Distillation

Date: Sep 10, 2026

• 🔴 (03:04) User-provided upgrade source states path normalization strips a trailing path separator but never strips it from a bare root such as /.
• 🔴 (03:04) User-provided upgrade source passes the successful source-probe response to the caller so the caller never repeats the successful probe request.
• 🔴 (03:04) User-provided upgrade source defines legacy installation subdirectories relative to the user’s home directory that predate XDG installation paths.
• 🔴 (03:04) User-provided upgrade source throws UpgradeError with detail "No CLI upgrade source was found: every source returned HTTP 404" when every candidate source responds with HTTP 404.
• 🔴 (03:04) User-provided upgrade source maps TLS/network failures to new UpgradeError("network_error", buildTlsErrorDetail(error)).
• 🔴 (03:04) User-provided platform detection only performs Linux-specific libc detection when process.platform === "linux" and invokes spawnSync("ldd", ["--version"], ...).
• 🔴 (03:04) User-provided platform binary naming returns sentry-${os}-${arch}${libcSuffix}${suffix}.
• 🔴 (03:04) User-provided install-path derivation creates a sibling lock path as ${installPath}.lock; install-directory resolution can return xdgBinHome.
• 🔴 (03:04) User-provided replacement logic is intentionally synchronous because installation uses a multi-step rename sequence with platform-specific behavior, including a Windows .old rename and Unix atomic replacement.
• 🔴 (03:04) User-provided installation locking uses acquireLock(lockPath); a lock belonging to a dead process is treated as stale, removed, and retried.
• 🔴 (03:04) User-provided replacement code attempts realpath and, on failure, logs logger.debug("realpath failed, falling back to resolve()", error) before falling back to resolve(); it copies the source binary using await copyFile(sourcePath, tempPath).
• 🔴 (03:04) User-provided source includes the exact lint suppression comment // biome-ignore lint/plugin: grandfathered silent catch — see #1531; drain by adding log.debug()/log.warn() or re-throwing.
• 🔴 (03:04) User-provided delta-upgrade source imports CLI_VERSION from ./constants.js, uses binpatch, and forms patch-chain identifiers as patch-chain:${fromVersion}-${toVersion}.
• 🔴 (03:04) User-provided delta-upgrade resolution uses getPlatformBinaryName(), validates release objects by checking "tag_name" in value, and supplies customFetch as the fetch implementation.
• 🔴 (03:04) User-provided patch metadata discovery calls client.listTags(opts.token, PATCH_TAG_PREFIX, opts.signal) and requires both a manifest and tag; one represented failure reason is "version-mismatch".
• 🔴 (03:04) User-provided delta chain computes totalSize exactly as patches.reduce((sum, patch) => sum + patch.size, 0).
• 🔴 (03:04) User-provided delta application emits telemetry operation "upgrade.delta.apply" and records chain length with span.setAttribute("delta.chain_length", result.chainLength).
• 🔴 (03:04) User-provided delta progress handling starts a fresh progress bar for the apply phase because that phase totals bytes across its work.