Distillation

Date: Sep 10, 2026

• 🔴 [requested-review] (03:17) User requested a READ-ONLY security/supply-chain merge-gate review of getsentry/cli PR #1569 in repository /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade, at exact base ec83887a16f780f32fba4b7d710bad262dba3a22 and head e565b1afb39a341605adc883de8812851de7d581.
• 🔴 (03:17) User directed that repository review must inspect immutable Git objects only via git show HEAD:<path>, git diff base..head, and Git metadata; never inspect working-tree file contents and never fail due to worktree drift.
• 🔴 (03:17) User required inspection of all changed files and tests without modifying anything.
• 🔴 (03:17) User required review focus on stable SemVer prerelease exclusion; exact pinned-response validation with fail-closed behavior; pinned versions bypassing latest; pinned nightly standalone routing; exact nightly annotations; 404-only behavior; source affinity; pagination; changelog provenance; GHCR abort, scope, redirect, and SHA handling; delta behavior; cache behavior; offline behavior; and unchanged installer behavior.
• 🔴 (03:17) User stated the nightly repository probe and source-neutral verified cache are intentional.
• 🔴 (03:17) User required a non-empty, findings-first verdict using PASS, CONCERN, MUST-FIX, or BLOCKED, with exact head file:line evidence, deterministic regressions, and residual gaps.
• 🔴 (03:17) User required the review’s final line to be exactly MERGE or DO-NOT-MERGE; empty output is forbidden.
• 🟡 (03:18) Git metadata confirmed base ec83887a16f780f32fba4b7d710bad262dba3a22, head e565b1afb39a341605adc883de8812851de7d581, and merge base ec83887a16f780f32fba4b7d710bad262dba3a22.
• 🟡 (03:18) PR #1569 changed 16 files with 2,333 insertions and 370 deletions: packages/cli/src/commands/cli/upgrade.ts (152-line diff), packages/cli/src/lib/binary.ts (154), packages/cli/src/lib/delta-upgrade.ts (139), packages/cli/src/lib/ghcr.ts (91), packages/cli/src/lib/release-notes.ts (140), packages/cli/src/lib/upgrade.ts (443), packages/cli/src/lib/version-check.ts (21), packages/cli/test/commands/cli.test.ts (40), packages/cli/test/commands/cli/upgrade.test.ts (189), packages/cli/test/lib/binary.test.ts (130), packages/cli/test/lib/delta-upgrade.mocked.test.ts (14), packages/cli/test/lib/delta-upgrade.test.ts (201), packages/cli/test/lib/ghcr.test.ts (107), packages/cli/test/lib/release-notes.test.ts (185), packages/cli/test/lib/upgrade.test.ts (572), and packages/cli/test/lib/version-check.test.ts (125).
• 🔴 (03:18) User stated large artifacts are always written with pipeline() into createWriteStream() rather than buffering the complete payload in memory, to avoid memory peaks and preserve backpressure for shipped CLI workloads.
• 🔴 (03:18) User stated ValidationError must always be passed a field; omitting field collapses unfielded errors into one fingerprint.
• 🔴 (03:18) User stated ApiError type must be preserved so classifySilenced in src/lib/error-reporting.ts can silence HTTP 401–499 errors; wrapping it in generic CliError loses status and causes errors such as 403 responses to be captured.
• 🔴 (03:18) User stated ApiError should be rethrown as new ApiError(msg, error.status, error.detail, error.endpoint) with a terse message because ApiError.format() appends detail and endpoint; its fingerprint rule keys by api_status + command, and fingerprint-rule changes do not retroactively re-fingerprint, so new groups must be manually merged into canonical old parents.
• 🔴 (03:18) User stated per-object extraction errors are always swallowed and never abort the surrounding upload in src/lib/dif/scan.ts and src/lib/dif/index.ts: errors from extractEmbeddedPpdb, createIl2cppLineMapping, and source-bundle extraction are caught per object, logged at debug level, and swallowed to mirror legacy Rust sentry-cli behavior.
• 🔴 (03:18) User stated PeekResult.format is never 'unknown'; unrecognized formats return null from peekHeader.
• 🔴 (03:18) User stated nested ZIP archives are never recursively scanned regardless of the scanZips setting.
• 🔴 (03:18) User stated the relevant object/artifact is always fetchable from the base repository with GitHub.
• 🔴 (03:18) User stated GitHub Actions Node pins use workflow-level environment variables NODE_VERSION_22: "22.23.1" and NODE_VERSION_24: "24.18.0"; actions/setup-node steps reference ${{ env.NODE_VERSION_22 }} or ${{ env.NODE_VERSION_24 }}, while matrix jobs use ${{ matrix.node == '24' && env.NODE_VERSION_24 || env.NODE_VERSION_22 }} rather than bare "22" or "24" strings.
• 🔴 (03:18) User stated the Node pinning rationale: Node 24.17.0 and 22.23.0 shipped an ERR_STREAM_PREMATURE_CLOSE regression associated with the CVE-2026-48931 http.Agent fix; it was fixed in Node 24.18.0 and 22.23.1 via nodejs/node#64004.
• 🔴 (03:18) User stated npm-package CI builds on the development Node floor of 22.15+, using NODE_VERSION_20: "20.20.2" for the WASM-SQLite floor, NODE_VERSION_22: "22.23.1", and NODE_VERSION_24: "24.18.0"; the build job uses env.NODE_VERSION_22, and smoke tests use the matrix Node value with fallback to the environment variables so the fallback path is exercised in CI.