userCount','firstSeen','lastSeen']); buildListApiOptions(json, fields) enables collapseLifetime only when json && fields !== undefined && fields.length > 0 && !fields.some(f => LIFETIME_FIELDS.has(f)). Human output never collapses lifetime.buildIssueListCollapse() always starts with ['filtered','unhandled'], then conditionally adds 'lifetime' and 'stats'.IssueViewOutputSchema in src/types/sentry.ts extends SentryIssueSchema with event, org, replayIds, and trace, populated by jsonTransformIssueView; issue view always retains count, userCount, firstSeen, and lastSeen, while issue list may omit them under collapse=lifetime.FancyReporter to stderr plus Sentry createConsolaReporter structured logs. SENTRY_LOG_LEVEL controls level; buildCommand injects hidden --log-level and --verbose; withTag() creates independent instances; setLogLevel() propagates through a registry; user-facing output must use Consola rather than raw stderr.SENTRY_CLI_NO_TELEMETRY=1; 2. DO_NOT_TRACK=1; 3. metadata.defaults.telemetry; 4. enabled by default. Shell completions set SENTRY_CLI_NO_TELEMETRY=1 in bin.ts before imports.ENV_VAR_REGISTRY in src/lib/env-registry.ts is the single source of truth for honored environment variables; topLevel: true plus briefDescription exposes a variable in --help, while install-script-only variables use installOnly: true.src/lib/custom-ca.ts prioritizes the SQLite sentry cli defaults ca-cert setting over NODE_EXTRA_CA_CERTS, caches per process with hasResolved, and appends custom PEM to rootCertificates. tryReadPem() never throws; a missing file warns and returns undefined.TLS_ERROR_PATTERNS includes local issuer, verify first cert, UNABLE_TO_VERIFY_LEAF_SIGNATURE, DEPTH_ZERO_SELF_SIGNED_CERT, and SELF_SIGNED_CERT_IN_CHAIN, while explicitly excluding CERT_HAS_EXPIRED and ERR_TLS_CERT_ALTNAME_INVALID; getTlsCertErrorMessage() traverses error.cause with cycle detection.script/generate-docs-sections.ts injects generated content into committed Markdown/MDX files between named markers and supports --check, which dry-runs and exits 1 for stale output. It owns 13 sections across contributing.md, DEVELOPMENT.md, self-hosted.md, README.md, and getting-started.mdx.generateProjectStructure() invariant: route-directory groups always use the ├── prefix because standalone entries always follow groups. Groups and standalones are each alphabetically sorted; help.ts is inserted before sorting; only the last standalone uses └──.generate:docs runs exactly 4 scripts in order: 1. generate:parser → script/generate-parser.ts; 2. generate:command-docs → script/generate-command-docs.ts; 3. generate:skill → script/generate-skill.ts; 4. generate:docs-sections → script/generate-docs-sections.ts.generate:docs is a prerequisite for dev, build, build:all, bundle, typecheck, test:unit, test:changed, and test:e2e; docs/src/content/docs/commands/ and docs/src/content/docs/configuration.md are fully generated and gitignored, while docs/src/fragments/ is committed handwritten source.getsentry/cli: /repos/getsentry/cli/security-advisories was empty, while /repos/getsentry/cli/dependabot/alerts had exactly 13 open and 15 fixed alerts; pnpm.overrides in package.json is the canonical fix for transitive vulnerabilities. (meaning Aug 1, 2026)getsentry/symbolic WASM uses C zstd through zstd-sys and its wasm-shim/ for wasm32-unknown-unknown; CI’s wasm-build job installs clang lld llvm. ruzstd was dropped because it was significantly slower.InkUI.tearDown() must execute 6 try/catch-wrapped steps in order: 1. stop tip rotation; 2. remove the SIGINT listener and call store.setRequestCancel(undefined); 3. instance.clear(); 4. instance.unmount(); 5. restore the alternate screen with \x1b[?1049l; 6. call freshStdin.setRawMode(false), .pause(), and .destroy(). The torndown guard prevents double unmount; a second Ctrl+C calls process.exit(130).src/lib/sentry-urls.ts intentionally separates isSentrySaasUrl(url)—hostname-only, used for routing/UX—from isSaaSTrustOrigin(url)—requires HTTPS and default port, used for credential/security trust. Both must stay synchronized on hostname matching.PrepareDifsOptions.maxZipTotalSize defaults through DEFAULT_MAX_ZIP_TOTAL_SIZE to 2 GiB and limits cumulative uncompressed extraction plus container size; it is separate from per-entry server policy maxFileSize, and 0 disables the budget.organizations/{org}/preprodartifacts/{artifact_id}/install-details/, organizations/{org}/preprodartifacts/{artifact_id}/size-analysis/, projects/{org}/{project}/preprod/size-analysis/status-check-rules/, and projects/{org}/{project}/preprodartifacts/build-distribution/latest/; build list requires a new server endpoint.createAuthenticatedFetch with auth headers, a 30-second timeout, at most 2 retries, 401 refresh, and span tracing. buildAttemptFactory clones Request and must not materialize FormData, because doing so strips its boundary.~/.sentry/cache/responses/ for GET 2xx responses only, with TTL tiers: stable 5 minutes, volatile 60 seconds, immutable 24 hours.@sentry/api may pass a Request with no init; authenticated fetch must fall back to input.headers when init is undefined or it strips Content-Type and causes HTTP 415. Callers must guard Array.isArray(data) before .map() because the SDK returns {} for 204/empty responses.useTestConfigDir(), setAuthToken(), resetCacheState(), disableResponseCache(), and resetAuthenticatedFetch() in beforeEach; response cache lookup occurs before fetch, so stale cache can otherwise cause 0 mock calls.SENTRY_ORG/SENTRY_PROJECT; 3. SQLite defaults; 4. DSN auto-detection; 5. directory-name inference. SENTRY_PROJECT may contain org/project, in which case SENTRY_ORG is ignored.~/.agents/skills/sentry-cli/ and ~/.claude/skills/sentry-cli/; OpenCode is detected through OPENCODE_CLIENT for telemetry but is never an installation target. installAgentSkills() does not create top-level agent roots and uses same-directory atomic temp-file rename.node:sqlite on Node 22.15+ and node-sqlite3-wasm on Node 18.0–22.14, chosen to retain Node 18+ support.undefined and defensively maps it to null, and uses a manual transaction wrapper. The standalone SEA binary must not include the WASM driver.forwardFreshTtyToStdin(deps?) in src/lib/init/stdin-reopen.ts always returns a Disposable/TtyForwardingHandle; repeated calls return NOOP_HANDLE. When isTTY is initially undefined, it is backfilled with Object.defineProperty as true, writable, and configurable; pause and resume are replaced by no-ops to avoid Bun kqueue EINVAL.SelfCell<ByteView<'static>, di::Archive<'static>> from PR #992; PR #991’s Rc<Vec<u8>> plus reparse approach was closed in favor of it. Rust struct Object is exported as ObjectFile through #[wasm_bindgen(js_name = "ObjectFile")].il2cppLineMapping(object, provider) is a free WASM function, not an ObjectFile method. Its provider must return Uint8Array or nullish; provider_bytes() validates using dyn_ref::<js_sys::Uint8Array>() because js_sys::Uint8Array::new could silently coerce invalid values.▀ because 50/50 duty cycle dissolved E arms; solid █ because it removed scanline texture.bundle-sources first and deferred print-sources until a future @sentry/symbolic release adds source enumeration; symbolic PRs #988–#993 are merged, @sentry/symbolic@13.4.0 is published, and CLI PR #1124 is merged.toolkit.pnpm + Node + Vitest toolchain.collect_il2cpp and CLI-specific source-bundle semantics belongs in getsentry/cli, not getsentry/symbolic.--fields on API output must filter response.body while preserving {status,statusText,body}; filtering must support nested dot notation and array elements without mutation, while retaining literal keys that contain dots.@stricli/core patch targets exactly version 1.2.7, removes -H from the reserved alias list, and preserves curl-style -H aliases for --header/--host; the dependency must be pinned to 1.2.7, not ^1.2.8. Patch commit: 78c9b04a5.statusText, for example HTTP 404 Not Found, with regression coverage.noParameterProperties; new classes under src/lib/**/*.ts must declare fields explicitly and assign them in the constructor body.--stdin-file-path, because stdin mode can falsely report “contents aren't fixed” despite --write producing no changes..github/workflows/ci.yml, specifically NODE_VERSION_22: "22.23.1" and NODE_VERSION_24: "24.18.0"; floating 22.x is unsafe because GitHub Actions caching can retain a vulnerable patch..github/workflows/ci.yml set-prev-release-tag has a separate unresolved bug: it selects the newest stable release chronologically rather than deriving the previous series from a branch such as release/0.41 → 0.40. This was intentionally out of scope for PR #1329.--sixel opt-in must be invocation-scoped through the environment registry/context; it must not write process.env.SENTRY_DASHBOARD_SIXEL or call setEnv() in CLI mode because SDK invocations isolate getEnv() and same-process commands could leak state.mergeStateStatus=UNSTABLE but mergeable=MERGEABLE and only non-gate jobs such as Socket Security, dependency-review, nightly publish, skill eval, or delta patches are failing/pending; transient org-managed dependency-review failures should not block merging.DEVELOPMENT.md handwritten prose is not covered by any staleness check.getsentry/cli PR branch, the docs-regen workflow may add a chore: regenerate docs bot commit and force-advance the remote; local state must be re-fetched and fast-forwarded before final checks, and the generated bot commit must not be reverted.event/view.ts, parseSingleArg with HEX_ID_RE must recognize project/<hex-event-id> before parseSlashSeparatedArg; otherwise the generic parser misclassifies the valid special case as incomplete org/project.fossilize 0.10.1 can make pnpm run build:all request a malformed comma-joined multi-platform Node URL and receive 404; this is not a rebase defect and is not CI-relevant because CI builds only linux-x64. Local verification should use the CI-matching single-platform build.https://brand.getsentry.com/api/screen/download/<signed-token>, so the user must provide an authenticated asset URL or download token.getCurlInstallPaths() must guard a stored SQLite install path with existsSync(dirname(stored.path)), then fall back to process.execPath matching KNOWN_CURL_DIRS = ['.local/bin','bin','.sentry/bin'], then ~/.sentry/bin. It must not prefer execPath over a valid stored path because that breaks npm-to-nightly migration.