Dashboard › cli › Distillation
c1ca6056-7b41-4bd0-8181-e37e4268503a["lore_tm_v1_HICXXbfKIlsUg2rTpSO5qINi_RGx4l_cFwYRRbUU5Kc","lore_tm_v1_3deJlpeQ4dTGc7sLVrFLHUjd928jHNeced-UmX4nKKg","lore_tm_v1_daj-_5vpQ8Tw5KOS8AHHky34v_hrToSVlFVvFV5Wf24","lore_tm_v1_faaP_GA9dJfA_l3ZUIAHj-25IHsCXu76vVkTBxy75m4","lore_tm_v1_W1BbVp3ZQa3-edi5A0h_LDQ-b7G1ql-z76EtXFmpdII"]
3969176168 on PR getsentry/cli#1569, commit 4094ae9a7670f2bf46898fc7d5b8c7d89cf70819, reported a Medium Severity installer bug at packages/cli/install#L324-L334 (BUGBOT_BUG_ID: ed4075b4-8534-400f-b7a9-385dce20569e): the Toolkit latest-release parser accepts the first stable-looking cli@X.Y.Z tag_name and never inspects GitHub prerelease or draft flags, unlike the TypeScript resolver; consequently, a prerelease with a stable-looking cli@ tag can be installed as the latest stable CLI.3969176180 on PR getsentry/cli#1569, commit 4094ae9a7670f2bf46898fc7d5b8c7d89cf70819, reported a Medium Severity issue at packages/cli/src/commands/cli/upgrade.ts#L187-L234 (BUGBOT_BUG_ID: bb8d5ec7-9021-4365-b44d-c3860ac1abc9): both the explicit --offline path and network-fallback path return a target without source, causing executeUpgrade to default to PRIMARY_UPGRADE_SOURCE (Toolkit), even if prefetch or prior discovery selected the legacy repository; Bugbot said offline delta resolution could therefore inspect the wrong source and miss a cached or legacy-only chain.packages/cli/install: temporary files are github_response="${tmpdir}/sentry-install-github-response-$$" and nightly_manifest_file="${tmpdir}/sentry-install-nightly-manifest-$$"; the EXIT trap removes those files plus $tmp_binary; source records are parsed as GitHub repo, GHCR repo, and tag prefix using cut -d'|' -f1, -f2, and -f3.github_get() in packages/cli/install captures curl’s HTTP status with curl -sS -L -o "$github_response" -w '%{http_code}' "$url"; transport failure dies with "Failed to connect to GitHub while fetching ${url}" / code "gh-fetch", while callers fall through only on HTTP 404 and stop on other non-2xx statuses.select_nightly_source() in packages/cli/install probes https://api.github.com/repos/${github_repo}, gets a GHCR token scoped to repository:${ghcr_repo}:pull, and requests https://ghcr.io/v2/${ghcr_repo}/manifests/nightly with OCI manifest headers; GitHub or manifest HTTP 404 advances to the next UPGRADE_SOURCES entry, other failures terminate, success fixes selected_source and selected_ghcr_source, and exhaustion dies with "No CLI upgrade source was found: every source returned HTTP 404" / code "gh-source".select_stable_source() in packages/cli/install: unpinned prefixed sources request https://api.github.com/repos/${github_repo}/releases?per_page=100, unprefixed sources request /releases/latest, and pinned versions request /releases/tags/${tag_path} after converting @ to %40; its Toolkit parser scans for the first tag_name matching ^cli@v?[0-9]+\.[0-9]+\.[0-9]+(\+[0-9A-Za-z.-]+)?$, strips cli@, and does not inspect adjacent prerelease or draft fields.packages/cli/node_modules/binpatch/dist/index.js; resolveAndApply(opts) at lines 654–704 attempts tryLoadCachedChain(cache, currentVersion, targetVersion) before checking offline, reports cached resolution as { source: "cache", chain: cached }, applies a cached chain immediately when found, and returns null with telemetry?.onOfflineMiss?.() when offline and the cache lookup misses. Only non-offline execution calls source.resolveChain(currentVersion, targetVersion, signal, report).applyChain() in packages/cli/node_modules/binpatch/dist/index.js lines 712–739: it totals patched output sizes via parsePatchHeader(patch.data).newSize, applies patches with applyPatchChainInMemory(), emits phase, bytes, and done progress events for apply/verify stages, and throws SHA-256 mismatch after patching: got ${sha256}, expected ${chain.expectedSha256} when verification fails.packages/cli/test/lib/ghcr.test.ts defines a minimal OCI manifest with schemaVersion: 2, media type application/vnd.oci.image.manifest.v1+json, Linux layer sentry-linux-x64.gz (sha256:abc123, size 1000), Darwin layer sentry-darwin-arm64.gz (sha256:def456, size 1200), version 0.0.0-dev.1740000000, and source https://github.com/getsentry/cli.packages/cli/test/lib/ghcr.test.ts: getAnonymousToken() checks the default GHCR_REPO, uses getsentry/toolkit for UPGRADE_SOURCES[0], returns tokens from successful JSON, and verifies errors "GHCR token exchange failed: HTTP 401", "Failed to connect to GHCR: fetch failed", and "GHCR token exchange returned no token"; fetchNightlyManifest() verifies bearer/OCI headers, source-specific path /v2/getsentry/toolkit/manifests/nightly, and errors 'Failed to fetch manifest for tag "nightly": HTTP 404' and 'Failed to fetch manifest for tag "nightly": fetch failed'.packages/cli/test/lib/ghcr.test.ts: getNightlyVersion() extracts 0.0.0-dev.1740000000 and errors with "Nightly manifest has no version annotation" when missing; findLayerByFilename() maps sentry-linux-x64.gz to sha256:abc123 and sentry-darwin-arm64.gz to sha256:def456, while a missing FreeBSD layer errors with "No nightly build found for sentry-freebsd-x64.gz".downloadNightlyBlob() tests in packages/cli/test/lib/ghcr.test.ts: direct HTTP 200 is returned; HTTP 307 and 302 redirects are followed without forwarding the bearer authorization header; missing redirect Location produces "GHCR blob redirect (307) had no Location header"; blob-storage HTTP 403 produces "Blob storage download failed: HTTP 403"; unexpected GHCR HTTP 500 produces "Unexpected GHCR blob response: HTTP 500"; initial and redirect-follow network failures produce "Failed to connect to GHCR: fetch failed" and "Failed to download from blob storage: fetch failed" respectively.packages/cli/test/lib/ghcr.test.ts: fetchManifest("token", "patch-0.13.0") requests /v2/${GHCR_REPO}/manifests/patch-0.13.0, with exact errors 'Failed to fetch manifest for tag "patch-0.13.0": HTTP 404' and 'Failed to fetch manifest for tag "some-tag": fetch failed'; downloadLayerBlob("token", "sha256:abc123") follows a 307 redirect and returns the downloaded ArrayBuffer.listTags() tests in packages/cli/test/lib/ghcr.test.ts: no prefix returns ["nightly", "patch-0.13.0", "patch-0.14.0"]; prefix "patch-" returns only the 2 patch tags or [] when none match; absent tags also returns []; exact failures are "Failed to list GHCR tags: HTTP 500" and "Failed to list GHCR tags: fetch failed"; pagination triggers on exactly 100 first-page tags, appends 2 second-page tags for a total of 102, and a mixed 80-tag page filtered by "patch-" returns exactly 40.countListItems tests in packages/cli/test/lib/release-notes.test.ts: a three-item Markdown list returns 3, paragraph-only content returns 0, and an empty token array returns 0.packages/cli/test/lib/release-notes.test.ts: stable Toolkit changelogs request only https://api.github.com/repos/getsentry/toolkit/releases?per_page=30, ignore unrelated mcp@99.0.0, and include cli@0.21.0; stable legacy changelogs request only https://api.github.com/repos/getsentry/cli/releases?per_page=30; both cases produce totalItems: 1.packages/cli/test/lib/release-notes.test.ts: upgrading from 0.21.0-dev.100 to 0.21.0-dev.200 with the Toolkit source requests exactly https://api.github.com/repos/getsentry/toolkit/commits?sha=main&since=1970-01-01T00:01:41.000Z&until=1970-01-01T00:03:21.000Z&per_page=100, never requests getsentry/cli, and produces totalItems: 1 from commit message "fix: keep nightly stages affine".