Session 07ZTCdAnxz8Z

No files found

commit
commit
BASE commit=ec83887a16f780f32fba4b7d710bad262dba3a22 tree=110d6530e57ca4fbfb2a3f98e52013d2668b5b5e parents=e7beceb6ba09b64dc277ae1732df04e65500062b
BASE subject=fix(event): Prevent immediate retry of rate-limited org in event view fallback (#1566)
HEAD commit=9525f72c70fabbb23ec21d13cf86add58f6287cc tree=22f49363a13e32c36dcd9e1ca95916809c2dc271 parents=a84012184c79c2566c7466aa6beda5f767199218
HEAD subject=fix(cli): harden upgrade metadata validation
MERGE_BASE=ec83887a16f780f32fba4b7d710bad262dba3a22
BASE_IS_ANCESTOR=0

M	packages/cli/src/commands/cli/upgrade.ts
M	packages/cli/src/lib/binary.ts
M	packages/cli/src/lib/delta-upgrade.ts
M	packages/cli/src/lib/errors.ts
M	packages/cli/src/lib/ghcr.ts
M	packages/cli/src/lib/release-notes.ts
M	packages/cli/src/lib/upgrade.ts
M	packages/cli/src/lib/version-check.ts
M	packages/cli/test/commands/cli.test.ts
M	packages/cli/test/commands/cli/upgrade.test.ts
M	packages/cli/test/lib/binary.test.ts
M	packages/cli/test/lib/delta-upgrade.mocked.test.ts
M	packages/cli/test/lib/delta-upgrade.test.ts
M	packages/cli/test/lib/ghcr.test.ts
M	packages/cli/test/lib/release-notes.test.ts
M	packages/cli/test/lib/upgrade.test.ts
M	packages/cli/test/lib/version-check.test.ts
 packages/cli/src/commands/cli/upgrade.ts           | 180 +++--
 packages/cli/src/lib/binary.ts                     | 191 +++++-
 packages/cli/src/lib/delta-upgrade.ts              | 170 ++++-
 packages/cli/src/lib/errors.ts                     |   8 +
 packages/cli/src/lib/ghcr.ts                       | ...

DIFF_CHECK_EXIT=0
4950719273dc17d5a9e061b8cfe70c62131fe3299dc1799d9c09bb522b112193  -

diff --git a/packages/cli/src/commands/cli/upgrade.ts b/packages/cli/src/commands/cli/upgrade.ts
index 8d8282368..b3039d86b 100644
--- a/packages/cli/src/commands/cli/upgrade.ts
+++ b/packages/cli/src/commands/cli/upgrade.ts
@@ -1,414 +1,465 @@
 /**
  * sentry cli upgrade
  *
  * Self-update the Sentry CLI to the latest or a specific version.
  * After upgrading, spawns the NEW binary with `cli setup` to update
  * completions, agent skills, and record installation metadata.
  *
  * Supports two release channels:
  * - stable (default): tracks the latest GitHub release
  * - nightly: tracks the rolling nightly prerelease built from main
  *
  * The channel can be set via --channel or by passing "nightly"/"stable"
  * as the version argument. The choice is persisted in the local database
  * so that subsequent bare `sentry cli upgrade` calls use the same channel. ...

diff --git a/packages/cli/src/lib/binary.ts b/packages/cli/src/lib/binary.ts
index 75582612a..e64f5059e 100644
--- a/packages/cli/src/lib/binary.ts
+++ b/packages/cli/src/lib/binary.ts
@@ -1,450 +1,621 @@
 /**
  * Binary Management
  *
  * Shared utilities for installing, replacing, and managing the CLI binary.
  * Used by both `setup --install` (fresh installs) and `upgrade` (self-updates).
  */
 
 import { spawnSync } from "node:child_process";
 import {
   existsSync,
   mkdirSync,
   readFileSync,
   renameSync,
   unlinkSync,
   writeFileSync,
 } from "node:fs";
 import { chmod, copyFile, mkdir, realpath, unlink } from "node:fs/promises";
 import { delimiter, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { compare as semverCompare } from "semver";
 import { getUserAgent } from "./constants.js";
 import {
   buildTlsErrorDetail,
   customFetch,
   isTlsCertError,
 } from "./custom-ca.js";
-import { stringifyUnknown, UpgradeError } from "./errors.js";
+import ...

diff --git a/packages/cli/src/lib/delta-upgrade.ts b/packages/cli/src/lib/delta-upgrade.ts
index ec709b8c8..204875dce 100644
--- a/packages/cli/src/lib/delta-upgrade.ts
+++ b/packages/cli/src/lib/delta-upgrade.ts
@@ -1,388 +1,481 @@
 /** Delta upgrade discovery and application backed by binpatch. */
 
 import { join } from "node:path";
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/node-core/light";
 import {
   applyPatchChainInMemory,
   extractStableChain as binpatchExtractStableChain,
   filterAndSortChainTags as binpatchFilterAndSortChainTags,
   validateChainStep as binpatchValidateChainStep,
   type DeltaTelemetry,
   type DeltaUnavailableReason,
   type ExtractStableChainOpts,
   type GitHubRelease,
   getPatchFromVersion,
   getPatchTargetSha256,
   ghcrSource,
   githubReleaseSource,
   type InstrumentHook,
   MAX_NIGHTLY_CHAIN_DEPTH,
   makeCache,
   OciClient,
   type OciManifest,
   ...

diff --git a/packages/cli/src/lib/errors.ts b/packages/cli/src/lib/errors.ts
index f81b8c70c..b21505cd1 100644
--- a/packages/cli/src/lib/errors.ts
+++ b/packages/cli/src/lib/errors.ts
@@ -541,160 +541,168 @@ export function validationError(
   headline: string,
   examples: string[],
   field?: string,
   note?: string
 ): ValidationError {
   return new ValidationError(
     buildValidationMessage(headline, examples, note),
     field
   );
 }
 
 /**
  * Input validation errors.
  *
  * @param message - Validation failure description
  * @param field - Name of the invalid field
  */
 export class ValidationError extends CliError {
   readonly field?: string;
 
   constructor(message: string, field?: string) {
     super(message, EXIT.VALIDATION);
     this.name = "ValidationError";
     this.field = field;
   }
 }
 
 /**
  * OAuth device flow errors (RFC 8628).
  *
  * @param code - OAuth error code (e.g., "authorization_pending", "slow_down")
  * @param description - Human-readable ...

diff --git a/packages/cli/src/lib/ghcr.ts b/packages/cli/src/lib/ghcr.ts
index 43d6deb7e..5bca7c061 100644
--- a/packages/cli/src/lib/ghcr.ts
+++ b/packages/cli/src/lib/ghcr.ts
@@ -1,520 +1,659 @@
 /**
  * GHCR (GitHub Container Registry) Client
  *
  * Encapsulates the OCI download protocol for fetching nightly CLI binaries
  * from ghcr.io/getsentry/cli. Nightly builds are pushed as OCI artifacts
  * via ORAS with the version baked into the manifest annotation.
  *
  * Key design decisions:
  * - Anonymous access: nightly package is public; no token needed beyond the
  *   standard ghcr.io anonymous token exchange.
  * - Version discovery from manifest annotation: `annotations.version` in the
  *   OCI manifest holds the nightly version. Checking the latest version only
  *   requires a token exchange + manifest fetch (2 HTTP requests total).
  * - Redirect quirk: ghcr.io blob downloads return 307 to Azure Blob Storage. ...

diff --git a/packages/cli/src/lib/release-notes.ts b/packages/cli/src/lib/release-notes.ts
index ddf617535..903ca51f6 100644
--- a/packages/cli/src/lib/release-notes.ts
+++ b/packages/cli/src/lib/release-notes.ts
@@ -1,122 +1,129 @@
 /**
  * Release Notes Parser & Aggregation
  *
  * Extracts user-facing changelog entries from GitHub Release bodies (stable)
  * or conventional commit messages (nightly). Uses `marked.lexer()` for
  * AST-based section extraction and produces structured data that can be
  * re-serialized as filtered markdown for rendering via `renderMarkdown()`. ...

diff --git a/packages/cli/src/lib/upgrade.ts b/packages/cli/src/lib/upgrade.ts
index 945adc48d..b29d67ff2 100644
--- a/packages/cli/src/lib/upgrade.ts
+++ b/packages/cli/src/lib/upgrade.ts
@@ -1,169 +1,267 @@
 /**
  * Upgrade Module
  *
  * Detects how the CLI was installed and provides self-upgrade functionality.
  * Binary management helpers (download URLs, locking, replacement) live in
  * binary.ts and are shared with the setup --install flow.
  */
 
 import { spawn } from "node:child_process";
 import {
   chmodSync,
   closeSync,
   existsSync,
   openSync,
   realpathSync,
   statSync,
   unlinkSync,
   writeSync,
 } from "node:fs";
 import { writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, sep } from "node:path";
 import { setTimeout } from "node:timers/promises";
+import { prerelease as semverPrerelease, valid as semverValid } from "semver";
 import {
   acquireLock,
   cleanupOldBinary,
+  compareVersions,
   ...

diff --git a/packages/cli/src/lib/version-check.ts b/packages/cli/src/lib/version-check.ts
index c69ff0466..34393b1c7 100644
--- a/packages/cli/src/lib/version-check.ts
+++ b/packages/cli/src/lib/version-check.ts
@@ -1,391 +1,396 @@
 /**
  * Background version check for "new version available" notifications.
  *
  * For nightly builds (CLI_VERSION contains "-dev.<timestamp>"), checks GHCR for the
  * latest nightly version via the OCI manifest annotation. For stable builds,
  * checks GitHub Releases. Results are cached in the database and shown on
  * subsequent runs.
  */
 
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/node-core/light";
 import { compare as semverCompare } from "semver";
+import type { UpgradeSource } from "./binary.js";
 import { CLI_VERSION } from "./constants.js";
 import { getReleaseChannel } from "./db/release-channel.js";
 import {
   getVersionCheckInfo,
   markUpdateNotified,
   ...

diff --git a/packages/cli/test/commands/cli.test.ts b/packages/cli/test/commands/cli.test.ts
index cd1514eb0..4eec11e9d 100644
--- a/packages/cli/test/commands/cli.test.ts
+++ b/packages/cli/test/commands/cli.test.ts
@@ -47,190 +47,184 @@ function createMockContext(overrides: Partial<{ execPath: string }> = {}): {
       write: (s: string) => {
         errors.push(s);
         return true;
       },
     },
   };
 
   return {
     context,
     getStderr: () => stderrChunks.join(""),
     getStdout: () => stdoutChunks.join(""),
     errors,
     restore: () => {
       process.stderr.write = origWrite;
     },
   };
 }
 
 describe("feedbackCommand.func", () => {
   test("throws ValidationError for empty message", async () => {
     // Access func through loader
     const func = await feedbackCommand.loader();
     const mockContext = {
       stdout: { write: vi.fn(() => true) },
       stderr: { write: vi.fn(() => true) },
     };
 
     await expect(func.call(mockContext, {}, ...

...output truncated...

Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_08b5d5cb6001Vl2uxb1kRBa3JN

 import type { SentryContext } from "../../../src/context.js";
 import { CLI_VERSION } from "../../../src/lib/constants.js";
 import {
   clearInstallInfo,
   setInstallInfo,
 } from "../../../src/lib/db/install-info.js";
 import {
   getReleaseChannel,
   setReleaseChannel,
 } from "../../../src/lib/db/release-channel.js";
+import { setVersionCheckInfo } from "../../../src/lib/db/version-check.js";
 import { TEST_TMP_DIR, useTestConfigDir } from "../../helpers.js";
 
 /** Store original fetch for restoration */
 let originalFetch: typeof globalThis.fetch;
 
 /** Helper to mock fetch */
 function mockFetch(
   fn: (url: string | URL | Request, init?: RequestInit) => Promise<Response>
 ): void {
   globalThis.fetch = fn as typeof globalThis.fetch;
 }
 
 /**
  * Create a mock Stricli context with stderr and stdout capture. ...

<path>/home/byk/.local/share/opencode/tool-output/tool_08b5d5cb6001Vl2uxb1kRBa3JN</path>
<type>file</type>
<content>
1: diff --git a/packages/cli/test/commands/cli/upgrade.test.ts b/packages/cli/test/commands/cli/upgrade.test.ts
2: index ca9688e46..b7fead58f 100644
3: --- a/packages/cli/test/commands/cli/upgrade.test.ts
4: +++ b/packages/cli/test/commands/cli/upgrade.test.ts
5: @@ -1,92 +1,93 @@
6:  /**
7:   * Upgrade Command Tests
8:   *
9:   * Tests the `sentry cli upgrade` command through Stricli's run().
10:   * Covers resolveTargetVersion branches (check mode, already up-to-date,
11:   * version validation) and error paths.
12:   *
13:   * Status messages go through consola (→ process.stderr). Tests capture stderr
14:   * via a spy on process.stderr.write and assert on the collected output. ...

<path>/home/byk/.local/share/opencode/tool-output/tool_08b5d5cb6001Vl2uxb1kRBa3JN</path>
<type>file</type>
<content>
1507:      const err = new Error("EBUSY: resource busy or locked, uv_spawn");
1508:      (err as NodeJS.ErrnoException).code = "EBUSY";
1509:      expect(isEbusyError(err)).toBe(true);
1510:    });
1511:  
1512:    test("returns false for ENOENT", () => {
1513:      const err = new Error("ENOENT: no such file or directory");
1514:      (err as NodeJS.ErrnoException).code = "ENOENT";
1515:      expect(isEbusyError(err)).toBe(false);
1516:    });
1517:  
1518:    test("returns false for EACCES", () => {
1519:      const err = new Error("EACCES: permission denied");
1520:      (err as NodeJS.ErrnoException).code = "EACCES";
1521:      expect(isEbusyError(err)).toBe(false);
1522:    });
1523:  
1524:    test("returns false for non-Error values", () => {
1525:      expect(isEbusyError("EBUSY")).toBe(false);
1526:      expect(isEbusyError(null)).toBe(false);
1527:      ...

diff --git a/packages/cli/test/lib/binary.test.ts b/packages/cli/test/lib/binary.test.ts
index 6fcfb3b1a..29ead3828 100644
--- a/packages/cli/test/lib/binary.test.ts
+++ b/packages/cli/test/lib/binary.test.ts
@@ -1,123 +1,250 @@
 /**
  * Binary Management Tests
  *
  * Tests for shared binary helpers: install directory selection, paths,
  * download URLs, locking, and binary installation.
  */
 
 import {
   chmodSync,
   mkdirSync,
   readFileSync,
   realpathSync,
   rmSync,
   symlinkSync,
   writeFileSync,
 } from "node:fs";
 import { access, readFile, writeFile } from "node:fs/promises";
 import { join, sep } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "vitest";
 import {
   acquireLock,
   compareVersions,
   determineInstallDir,
   fetchWithUpgradeError,
   getBinaryDownloadUrl,
   getBinaryFilename,
   getBinaryPaths,
+  getGitHubReleaseByTagUrl,
   getLegacyInstallDirs,
   getPlatformBinaryName,
   installBinary,
   isDowngrade,
   ...

diff --git a/packages/cli/test/lib/delta-upgrade.mocked.test.ts b/packages/cli/test/lib/delta-upgrade.mocked.test.ts
index cd0a2fddc..f6186ab59 100644
--- a/packages/cli/test/lib/delta-upgrade.mocked.test.ts
+++ b/packages/cli/test/lib/delta-upgrade.mocked.test.ts
@@ -22,185 +22,185 @@ import { useTestConfigDir } from "../helpers.js";
 useTestConfigDir("delta-upgrade-mocked-");
 
 // ============================================================================
 // Mock Setup
 // ============================================================================
 
 /**
  * Mock constants.js to pretend we're running a real stable version.
  * This satisfies canAttemptDelta()'s CLI_VERSION !== "0.0.0-dev" check.
  */
 vi.mock("../../src/lib/constants.js", async (importOriginal) => {
   const orig =
     await importOriginal<typeof import("../../src/lib/constants.js")>();
   return {
     ...orig,
     CLI_VERSION: "0.13.0",
   };
 });
 
 // Import AFTER mock setup so the mocked constants are ...

diff --git a/packages/cli/test/lib/delta-upgrade.test.ts b/packages/cli/test/lib/delta-upgrade.test.ts
index 3752d4ae6..68d1cfbdf 100644
--- a/packages/cli/test/lib/delta-upgrade.test.ts
+++ b/packages/cli/test/lib/delta-upgrade.test.ts
@@ -1,90 +1,99 @@
 /**
  * Unit Tests for Delta Upgrade Module
  *
  * Tests the exported pure-computation functions that drive chain resolution
  * for both stable (GitHub Releases) and nightly (GHCR) channels, plus
  * async orchestration functions tested via fetch mocking.
  */
 
 import { createHash } from "node:crypto";
 import { existsSync, unlinkSync } from "node:fs";
 import { access, readFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, test } from "vitest";
-import { getPlatformBinaryName } from "../../src/lib/binary.js";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import {
+  getPlatformBinaryName,
+  ...

diff --git a/packages/cli/test/lib/ghcr.test.ts b/packages/cli/test/lib/ghcr.test.ts
index e5c81d532..a55612b5a 100644
--- a/packages/cli/test/lib/ghcr.test.ts
+++ b/packages/cli/test/lib/ghcr.test.ts
@@ -1,252 +1,360 @@
 /**
  * GHCR Client Tests
  *
  * Unit tests for the GHCR/OCI download protocol helpers.
  * All HTTP calls are mocked via globalThis.fetch to avoid network access.
  */
 
 import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { UPGRADE_SOURCES } from "../../src/lib/binary.js";
 import { UpgradeError } from "../../src/lib/errors.js";
 import {
   downloadLayerBlob,
   downloadNightlyBlob,
   fetchManifest,
   fetchNightlyManifest,
   findLayerByFilename,
   GHCR_REPO,
   GHCR_TAG,
+  GhcrManifestHttpError,
   getAnonymousToken,
   getNightlyVersion,
   listTags,
   type OciManifest,
 } from "../../src/lib/ghcr.js";
 
 /** Store original fetch for restoration */
 let originalFetch: typeof globalThis.fetch;
 
 /** Helper to mock fetch without ...

diff --git a/packages/cli/test/lib/ghcr.test.ts b/packages/cli/test/lib/ghcr.test.ts
index e5c81d532..a55612b5a 100644
--- a/packages/cli/test/lib/ghcr.test.ts
+++ b/packages/cli/test/lib/ghcr.test.ts
@@ -6,6 +6,7 @@
  */
 
 import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { UPGRADE_SOURCES } from "../../src/lib/binary.js";
 import { UpgradeError } from "../../src/lib/errors.js";
 import {
   downloadLayerBlob,
@@ -15,6 +16,7 @@ import {
   findLayerByFilename,
   GHCR_REPO,
   GHCR_TAG,
+  GhcrManifestHttpError,
   getAnonymousToken,
   getNightlyVersion,
   listTags,
@@ -37,13 +39,13 @@ function makeManifest(overrides: Partial<OciManifest> = {}): OciManifest {
     schemaVersion: 2,
     mediaType: "application/vnd.oci.image.manifest.v1+json",
     config: {
-      digest: "sha256:config",
+      digest: `sha256:${"0".repeat(64)}`,
       mediaType: "application/vnd.oci.empty.v1+json",
       size: 2,
     },
     layers: [
       {
-        digest: ...

diff --git a/packages/cli/test/lib/release-notes.test.ts b/packages/cli/test/lib/release-notes.test.ts
index 78963b471..ffccf4901 100644
--- a/packages/cli/test/lib/release-notes.test.ts
+++ b/packages/cli/test/lib/release-notes.test.ts
@@ -1,61 +1,67 @@
 /**
  * Unit Tests for Release Notes Parser & Aggregation
  *
  * Tests core invariants (section extraction, version filtering, truncation)
  * that are hard to express as property-based tests due to format specifics.
  *
  * Core random-input invariants (category validity, filtering, commit parsing)
  * are tested via property-based tests in release-notes.property.test.ts.
  */
 
 import { marked } from "marked";
-import { describe, expect, test } from "vitest";
-import type { GitHubRelease } from "../../src/lib/delta-upgrade.js";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { UPGRADE_SOURCES } from "../../src/lib/binary.js";
+import {
+  fetchRecentReleases,
+  type GitHubRelease,
+} from ...

diff --git a/packages/cli/test/lib/upgrade.test.ts b/packages/cli/test/lib/upgrade.test.ts
index 7c6f63a4b..d10f21dd6 100644
--- a/packages/cli/test/lib/upgrade.test.ts
+++ b/packages/cli/test/lib/upgrade.test.ts
@@ -103,60 +103,62 @@ const { spawnImpl } = vi.hoisted(() => ({
 // Initialize with the real default now that fakeProcess is defined
 spawnImpl.fn = () => fakeProcess(0);
 
 vi.mock("node:child_process", async (importOriginal) => {
   const orig = await importOriginal<typeof import("node:child_process")>();
   return {
     ...orig,
     spawn: (cmd: string, args: string[], opts: object) =>
       spawnImpl.fn(cmd, args, opts),
   };
 });
 
 // Dynamic imports: must run AFTER vi.mock() so upgrade.ts picks up the
 // mocked spawn.
 import { isEnoentSpawnError } from "../../src/commands/cli/upgrade.js";
 import {
   acquireLock,
   getBinaryDownloadUrl,
   isNightlyVersion,
   releaseLock,
+  UPGRADE_SOURCES,
 } from "../../src/lib/binary.js";
 import {
   clearInstallInfo,
   ...

diff --git a/packages/cli/test/lib/version-check.test.ts b/packages/cli/test/lib/version-check.test.ts
index 20172cd83..dd047a5cb 100644
--- a/packages/cli/test/lib/version-check.test.ts
+++ b/packages/cli/test/lib/version-check.test.ts
@@ -1,61 +1,64 @@
 /**
  * Version Check Logic Tests
  */
 
 import { setTimeout as sleep } from "node:timers/promises";
-import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { UPGRADE_SOURCES } from "../../src/lib/binary.js";
 import { setReleaseChannel } from "../../src/lib/db/release-channel.js";
 import {
   getVersionCheckInfo,
   setVersionCheckInfo,
 } from "../../src/lib/db/version-check.js";
+// biome-ignore lint/performance/noNamespaceImport: Vitest requires the module namespace to spy on an ESM export
+import * as deltaUpgrade from "../../src/lib/delta-upgrade.js";
 import {
   ApiError,
   ContextError,
   ValidationError,
 } from ...