Distillation

Date: Sep 10, 2026

• 🔴 (03:18) User stated packages/cli/src/lib/ghcr.ts now imports valid as semverValid from semver and imports PRIMARY_UPGRADE_SOURCE plus type UpgradeSource from ./binary.js.
• 🔴 (03:18) User stated getAnonymousToken(sourceOrSignal: UpgradeSource | AbortSignal = PRIMARY_UPGRADE_SOURCE, signal?: AbortSignal) supports either an upgrade source or the legacy AbortSignal argument; it requests ${GHCR_REGISTRY}/token?scope=repository:${source.ghcrRepo}:pull and preserves the external signal.
• 🔴 (03:18) User stated getNightlyVersion(manifest) now rejects a manifest annotation when semverValid(version) === null or !NIGHTLY_VERSION_REGEX.test(version), throwing UpgradeError("network_error", "Nightly manifest has invalid version annotation").
• 🔴 (03:18) User stated downloadNightlyBlob(token, digest, signal?, source = PRIMARY_UPGRADE_SOURCE) builds the blob URL as ${GHCR_REGISTRY}/v2/${source.ghcrRepo}/blobs/${digest} rather than using a fixed GHCR repository.
• 🔴 (03:18) User stated downloadNightlyBlob() calls rethrowExternalAbort(error, signal) when the authenticated GHCR blob request throws, preserving externally requested cancellation rather than wrapping it as an ordinary network failure.
• 🔴 (03:18) User stated GHCR blob downloads must manually follow HTTP 301, 302, 307, or 308 redirects without forwarding the Authorization header to Azure Blob Storage; automatically forwarding that header causes Azure to return HTTP 404.
• 🔴 (03:19) User stated packages/cli/src/commands/cli/upgrade.ts supports stable and nightly release channels; stable tracks the latest GitHub release, nightly tracks the rolling prerelease built from main, and the selected channel is persisted so subsequent bare sentry cli upgrade calls reuse it.
• 🔴 (03:19) User stated package managers always need network access to fetch and install packages; therefore offline upgrade is supported only for curl-installed binaries, and validateMethod() throws UpgradeError("unsupported_operation", "Offline upgrade is only supported for curl-installed binaries.") when offline is true and method !== "curl".
• 🔴 (03:19) User specified nightly-version existence checks always use the curl/GitHub lookup regardless of the current installation method because nightly builds are GitHub-only.
• 🔴 (03:19) User stated validateMethod() rejects method === "unknown" with UpgradeError("unknown_method").
• 🔴 (03:19) User stated Homebrew does not support installing a specifically pinned stable version through sentry cli upgrade; validateMethod() throws UpgradeError("unsupported_operation", "Homebrew does not support installing a specific version. Run 'brew upgrade getsentry/tools/sentry' to upgrade to the latest formula version.").
• 🔴 (03:19) User stated target resolution in packages/cli/src/commands/cli/upgrade.ts now returns { kind: "target", target: resolvedTarget, source } and uses the imported resolveExistingUpgradeVersion, resolveLatestUpgradeVersion, isNightlyVersion, and type UpgradeSource.
• 🔴 (03:19) User stated runSetupOnNewBinary() invokes the upgraded binary with ordered base arguments cli, setup, --quiet, --method, method, --channel, channel, --no-modify-path; it conditionally adds --install, --ensure-auth-scopes, and --no-agent-skills.
• 🔴 (03:19) User stated curl upgrades using --install set SENTRY_INSTALL_DIR in the child environment to pin the installation directory and prevent determineInstallDir() from relocating the new binary.
• 🔴 (03:19) User stated the CLI help example sentry cli upgrade nightly means “Switch to nightly channel and update.”