Distillation

Date: Sep 9, 2026

• 🟡 (23:57) fetchLatestVersion("npm", "nightly") coverage in /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade/packages/cli/test/lib/upgrade.test.ts mocks Toolkit repository availability at https://api.github.com/repos/getsentry/toolkit, GHCR token "tok", and a nightly manifest annotation { version: "0.0.0-dev.1740393600" }; expected result is "0.0.0-dev.1740393600".
• 🟡 (23:57) fetchLatestVersion("curl") coverage verifies that omitting the channel defaults to stable GitHub discovery and normalizes Toolkit tag "cli@v3.0.0" to "3.0.0".
• 🟡 (23:57) versionExists("curl", "1.0.0") coverage verifies the first probe is exactly https://api.github.com/repos/getsentry/toolkit/releases/tags/cli%401.0.0; when it succeeds, the selected Toolkit source is retained.
• 🟡 (23:57) versionExists("curl", "1.0.0") coverage verifies Toolkit HTTP 404 falls back to exactly https://api.github.com/repos/getsentry/cli/releases/tags/1.0.0, where a successful unprefixed legacy tag returns true.
• 🟡 (23:57) resolveExistingUpgradeVersion("1.0.0") coverage verifies a thrown transport error whose text is "No CLI upgrade source was found: every source returned HTTP 404" is not classified as missing sources; it is reported as "Failed to connect to GitHub".
• 🟡 (23:57) Passing explicit UPGRADE_SOURCES[0] to versionExists("curl", "1.0.0", UPGRADE_SOURCES[0]) prevents fallback: Toolkit HTTP 404 returns false after only https://api.github.com/repos/getsentry/toolkit/releases/tags/cli%401.0.0.
• 🟡 (23:57) Stable existence tests also verify versionExists("curl", "99.99.99") returns false for GitHub HTTP 404, while versionExists("npm", "1.0.0") returns true for npm HTTP 200.
• 🟡 (23:57) binpatch stable-chain implementation in packages/cli/node_modules/binpatch/dist/index.js uses SHA256_DIGEST_PATTERN = /^sha256:([0-9a-f]+)$/i; extractSha256(asset) lowercases a valid digest, and getStableTargetSha256(release, binaryName) reads it from the matching binary asset.
• 🟡 (23:57) extractStableChain(opts) in packages/cli/node_modules/binpatch/dist/index.js finds target/current releases by exact tag_name, returns "no_patches" if either is absent or targetIdx >= currentIdx, returns "too_long" above MAX_STABLE_CHAIN_DEPTH, requires the target binary SHA-256 and a ${binaryName}.patch asset for every release, returns "malformed_chain" when required data is absent, and returns "over_budget" when cumulative patch size exceeds fullGzSize * SIZE_THRESHOLD_RATIO.
• 🟡 (23:57) On success, extractStableChain(opts) reverses patch URLs and releases, constructs ordered { fromVersion, toVersion } steps from currentVersion toward targetVersion, and returns { patchUrls, expectedSha256, steps }.
• 🟡 (23:57) githubReleaseSource(config) in packages/cli/node_modules/binpatch/dist/index.js fetches ${releasesUrl}?per_page=${MAX_STABLE_CHAIN_DEPTH + 2} with Accept: "application/vnd.github.v3+json", configured "User-Agent", and the supplied abort signal; transport or non-OK responses resolve as unavailable (null).
• 🟡 (23:57) githubReleaseSource(config).resolveChain(...) reports "network" when release retrieval or any concurrent patch download fails, "no_patches" when the target release is absent, "malformed_chain" when ${binaryName}.gz or required chain data is absent, and otherwise returns downloaded patches with exact byte sizes, aggregate totalSize, expectedSha256, and transition steps.
• 🟡 (23:58) Diff for packages/cli/test/lib/binary.test.ts expands imports with getGitHubReleaseByTagUrl, resolveUpgradeSource, UPGRADE_SOURCES, and UpgradeSourceNotFoundError.
• 🟡 (23:58) Updated getBinaryDownloadUrl("1.0.0") expectations require Toolkit release URLs beginning https://github.com/getsentry/toolkit/releases/download/, containing /cli@1.0.0/, sentry-, and the current architecture ("arm64" or "x64"); Windows output ends in .exe, while non-Windows output does not.
• 🟡 (23:58) UPGRADE_SOURCES ordering test in packages/cli/test/lib/binary.test.ts expects exactly: 1. { githubRepo: "getsentry/toolkit", ghcrRepo: "getsentry/toolkit", tagPrefix: "cli@" }; 2. { githubRepo: "getsentry/cli", ghcrRepo: "getsentry/cli", tagPrefix: "" }.
• 🟡 (23:58) resolveUpgradeSource first-source test probes exactly https://api.github.com/repos/getsentry/toolkit/releases/tags/cli%400.45.0; Toolkit HTTP 200 with { tag_name: "cli@0.45.0" } returns { source: UPGRADE_SOURCES[0], response: Response } without trying legacy.
• 🟡 (23:58) resolveUpgradeSource fallback test verifies only Toolkit HTTP 404 advances to legacy, producing request order: 1. https://api.github.com/repos/getsentry/toolkit/releases/tags/cli%400.45.0; 2. https://api.github.com/repos/getsentry/cli/releases/tags/0.45.0, with the latter selected after HTTP 200.
• 🟡 (23:58) Parameterized resolveUpgradeSource tests verify Toolkit HTTP statuses 401, 403, 429, and 500 each throw an exact HTTP ${status} error and do not query the legacy source.
• 🟡 (23:58) resolveUpgradeSource network-failure coverage verifies TypeError("fetch failed") on the Toolkit probe throws "Failed to connect to GitHub: fetch failed" and makes exactly one request, to https://api.github.com/repos/getsentry/toolkit/releases/tags/cli%400.45.0.
• 🟡 (23:58) When every source returns HTTP 404, resolveUpgradeSource tests require an UpgradeSourceNotFoundError with name: "UpgradeSourceNotFoundError" after exactly two probes: Toolkit cli%400.45.0, then legacy 0.45.0.