Distillation

Date: September 10, 2026

• 🟡 (12:04) Full binary download in packages/cli/src/lib/upgrade.ts fully consumes response.arrayBuffer() before calling writeFile(destPath, new Uint8Array(body)); this avoids a Bun event-loop bug where Bun.write(path, Response) with a large streaming body can let the process exit before download completion. Referenced issue: https://github.com/oven-sh/bun/issues/13237.
• 🟡 (12:04) A failed full binary download throws new UpgradeError("execution_failed", \Failed to download binary: HTTP ${response.status}`)`.
• 🟡 (12:04) Binary visibility verification uses VERIFY_MAX_ATTEMPTS = 6 and VERIFY_BASE_DELAY_MS = 100; six probes with five exponential-backoff sleeps provide an approximately 3.1-second wall-clock budget.
• 🔴 (12:04) User stated waitForBinaryVisible must throw an UpgradeError when the freshly written binary “never becomes visible or stays empty.”
• 🟡 (12:04) Upgrade handoff behavior documents that if the child process resolves to the same install path, it takes over the lock.
• 🟡 (12:05) At commit 9525f72c70fabbb23ec21d13cf86add58f6287cc, packages/cli/src/lib/custom-ca.ts:305 exports customFetch(input: string | URL | Request, init?: RequestInit): Promise<Response>.
• 🟡 (12:05) customFetch() calls getCustomTlsOptions(); when no TLS options exist it returns fetch(input, init), otherwise it returns fetch(input, { ...init, ...tlsOpts }).
• 🟡 (12:05) customFetch() is the drop-in replacement for unauthenticated bare fetch() calls and injects configured custom CA certificates. Authenticated API calls instead use fetchWithTimeout() in sentry-client.ts, which applies TLS options alongside the SaaS warning.
• 🟡 (12:05) The sentry package metadata identifies version 0.45.0-dev.0, repository git+https://github.com/getsentry/cli.git, license FSL-1.1-Apache-2.0, module type module, Node engine >=20.0, development runtime Node >=22.15, and package manager pnpm@10.11.0.
• 🟡 (12:05) The sentry package entry points are ./dist/index.cjs for main, ./dist/index.d.cts for types, ESM exports ./dist/index.mjs with ./dist/index.d.mts, CommonJS exports ./dist/index.cjs with ./dist/index.d.cts, and the sentry executable maps to ./dist/bin.cjs.
• 🟡 (12:05) Key package scripts include test:unit running generated docs/SDK plus vitest run test/lib test/commands test/types test/script --coverage; test:changed running vitest run --changed; test:e2e running vitest run test/e2e; test:init-eval using --testTimeout 600000; typecheck using tsc --noEmit; and lint using biome check --no-errors-on-unmatched --error-on-warnings --max-diagnostics=none ./.
• 🟡 (12:05) Upgrade-relevant package tooling includes tsx ^4.22.4, typescript ^5.9.3, vitest ^4.1.9, semver ^7.8.5, @types/semver ^7.7.1, fast-check ^4.8.0, and @vitest/coverage-v8 ^4.1.9.
• 🟡 (12:06) packages/cli/test/commands/cli.test.ts upgrade-command tests were updated for Toolkit GitHub release metadata: latest-release mocks now return arrays such as [{ tag_name: "cli@1.0.0" }] and [{ tag_name: "cli@99.0.0" }], replacing single objects with tags such as { tag_name: "v0.0.0-dev" } and { tag_name: "v99.0.0" }.
• 🟡 (12:06) The test "shows installation info with specified method" now invokes func.call(context, { check: true, method: "curl", json: true }) instead of check: false, and expects data.action to be "checked" rather than "up-to-date" while retaining data.method === "curl".
• 🟡 (12:06) The test "check mode shows update available" now describes curl as using the Toolkit GitHub release list with product-prefixed tags, expects target version "99.0.0", and expects warning "Run 'sentry cli upgrade' to update.".
• 🟡 (12:06) The version-specific check-mode mock now returns { tag_name: "cli@2.0.0" } when the requested URL contains /releases/tags/cli%402.0.0, otherwise [{ tag_name: "cli@99.0.0" }]; invoking the command with positional version "2.0.0" must produce warning "Run 'sentry cli upgrade 2.0.0' to update.".
• 🟡 (12:06) The former test "check mode shows already on target when versions match" was replaced by "check mode compares the current version with a stable target"; it expects action === "checked", currentVersion === "0.0.0-dev", and targetVersion === "1.0.0" rather than requiring current and target versions to match or warnings to be absent.
• 🟡 (12:06) The nonexistent-version test mocks every fetch as HTTP 404 Not Found, calls func.call(context, { check: false, method: "curl" }, "999.0.0"), expects error "Version 999.0.0 not found", and newly asserts exactly 2 fetch calls via expect(callCount).toBe(2).