Distillation

Date: September 10, 2026

• 🔴 (05:10) User stated package managers always need network access to fetch and install packages.
• 🔴 (05:10) User provided the CLI example sentry cli upgrade nightly, described as “Switch to nightly channel and update”.
• 🔴 (05:10) User-provided source shows SPAWN_MAX_ATTEMPTS = 5.
• 🔴 (05:10) User-provided CLI help includes sentry cli upgrade --no-agent-skills, described as “Skip reinstalling agent skills”.
• 🔴 (05:18) User provided immutable patch hash 926a66dead34fd22b367458e04d00e1aa692448b.
• 🟡 (05:18) Assistant review found a MUST-FIX selected-source-affinity bug in /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade/packages/cli/src/lib/delta-upgrade.ts:133-135,172-174,566-575: the selected UpgradeSource reaches the network strategy but not getPatchCache(); cache identity contains only fromVersion and toVersion, with all sources sharing patch-cache. A legacy chain cached for 0.44.0 → 0.45.0 can therefore satisfy a later Toolkit operation, causing resolveAndApply() to apply legacy patches and expected SHA while reporting/routing Toolkit. Recommended fix: namespace cache entries by a stable source key or persist and verify source provenance for each cached chain; permit existing unscoped entries only through an explicit legacy migration rule.
• 🟡 (05:18) Assistant specified ordered regression coverage for delta-cache source affinity: 1. Online Toolkit resolution never consumes a legacy chain. 2. Online legacy resolution never consumes a Toolkit chain. 3. Offline resolution consumes only a cache entry whose recorded source matches its provenance. 4. No request or artifact from the other source occurs.
• 🟡 (05:18) Assistant review found a MUST-FIX Toolkit tag-contract bug in /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade/packages/cli/src/lib/upgrade.ts:136-145 and /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade/packages/cli/src/lib/binary.ts:238-243: discovery strips cli@ and then a leading v, accepting cli@v1.2.3 as 1.2.3, but download construction requests cli@1.2.3, a different tag. The test at packages/cli/test/lib/upgrade.test.ts:399-422 explicitly preserves the broken behavior. Recommended fix: Toolkit must require the text after cli@ to be stable SemVer directly; only normalize legacy vVERSION when source.tagPrefix === "". Regression should return only cli@v1.2.3, expect terminal invalid/no-version metadata with no download or legacy fallback, and retain a separate legacy v1.2.3 compatibility test.
• 🟡 (05:18) Assistant review found a MUST-FIX npm metadata-validation bug in /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade/packages/cli/src/lib/upgrade.ts:581-587: although parseUpgradeJson() returns unknown, the npm path casts it to {version?: string} and accesses data.version; null causes raw TypeError, while {version: 42} passes a non-string to semver.valid() and can also throw outside intended metadata classification. Recommended fix: ensure the body is a non-null, non-array object and version is a string before validateStableVersion(). Regression cases: null, arrays, primitives, {version: 42}, and {version: ""}, each asserting the exact UpgradeError name, reason, and message plus zero package-manager execution.
• 🟡 (05:18) Assistant verified prior blocker fixes: parseUpgradeJson() preserves caller abort identity and distinguishes syntax failures from body-transport failures at binary.ts:521-539; curl cache fallback accepts only UpgradeTransportError, with HTTP and malformed metadata terminal at commands/cli/upgrade.ts:210-236; GHCR token responses require a non-empty string at ghcr.ts:279-297; OCI manifests validate schema, layers, digests, sizes, annotations, and optional config at ghcr.ts:206-245; GHCR tag lists reject non-array and non-string tags at ghcr.ts:558-583; pinned GitHub releases require the exact source-specific tag at upgrade.ts:723-745.
• 🟡 (05:18) Assistant additionally verified: external abort reasons propagate through source probes, token exchange, manifest fetch/body parsing, pagination, GHCR blob fetch, and redirect fetch; legacy fallback occurs only for typed HTTP 404—not 401/403/429/5xx, malformed success responses, or transport failures; GitHub pagination constrains origin/path/page, reconstructs the selected-source URL, rejects cycles, and retains the signal; redirect downloads remove the authorization header; stable package versions reject invalid SemVer and prereleases once confirmed to be strings; pinned stable/nightly routing uses artifact semantics independently of the persisted tracking channel; source propagates through discovery, changelog, download, and prefetch network strategies; delta output SHA verification remains mandatory; offline mode remains curl-only and never performs package-manager upgrades.
• 🟡 (05:18) Assistant identified a residual GHCR pagination gap at ghcr.ts:603-623: there is no repeated-cursor guard, so a malformed full page repeating its final tag can loop forever. Recommended adding a seen-cursor assertion.
• 🟡 (05:18) Assistant identified a residual fixture gap at test/commands/cli/upgrade.test.ts:1095-1104: the fixture is not a valid OCI manifest and the test checks only that manifest URLs were requested, allowing it to pass even if upgrade fails before blob download. Recommended replacing it with a valid manifest and asserting blob access, setup invocation, and successful output.
• 🟡 (05:18) Assistant stated tests were not run because the review was limited to immutable Git objects and prohibited worktree access.
• 🟡 (05:18) Assistant reviewed all 17 changed source and test paths; confirmed the base and head objects exist, merge base is exactly ec83887a16f780f32fba4b7d710bad262dba3a22, git diff --check passes, and immutable patch hash remained 926a66dead34fd22b367458e04d00e1aa692448b; final recommendation was DO-NOT-MERGE.