Distillation

Date: Sep 10, 2026

• 🔴 (04:36) User requires security/supply-chain reviews to be strictly read-only: never modify anything, use immutable Git objects only, and never use the worktree.
• 🔴 (04:36) User requires every final security/supply-chain review to return a substantive, non-empty report; empty output is forbidden.
• 🟡 [requested-review] (04:36) User requested a final security/supply-chain gate for getsentry/cli PR #1569 at exact base commit ec83887a16f780f32fba4b7d710bad262dba3a22 and exact head commit cea7b2afba91f11f1cdbb1785ea97ba61159520c, using repository /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade.
• 🟡 (04:36) User required inspection of all changed source and test files, covering: endpoint response shape and exact-tag fail-closed behavior; arbitrary cancellation at every stage; transport-only cache fallback; stable package SemVer; strict branded prefetch; target channels; semantic stable filters; exact metadata; 404 behavior; source affinity; trusted pagination; GHCR scope, redirects, and SHA handling; delta, cache, offline, and installer behavior; and CodeQL exact-origin behavior.
• 🟡 (04:36) User required a findings-first report using exact classifications PASS, CONCERN, MUST-FIX, or BLOCKED, with exact head file:line references, a deterministic regression for every defect, and explicit residual gaps.
• 🔴 (04:36) User requires the final review verdict to be exactly MERGE or DO-NOT-MERGE.
• 🟡 (04:37) Git verification returned base ec83887a16f780f32fba4b7d710bad262dba3a22, head cea7b2afba91f11f1cdbb1785ea97ba61159520c, and merge base ec83887a16f780f32fba4b7d710bad262dba3a22.
• 🟡 (04:37) PR #1569 changes 17 files with exactly 2,780 insertions and 407 deletions: packages/cli/src/commands/cli/upgrade.ts (180-line diff), packages/cli/src/lib/binary.ts (170), packages/cli/src/lib/delta-upgrade.ts (170), packages/cli/src/lib/errors.ts (8), packages/cli/src/lib/ghcr.ts (104), packages/cli/src/lib/release-notes.ts (134), packages/cli/src/lib/upgrade.ts (488), packages/cli/src/lib/version-check.ts (21), packages/cli/test/commands/cli.test.ts (40), packages/cli/test/commands/cli/upgrade.test.ts (342), packages/cli/test/lib/binary.test.ts (145), packages/cli/test/lib/delta-upgrade.mocked.test.ts (14), packages/cli/test/lib/delta-upgrade.test.ts (220), packages/cli/test/lib/ghcr.test.ts (139), packages/cli/test/lib/release-notes.test.ts (221), packages/cli/test/lib/upgrade.test.ts (666), and packages/cli/test/lib/version-check.test.ts (125).
• 🔴 (04:37) User stated artifacts must always be fetchable from the base repository with GitHub.
• 🔴 [enforced-workflow] (04:37) User requires the regular PR workflow with minimal, clean diffs for dependency updates: create a properly named branch; commit, including .lore.md; open a PR; review and merge; inspect package.json and lockfile diffs; confirm peer-dependency ranges resolve; prevent unrelated churn; verify the branch tracks the correct remote and is pushed to the correct PR branch; close redundant or duplicate PRs such as Dependabot replacements; require all CI checks to pass, rerunning flaky jobs when necessary; and merge only when everything is clean.
• 🔴 (04:37) User requires Node.js API availability to always be guarded at module top level with runtime checks such as typeof api === 'function', especially for newer APIs such as zlib.zstdCompress, to prevent import-time crashes on older Node.js versions.
• 🔴 (04:37) User requires debug IDs to always be injected into JavaScript bundles during local builds, even without an authentication token; upload should instead be gated inside the plugin.
• 🔴 (04:37) User requires server-side deployments never to ship sourcemaps to end users while preserving development debuggability.
• 🔴 (04:37) User requires sensitive CLI arguments to never reach telemetry. In src/cli.ts, SENSITIVE_ARGV_FLAGS = new Set(['token', 'auth-token']); redactArgv() must replace those values with [REDACTED] before every telemetry call, and raw process.argv must never be sent without first passing through redactArgv().
• 🔴 (04:37) User requires non-essential post-install steps in src/commands/cli/setup.ts never to crash setup. bestEffort(stepName, fn) must catch failures, call warn(stepName, error), and call captureException(error, { level: 'warning', tags: { 'setup.step': stepName } }); runConfigurationSteps() applies bestEffort() independently to all 4 steps.
• 🔴 (04:37) User’s install-directory priority is: 1. $SENTRY_INSTALL_DIR, 2. ~/.local/bin when it exists and is in PATH, 3. ~/bin when it exists and is in PATH, 4. ~/.sentry/bin as fallback. The welcome message appears only for a fresh install, not an upgrade.
• 🔴 (04:37) User requires explicit, immutable design classifications and binary isolation of fetch versus content failures: preserve exact enum/string values; distinguish network/transient from malformed_chain, cache hit from miss, and in-memory from disk; narrow investigation to one layer at a time rather than broad refactoring.
• 🔴 (04:37) User’s stated invariant is that fetch failures are always transient and never poison state.
• 🔴 (04:37) User’s stated invariants include never targeting the same path, never writing intermediates to disk, and always cleaning up intermediates on failure.
• 🔴 [enforced-workflow] (04:37) After committing fixes on a fix/* branch, user expects the branch to be pushed to origin and a PR opened immediately, then work handed off to CI and follow-ups: monitor CI, identify dependent-repository work such as filing issues in BYK/binpatch, and flag unintended changes such as auto-generated .lore.md before proceeding.