Distillation

Date: Aug 24, 2026

• 🔴 [requested-review] (16:27) User requested a rigorous read-only adversarial correctness review of current worktree changes for PR #848, compared against origin/master and relevant source/tests; explicitly instructed not to edit files.
• 🔴 [requested-review] (16:27) User requested findings only, ordered Critical/Major/Minor with file:line citations, focused on configuration resolution, CLI parsing order/yargs interaction, SemVer edge cases, cache invalidation, backward compatibility, and release behavior; requested PASS/FAIL per major concern and a final MERGE/DO-NOT-MERGE verdict; instructed not to assume prior claims are correct.
• 🟡 (16:29) Repository inspected at /home/byk/Code/getsentry/craft; root includes package.json, pnpm-lock.yaml, src/, docs/, dist/, build.mjs, vitest.config.mts, AGENTS.md, .craft.yml, and node_modules/.
• 🟢 (16:30) Current /home/byk/Code/getsentry/craft worktree is branch byk/fix/commit-on-repo at b06435e4f20ff8cb0470de98ee113051978b3d63, tracking origin/byk/fix/commit-on-repo; tracked modification .lore.md and untracked .craft-issue-842-plan.md and .opencode/.
• 🟡 (16:30) PR #848 is open, non-draft, mergeable, with reviewDecision: REVIEW_REQUIRED; title: feat(config): top-level workspaces schema + --workspace selector; base master; head feat/workspaces-schema at c099bbf97c27330e69d2d329dac817bd3f95e0b0.
• 🟡 (16:30) PR #848 comprises commits: 4e2d8f434b7a096349ab088d200371560689d5d3 (feat(config): add top-level workspaces schema + --workspace selector), 42d17f0939a136010f23440e9b7210e7bdf03d6e (fix(config): address Bugbot findings on workspaces selector), and c099bbf97c27330e69d2d329dac817bd3f95e0b0 (merge of master into feat/workspaces-schema).
• 🟡 (16:30) PR #848 changes 7 files against master: src/__tests__/config.test.ts (+198), src/commands/publish.ts (+16/-5), src/config.ts (+201/-29), src/index.ts (+22/-1), src/schemas/project_config.ts (+48/-6), src/utils/__tests__/helpers.test.ts (+71), and src/utils/helpers.ts (+41).
• 🟡 (16:30) PR design claim: top-level workspaces defines named independently-versioned release units; selected workspace inherits unspecified release-relevant top-level fields and overrides declared fields; workspace github may partially override top-level GitHub config; absent workspaces is intended to preserve prior behavior.
• 🟡 (16:30) PR design claim: global --workspace <name> selector and CRAFT_WORKSPACE environment fallback are applied before yargs parsing because command builders, notably publish, derive option choices from resolved configuration before middleware; publish builder handles configuration-resolution failure during parse time.
• 🟡 (16:30) PR design claim: unknown workspace, workspace selection with no workspaces, and missing selection when workspaces are defined fail fast; workspace feature is gated by minVersion >= 2.27.0.
• 🔴 (16:32) User decided to replace execSync tar usage with node-tar for security in commit-repository handling.
• 🟢 (16:32) Local branch security/commit-repo-node-tar points to 8484cd8cc46c14b89c42ee8c52d76a9ae596c81b with commit message security(commit-repo): replace execSync tar with node-tar; branch is marked [gone].
• 🟢 (16:32) Separate worktree /home/byk/Code/getsentry/craft-workspaces-schema is on feat/workspaces-schema at c099bbf97c27330e69d2d329dac817bd3f95e0b0.
• 🟡 (16:33) In the feat/workspaces-schema worktree, uncommitted modifications exist in src/__tests__/config.test.ts, src/config.ts, src/utils/__tests__/helpers.test.ts, and src/utils/helpers.ts; committed PR diff is 597 insertions and 41 deletions, while uncommitted review fixes add 68 insertions and remove 24 lines across those 4 files.
• 🔴 (16:36) User preference/directive: always use pnpm for package management; never use npm or yarn.
• 🟢 (16:36) Repository instruction context: Node.js is managed by Volta, currently v22.12.0; dependencies are installed with pnpm install --frozen-lockfile.
• 🔴 (16:36) User specified SemVer comparison behavior: relax only the current-version side for development/pre-release compatibility, never the configured minVersion side.
• 🟡 (16:36) src/config.ts implementation comment at line 400 states: “We only relax the CURRENT side (never the configured minVersion side).”
• 🟡 (16:37) src/schemas/project_config.ts:180-197 defines releaseUnitFields shared by top-level configuration and a workspace: github, targets, preReleaseCommand, postReleaseCommand, releaseBranchPrefix, changelog, deprecated changelogPolicy, requireNames, statusProvider, artifactProvider, versioning, and noMerge; all are optional.
• 🟡 (16:37) src/schemas/project_config.ts:208-213 defines WorkspaceSchema by spreading releaseUnitFields but replacing github with GitHubGlobalConfigSchema.partial().optional(), allowing a workspace to override only projectPath, owner, or repo.
• 🟡 (16:37) src/schemas/project_config.ts:218-233 defines CraftProjectConfigSchema with the release-unit fields, optional minVersion matching /^\d+\.\d+\.\d+.*$/, and optional workspaces: z.record(z.string(), WorkspaceSchema).
• 🟡 (16:37) src/schemas/project_config.ts:225-230 documents that named workspaces must be selected using --workspace <name> or CRAFT_WORKSPACE when workspaces is present; selected values override top-level fields, while configurations without workspaces retain the legacy single implicit release unit behavior.
• 🟡 (16:37) src/schemas/project_config.ts:175-178 distinguishes the new release-unit workspace concept from an npm target’s existing workspaces: true, which discovers and publishes npm packages within one target at the same version.