Distillation

Date: Sep 10, 2026

• 🔴 (10:51) User assigned the assistant as the replacement READ-ONLY security and supply-chain merge-gate reviewer for getsentry/cli PR #1569; prior reviewer returned empty twice, and a substantive evidence-based response is mandatory.
• 🔴 (10:51) User specified repository /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade, exact immutable base ec83887a16f780f32fba4b7d710bad262dba3a22, and exact immutable head 9525f72c70fabbb23ec21d13cf86add58f6287cc.
• 🔴 [enforced-read-only-review] (10:51) User instructed: “Never inspect or modify the worktree,” mutate VCS, or write files; review must use Git objects only.
• 🔴 [requested-review] (10:51) User required verification of merge-base/base ancestry, base/head trees, changed paths, full diff, and git diff --check, plus inspection of every changed source and test object.
• 🔴 (10:51) User required Toolkit-first fallback to advance only on genuine typed HTTP 404; non-404 HTTP responses, transport errors, TLS errors, and malformed success responses must never fall through.
• 🔴 (10:51) User required the successfully selected source to remain sticky through stable/nightly exact/latest lookup, token scope, manifests, blobs, delta, prefetch, changelog, and setup.
• 🔴 (10:51) User required GitHub pagination to reconstruct trusted selected-repository URLs and detect cycles.
• 🔴 (10:51) User required response-body cancellation to preserve the exact arbitrary signal.reason; body termination must remain UpgradeTransportError; malformed complete JSON must be terminal metadata failure.
• 🔴 (10:51) User required npm latest JSON to have strict runtime shape and stable canonical SemVer.
• 🔴 (10:51) User required pinned npm/pnpm/bun/yarn HTTP 404 versus 401/403/429/500 classification to use one request and never launch a subprocess on failure.
• 🔴 [enforced-lookup-method] (10:52) User required nightly builds to always use curl (GitHub) lookup regardless of the current installation method.
• 🔴 (10:51) User required Toolkit to accept only cli@VERSION, while the legacy source supports vVERSION.
• 🔴 (10:51) User required malformed or prerelease standalone pins and draft/prerelease exact-release metadata to fail before download/setup.
• 🔴 (10:51) User required GHCR tokens to be trimmed non-empty strings.
• 🔴 (10:51) User required OCI manifests, layers, digests, sizes, annotations, and tag-list bodies to be runtime-validated; annotation arrays must fail.
• 🔴 (10:51) User required tag pagination to detect repeated cursors, bearer authorization never to reach redirects, and nightly annotations to bind the exact target.
• 🔴 (10:51) User required artifact channel and tracking channel to remain separate.
• 🔴 (10:51) User required correct offline behavior and transport-only cache fallback.
• 🔴 (10:51) User required delta application to verify the final SHA and clean up.
• 🔴 (10:51) User stated the settled contract: patch cache is source-neutral because dual-published artifacts for the same version pair must be byte-identical, and cached chains verify final output SHA-256. User instructed not to reopen this issue unless a defect survives both guarantees.
• 🔴 (10:51) User required findings first, ordered by severity, with every finding labeled PASS, CONCERN, MUST-FIX, or BLOCKED, including exact HEAD file:line evidence and a deterministic regression/fix for defects.
• 🔴 (10:51) User required the final review to state inspected scope and residual risks even if no defects are found.
• 🔴 (10:51) User required any command/tool failure to be reported first as BLOCKED with the exact error rather than returning empty; empty output is forbidden.
• 🔴 (10:51) User required the final line to be exactly MERGE or DO-NOT-MERGE.
• 🟡 (10:51) Git-object verification reported worktree Git directory /home/byk/Code/getsentry/cli/.git/worktrees/toolkit-bridge-upgrade.
• 🟡 (10:51) Base object verified as commit ec83887a16f780f32fba4b7d710bad262dba3a22, tree 110d6530e57ca4fbfb2a3f98e52013d2668b5b5e, parent e7beceb6ba09b64dc277ae1732df04e65500062b, subject fix(event): Prevent immediate retry of rate-limited org in event view fallback (#1566).
• 🟡 (10:51) Head object verified as commit 9525f72c70fabbb23ec21d13cf86add58f6287cc, tree 22f49363a13e32c36dcd9e1ca95916809c2dc271, parent a84012184c79c2566c7466aa6beda5f767199218, subject fix(cli): harden upgrade metadata validation.
• 🟡 (10:51) Merge-base was exactly ec83887a16f780f32fba4b7d710bad262dba3a22; base ancestry check reported base-is-ancestor=yes.
• 🟡 (10:52) Exactly 17 modified paths were reported: packages/cli/src/commands/cli/upgrade.ts, packages/cli/src/lib/binary.ts, packages/cli/src/lib/delta-upgrade.ts, packages/cli/src/lib/errors.ts, packages/cli/src/lib/ghcr.ts, packages/cli/src/lib/release-notes.ts, packages/cli/src/lib/upgrade.ts, packages/cli/src/lib/version-check.ts, packages/cli/test/commands/cli.test.ts, packages/cli/test/commands/cli/upgrade.test.ts, packages/cli/test/lib/binary.test.ts, packages/cli/test/lib/delta-upgrade.mocked.test.ts, packages/cli/test/lib/delta-upgrade.test.ts, packages/cli/test/lib/ghcr.test.ts, packages/cli/test/lib/release-notes.test.ts, packages/cli/test/lib/upgrade.test.ts, and packages/cli/test/lib/version-check.test.ts.
• 🟡 (10:52) Diff stat reported 3,299 insertions and 433 deletions across 17 files. Per-file changes: upgrade.ts 180 lines, binary.ts 191, delta-upgrade.ts 170, errors.ts 8, ghcr.ts 213, release-notes.ts 134, version-check.ts 21, commands/cli.test.ts 40, commands/cli/upgrade.test.ts 494, binary.test.ts 188, delta-upgrade.mocked.test.ts 14, delta-upgrade.test.ts 220, ghcr.test.ts 235, release-notes.test.ts 221, upgrade.test.ts 758, and version-check.test.ts 125.
• 🟡 (10:52) git diff --check reported diff-check=clean; patch SHA-256 was 4950719273dc17d5a9e061b8cfe70c62131fe3299dc1799d9c09bb522b112193.
• 🟡 (10:52) packages/cli/src/lib/binary.ts introduced UpgradeSource with exact fields githubRepo, ghcrRepo, and tagPrefix; UPGRADE_SOURCES is ordered as 1. Toolkit { githubRepo: "getsentry/toolkit", ghcrRepo: "getsentry/toolkit", tagPrefix: "cli@" }, then 2. legacy CLI { githubRepo: "getsentry/cli", ghcrRepo: "getsentry/cli", tagPrefix: "" }; PRIMARY_UPGRADE_SOURCE is the first entry.
• 🟡 (10:52) packages/cli/src/lib/binary.ts added source-aware URL helpers getBinaryDownloadUrl(), getGitHubReleasesUrl(), getGitHubReleaseByTagUrl(), getGitHubLatestReleaseUrl(), and getGitHubRepositoryUrl(); prefixed latest discovery uses ?per_page=100, while an unprefixed source uses /latest.
• 🔴 (10:52) User required source probing to never repeat the successful request; the implementation contract returns the successful Response from resolveUpgradeSource() for reuse.
• 🟡 (10:52) packages/cli/src/lib/binary.ts added resolveUpgradeSource(): probes ordered sources, returns { source, response } on success, advances only when response.status === 404, throws UpgradeError("network_error", ...) for other HTTP statuses, and throws UpgradeSourceNotFoundError when every source returns 404.
• 🟡 (10:52) fetchUpgradeProbe() in packages/cli/src/lib/binary.ts uses getGitHubHeaders() and optional signal; an aborted supplied signal rethrows exact options.signal.reason, an AbortError is rethrown, TLS errors become UpgradeTransportError(buildTlsErrorDetail(error)), and other connection failures become UpgradeTransportError("Failed to connect to GitHub: ...").
• 🟡 (10:52) packages/cli/src/lib/binary.ts changed fetchWithUpgradeError() so exact aborted init.signal.reason is preserved, TLS and generic connection failures use UpgradeTransportError, and ordinary AbortError remains unchanged.
• 🟡 (10:52) packages/cli/src/lib/binary.ts added parseUpgradeJson(response, signal, invalidMessage): exact cancellation reason is rethrown; SyntaxError becomes terminal UpgradeError("network_error", invalidMessage); other body-read failures become UpgradeTransportError with the underlying error string.
• 🟡 (10:52) packages/cli/src/lib/errors.ts added UpgradeTransportError extends UpgradeError; its constructor uses reason "network_error" and sets name = "UpgradeTransportError".
• 🟡 (10:52) packages/cli/src/lib/delta-upgrade.ts added source-bound normalized stable releases using symbol NORMALIZED_RELEASE_SOURCE, upgradeSourceKey(), isNormalizedForSource(), and normalizeStableReleases().
• 🟡 (10:52) normalizeStableReleases() filters runtime-shaped GitHub releases, rejects draft/prerelease entries, requires the selected source’s tagPrefix, strips that prefix, and retains only valid non-prerelease SemVer using semverValid() and semverPrerelease().
• 🟡 (10:52) packages/cli/src/lib/delta-upgrade.ts made stable and nightly strategies source-aware: stable uses getGitHubReleasesUrl(source) and nightly uses source.ghcrRepo; fetchRecentReleases(), resolveStableChain(), resolveNightlyChain(), resolveStableDelta(), resolveNightlyDelta(), attemptDeltaUpgrade(), prefetchNightlyPatches(), and prefetchStablePatches() now accept or propagate UpgradeSource.
• 🟡 (10:52) Stable delta release interception in stableSource(source) only normalizes a successful response whose input begins with the selected ${releasesUrl}?; non-array bodies are rewrapped unchanged, while arrays are normalized for the selected source before being returned to binpatch.
• 🟡 (10:52) fetchRecentReleases() requests ${getGitHubReleasesUrl(source)}?per_page=12; HTTP failure, malformed non-array data, or caught failure returns an empty source-normalized release array.
• 🟡 (10:53) packages/cli/src/lib/ghcr.ts defines GHCR_REQUEST_TIMEOUT = 10_000, GHCR_MAX_RETRIES = 1, GHCR_BLOB_TIMEOUT = 30_000, NIGHTLY_VERSION_REGEX = /^\d+\.\d+\.\d+-dev\.\d+$/, and SHA256_DIGEST_REGEX = /^sha256:[0-9a-f]{64}$/.
• 🟡 (10:53) packages/cli/src/lib/ghcr.ts changed retry/cancellation behavior: if the external signal is aborted, it immediately throws exact externalSignal.reason; exhausted transport/network failures become UpgradeTransportError.
• 🟡 (10:53) GHCR runtime validation shown in packages/cli/src/lib/ghcr.ts requires annotation maps to be non-array string records, layer digests to match lowercase SHA-256 format, sizes to be safe integers, schemaVersion === 2, and all manifest layers to pass validation.
• 🟡 (10:53) getAnonymousToken() in packages/cli/src/lib/ghcr.ts became source-aware and builds token scope as repository:${source.ghcrRepo}:pull.
• 🟡 (10:53) GHCR manifest fetching now throws GhcrManifestHttpError(tag, response.status) on non-OK HTTP, uses parseUpgradeJson() for body parsing, and throws terminal UpgradeError("network_error", 'Manifest for tag "..." returned invalid metadata') when runtime shape validation fails.
• 🟡 (10:53) getNightlyVersion() now requires both valid SemVer and exact numeric nightly shape X.Y.Z-dev.<digits>; otherwise it throws UpgradeError("network_error", "Nightly manifest has invalid version annotation").
• 🟡 (10:53) listTags() became source-aware and tracks visitedCursors; an absent or repeated next cursor throws UpgradeError("network_error", "GHCR tag pagination returned a repeated cursor").
• 🟡 (10:53) packages/cli/src/lib/release-notes.ts became source-aware through getGitHubReleasesUrl(source), normalizeStableReleases(), and isNormalizedForSource(); prefetched releases are accepted only when normalized for the selected source.
• 🟡 (10:53) Stable changelog fetching requests ${getGitHubReleasesUrl(source)}?per_page=30, normalizes releases for that source, and builds summaries over the exclusive fromVersion to inclusive toVersion range.
• 🟡 (10:53) Nightly changelog fetching now uses the selected repository in https://api.github.com/repos/${source.githubRepo}/commits?sha=main&since=${sinceDate}&until=${untilDate}&per_page=100.
• 🟡 (10:53) FetchChangelogOptions now carries optional source?: UpgradeSource and source-normalized prefetchedReleases?: NormalizedGitHubReleases; fetchChangelog() defaults the source to PRIMARY_UPGRADE_SOURCE and propagates it to stable or nightly changelog retrieval.