Distillation

Date: Sep 8, 2026

• 🔴 (17:23) User stated package-management preference: always use pnpm; never use npm or yarn.
• 🔴 (17:23) User stated the Craft repository uses Volta-managed Node.js v22.12.0 and dependencies are installed with pnpm install --frozen-lockfile.
• 🔴 (17:23) User stated Craft development commands: pnpm build outputs dist/craft; pnpm test runs tests; pnpm lint runs ESLint; pnpm fix auto-fixes lint; manual testing uses pnpm build && ./dist/craft.
• 🔴 [requested-review] (17:23) User requested a fresh, strict, read-only adversarial review in /home/byk/Code/getsentry/craft-workspace-action-propagation of the current uncommitted fix for Craft PR #872; instructed not to edit, mutate, or format files; requested review of the exact diff from f174ceafa57355e71617f32ba1b0a030953be0a2 plus relevant source/tests.
• 🔴 [requested-review] (17:23) User specified review criteria: demonstrate that glob emits the broken-symlink candidate and that it is skipped only on ENOENT; verify unexpected realpath errors such as ELOOP/EACCES are rethrown; ensure no bypass of safe-path validation, lexical and physical realpath containment, directory-only checks, sorted determinism, or configuration behavior; confirm tests and diff hygiene; return severity-ranked file:line findings, PASS/FAIL coverage, test gaps, ending exactly MERGE or DO-NOT-MERGE.
• 🟡 (17:23) Repository guidance in AGENTS.md: TypeScript project; Prettier 3.x configured for single quotes and no arrow parentheses; ESLint 9.x flat configuration in eslint.config.mjs using typescript-eslint; unused variables prefixed with _ are permitted; Vitest tests reside in src/__tests__/ as *.test.ts; CI tests Node.js 20 and 22; primary branch is master; configuration file is root .craft.yml and schema resides in src/schemas/.
• 🟡 (17:23) Working tree relative to f174ceafa57355e71617f32ba1b0a030953be0a2 has modified src/__tests__/config.test.ts and src/config.ts: 53 insertions and 1 deletion total; src/__tests__/config.test.ts has 43 additions and src/config.ts has 10 additions/1 deletion. Base commit f174cea is test: describe workspace paths accurately on feat/workspace-action-propagation; preceding relevant commits are d48b906 (feat: support concrete release workspaces), 4862056 (feat: support compact release workspaces), 6dae341 (feat: propagate release workspaces), and 21270a1 (feat(config): add release workspaces).
• 🟡 (17:23) Uncommitted fix in src/config.ts getWorkspaceGlobMatches() preserves existing checks: validates isSafeWorkspaceGlob(workspaceGlob); resolves root = path.resolve(workspaceDirectory) and realRoot = realpathSync(root); runs globSync(workspaceGlob, { absolute: false, cwd: root, dot: true, ignore: ['**/node_modules/**'], posix: true }); filters each match by isSafeWorkspacePath(match), lexical containment of resolvedMatch under root, physical containment of realMatch under realRoot, and lstatSync(resolvedMatch).isDirectory(); returns sorted results via .sort().
• 🟡 (17:23) Uncommitted fix changes src/config.ts around lines 251-261: wraps realpathSync(resolvedMatch) in try/catch; returns false only when (error as NodeJS.ErrnoException).code === 'ENOENT', thereby excluding that glob match; rethrows all other errors. Comment states glob candidates may disappear or be broken symlinks before resolution.
• 🟡 (17:23) Uncommitted tests add globSync import from glob in src/__tests__/config.test.ts.
• 🟡 (17:24) New test ignores broken symlinks matched by workspace globs in src/__tests__/config.test.ts:505-527: creates temporary repository directory with packages/cli, adds broken symlink packages/broken targeting <directory>/missing-workspace, configures minVersion: ${WORKSPACES_MIN_VERSION} and workspace glob packages/*, changes CWD to the temp directory, asserts globSync('packages/*', { cwd: directory, dot: true, posix: true }) contains packages/broken, and asserts getWorkspaceNames() equals ['packages/cli'].
• 🟡 (17:24) New test fails on unexpected workspace glob resolution errors in src/__tests__/config.test.ts:529-545: creates packages/cli, creates self-referential symlink packages/loop with target loop, configures workspace glob packages/*, changes CWD, and expects getWorkspaceNames() to throw /ELOOP/.
• 🟡 (17:24) Existing workspace-glob tests in src/__tests__/config.test.ts cover: directory-only behavior by excluding file packages/README.md; glob expansion for braces, nested braces, ?, character classes, and **; negated character classes [!a]* and [^a]*; matching relative to repository root for remote config; no expansion through a symlinked directory outside the repository; rejection of unsafe brace alternatives {../outside/*,packages/*} and {/tmp/*,packages/*}; malformed brace globs; unsafe literal paths; multiple-pattern collision errors; and deterministic expected workspace-name ordering.
• 🟡 (17:24) src/config.ts:452-489 applies workspace selection: config with no workspaces and no active selection returns unchanged; active selection without configured workspaces throws; configured workspaces without an active selection call getWorkspaceNamesFromConfig(config, workspaceDirectory) to provide available names then throw a selection-required error; selected workspace enforces checkWorkspacesMinVersion(config) then calls resolveWorkspaceConfig(config, _activeWorkspaceName, workspaceDirectory).
• 🟡 (17:24) src/config.ts:623-638 getWorkspaceNames() reads and validates .craft.yml, checks minimal config version, expands names through getWorkspaceNamesFromConfig(parsed, path.dirname(configPath)), conditionally enforces checkWorkspacesMinVersion(parsed) when names are nonempty, and returns the names.