Distillation

🔴 (00:09) The shell installer’s Toolkit latest-release parser in packages/cli/install#L324-L334 accepts the first matching cli@X.Y.Z tag_name and never inspects GitHub prerelease or draft flags; unlike the TypeScript resolver, it can therefore install a prerelease carrying a stable-looking cli@ tag as the latest stable CLI. Cursor Bugbot classified this as Medium Severity with bug ID ed4075b4-8534-400f-b7a9-385dce20569e.
🔴 (00:09) Cursor Bugbot identified a potential latent correctness issue in packages/cli/src/lib/binary.ts#L259-L265, also affecting packages/cli/src/lib/upgrade.ts:96~128: latest-release resolution filters GitHub releases and selects tags[0], assuming an undocumented newest-first API order; if the returned order differs, it could silently select an older CLI version.
🔴 (00:09) An HTTP 200 Toolkit response containing only MCP metadata is treated as malformed product metadata rather than source absence; falling back would violate the compatibility invariant and could conceal a broken Toolkit publication.
🔴 (00:09) The MCP-only HTTP 200 regression asserts exactly one Toolkit request and never contacts getsentry/cli.
🔴 (00:09) GHCR HTTP 403 remains terminal by design because anonymous bearer-token authorization or service policy failure does not prove a tag is absent; fallback/not-found classification is permitted only for a genuine HTTP 404.
🔴 (00:09) Commit 723375b6c corrected stale JSDoc and added a regression proving that GHCR HTTP 403 throws and never contacts the legacy repository.

Distillation

Observations