Dashboard › cli › Distillation
ab8f734b-b41e-41c4-9fa1-c20d3265ddf3["lore_tm_v1_e8hmNLiowtgzVv0LV8MHn53S_vlE7xKIg4k0TrGp1vQ","lore_tm_v1_yEG0he1UT7AKCeyEVDqel3AWfYOgtnpOIzBP8ZVwHXg","lore_tm_v1_xNvbhVh1bdwjnmsPzO48aTO5ug37SUUV5MamfdoED_k","lore_tm_v1_OCcbwg_z1xWyjbKMuD7PLZYDbyVa-NKtrhnj9OgxdL0"]
ec83887a16f780f32fba4b7d710bad262dba3a22 to head 878459c490576dbb7abb76d3a3dc1b5d9fc62c1f, requiring a substantive, non-empty, findings-first report.PASS, CONCERN, MUST-FIX, or BLOCKED, with the final line exactly MERGE or DO-NOT-MERGE.PASS and give exact head file:line evidence for all requested boundaries: fail-closed cache/error typing, stable package version validation, abort/source provenance, target routing, 404 handling, source affinity, pagination, redirects, SHA validation, delta upgrades, cache behavior, offline behavior, and CodeQL, plus residual gaps."never uses the cached target after %s" in packages/cli/test/commands/cli/upgrade.test.ts:431.878459c490576dbb7abb76d3a3dc1b5d9fc62c1f showed target/source routing in packages/cli/src/commands/cli/upgrade.ts: source: resolved.source at lines 219 and 1022; curl-only UpgradeTransportError handling at line 225; getArtifactChannel(target) maps nightly targets to "nightly" and all others to "stable" at lines 273–274; pinned nightly targets force lookupMethod = "curl" at line 335; executeUpgrade(method, target, downloadTag, offline, setMessage, source) at line 695; result/target channel selection at lines 1018 and 1032; and non-curl nightly targets are guarded at line 1072."uses the cached target only after a transport failure" in packages/cli/test/commands/cli/upgrade.test.ts:406 and parameterized "never uses the cached target after %s" at line 431.packages/cli/src/lib/delta-upgrade.ts uses NORMALIZED_RELEASE_SOURCE = Symbol("normalizedReleaseSource") at line 75, a readonly symbol property at line 80, isNormalizedForSource() at lines 88–94, and Object.defineProperty() to attach provenance at line 117; prefetchNightlyPatches routes through nightlySource(source) at line 716 and prefetchStablePatches through stableSource(source) at line 724.packages/cli/src/lib/release-notes.ts: imports isNormalizedForSource at line 26, checks it at line 435, destructures source with changelog inputs at lines 638–639, and normalizes prefetched releases with normalizeChangelogReleases(prefetchedReleases, source) at line 641.packages/cli/src/lib/upgrade.ts: npm registry results pass through validateStableVersion(data.version, "npm registry") at line 572; validateStableVersion() is defined at line 575 and rejects when semverValid(version) === null || semverPrerelease(version) !== null at line 582; requested package versions are validated with validateStableVersion(version, "Requested package version") at line 838.packages/cli/test/lib/upgrade.test.ts reject npm latest values "not-semver", "1.2.3-beta.1", and "1.2.3-rc.1" at lines 493–497; prerelease pinned version "1.2.3-beta.1" is rejected before network access across parameterized methods at lines 727–732. isNightlyVersion("2.0.0-beta.1") is expected to be false at line 1898.packages/cli/src/lib/ghcr.ts:329 rejects a version if semverValid(version) === null || !NIGHTLY_VERSION_REGEX.test(version).packages/cli/src/lib/version-check.ts: prefetchNightlyPatches(latestVersion, signal, source) at line 242 and prefetchStablePatches(latestVersion, signal, source) at line 244. packages/cli/test/lib/version-check.test.ts:538 tests that stable patch prefetch remains on the legacy source selected after a Toolkit 404.packages/cli/src/lib/upgrade.ts uses CANONICAL_RELEASES_PATH_REGEX = /^\/repositories\/\d+\/releases$/ at line 105, tests the canonical repository path at line 158, and requires https: plus hostname api.github.com at lines 163–164. packages/cli/test/lib/upgrade.test.ts:266 rejects pagination outside the selected source.{ version, source: resolved.source } in packages/cli/src/lib/upgrade.ts at lines 514 and 720 and retaining source: resolved.source at line 612.packages/cli/test/lib/binary.test.ts:108 falls back to legacy only on HTTP 404, lines 133 onward reject fallback on other HTTP statuses, and line 151 rejects fallback on network failure; packages/cli/test/lib/upgrade.test.ts:319 falls back to legacy latest only on Toolkit HTTP 404; line 751 falls back to an unprefixed legacy tag on Toolkit HTTP 404; line 834 does not fall back from an explicitly selected source; line 1913 falls back when the Toolkit nightly manifest returns 404; line 1958 does not fall back on non-404 Toolkit nightly failure; and line 1980 does not treat transport-error text containing HTTP 404 as a typed 404.packages/cli/test/lib/upgrade.test.ts:1744, "falls back to raw binary when .gz URL returns 404".packages/cli/test/lib/delta-upgrade.test.ts cover stable resolution on legacy at line 1001, nightly resolution on legacy at line 1244, and the describe("selected source affinity") suite at line 1943: attemptDeltaUpgrade stable at line 1947, attemptDeltaUpgrade nightly at line 1971, prefetchStablePatches at line 1996, and prefetchNightlyPatches at line 2015 all remain on the legacy source.describe("fetchChangelog source affinity") in packages/cli/test/lib/release-notes.test.ts:303 and "fetches stable releases only from the explicitly selected legacy source" at line 457."probes prefixed Toolkit tags and retains the selected source" in packages/cli/test/lib/upgrade.test.ts:736.packages/cli/src/lib/ghcr.ts constructs the token scope from source.ghcrRepo at line 234, manifest URL from source.ghcrRepo at line 274, blob URL from source.ghcrRepo at line 385, and paginated tags URL from source.ghcrRepo at line 483. Tests verify the token request and Toolkit scope scope=repository:getsentry/toolkit:pull in packages/cli/test/lib/ghcr.test.ts:84,98.redirect: "manual" in packages/cli/src/lib/ghcr.ts:396; direct status 200 is accepted at line 409; only statuses 301, 302, 307, and 308 enter redirect handling at lines 414–417; redirected requests use only "User-Agent": getUserAgent() at line 438 rather than forwarding the bearer authorization; and non-OK redirect responses are rejected at line 450.packages/cli/src/lib/delta-upgrade.ts initializes expectedSha256 to "" at line 412, obtains the patch target digest via getPatchTargetSha256(manifest, binaryName) ?? "" at line 441, rejects chain completion unless the previous version equals opts.targetVersion and a digest exists at line 444, passes expectedSha256 into the chain at line 463, hashes the in-memory patched output through applyPatchChainInMemory() at line 480, and throws SHA-256 mismatch after patching: got ${sha256}, expected ${chain.expectedSha256} when hashes differ at lines 486–488.resolveAndApply() in packages/cli/src/lib/delta-upgrade.ts:566 with cache: getPatchCache() at line 572.getStableTargetSha256 tests in packages/cli/test/lib/delta-upgrade.test.ts expect "deadbeef" for a valid matching asset at line 189 and null for invalid/missing cases at lines 196, 203, and 208. Additional exact expected-digest checks include versionToHex("0.13.0") at line 278, versionToHex("0.14.0") at line 296, versionHex("0.14.0") at line 995, "aabb1122" at line 1238, and "finalhash" at line 1352.expectedSha256 with createHash("sha256") around packages/cli/test/lib/delta-upgrade.test.ts:1563 and expect the returned digest to equal it at line 1580; another calculated digest case starts around line 1669. A mocked delta test computes expectedSha256 around packages/cli/test/lib/delta-upgrade.mocked.test.ts:428, places it in digest: \sha256:${expectedSha256}`at line 442, and expectsresult!.sha256` to equal it at line 487."offline_cache_miss" in packages/cli/src/lib/upgrade.ts:1218. Tests in packages/cli/test/lib/upgrade.test.ts:550–552 verify the default error and exact error.reason; line 2242 tests explicit offline mode with an actionable message and checks the reason at line 2249; line 2256 tests network fallback with a connection message and checks the reason at line 2263.b70aff436960c0e5550972c6366734ba5e1db82a1662319a7c59f199e836bb5d -; the associated command/input was not present in the observed segment.packages/cli/test/lib/api-client.multiregion.test.ts:76–87 distinguishes hosts sentry.io, localhost, 127.0.0.1, us.sentry.io, and de.sentry.io, with de.sentry.io conditional on handlers.euRegion.