feat(cli): Decode iOS asset catalogs with CoreUI

[BYK]

Summary

Supersedes getsentry/cli#1469 and carries its iOS asset-catalog work into Toolkit.

Closes getsentry/cli#1429.

• Port the complete legacy CoreUI Swift reader from getsentry/sentry-cli@c596fcddd616867b6c6cdfa11f9853dc889a585a.
• Preserve the legacy Assets.json array, metadata fields, and sibling <imageId>.<extension> image association. Canonicalize IDs and rename their images together for deterministic uploads.
• Build and embed the decoder in macOS arm64 standalone binaries. Resolve native paths relative to their modules and explicitly load CoreUI.
• Stream decoded files into XCArchive and IPA wrappers. Preserve original catalogs, reject unsafe output, keep extraction failures nonfatal, and prevent collisions with existing parsed files or parent paths.
• Add two real legacy catalogs, focused regressions, and macOS arm64 CI that builds the production SEA binary and checks real pixels, repeated-upload stability, IPA normalization, corrupt-catalog fallback, and upload through the embedded helper.

These changes address Trevor's five review points on the original PR: native path resolution, the complete reader, the manifest contract, image filenames, and using CoreUI instead of reverse-engineering the catalog format.

Validation

Validated on Toolkit base 098a9b23:

• pnpm run tsc — passed.
• pnpm run lint — passed.
• pnpm run test --printConsoleTrace — passed across all workspaces:
  • CLI: 10,734 passed, 18 skipped.
  • MCP core: 1,808 passed, 6 skipped.
  • Toolkit core: 54 passed; MCP server: 87 passed; test client: 80 passed; Cloudflare: 433 passed.
• Documentation links, generated-file checks, generated pre-commit checks, CLI policy checks, and git diff --check — passed.
• Focused build tests: 107 passed, 5 macOS-only tests skipped on Linux.
• Full bundled E2E run: 162 passed, 3 skipped, 1 timing failure (completion took 519.6 ms against a 500 ms limit). The unchanged assertions passed on the focused rerun: 4/4 tests on both unchanged main and this branch, including completion at 483 ms and 478 ms respectively.
• Source-mode completion and telemetry timing assertions fail on both unchanged main and this branch. Unchanged main measured 704.8 ms completion and 3,215.1 ms telemetry-enabled exit; the branch measured 868.8 ms and 2,944.5 ms. The source E2E timing limits remain unchanged.

Native CoreUI execution is covered by the macOS arm64 job, which now feeds the required aggregate test gate.

Review update (e24253e7)

• Removed the redundant license disclosures from the native sources, both READMEs, and this description.
• Made native CI part of the required aggregate gate, with a regression covering nine job-result/project-count scenarios.
• Fixed universal idiom metadata and added a real-catalog native assertion.
• Incorporated main 1b63965f and reran typecheck, lint, all workspace tests, documentation/generated-file checks, CLI policies, and all 65 CI-policy tests successfully. The CLI suite passed 10,795 tests; the Local viewer passed 110.
• All six current review threads have concrete replies and are resolved. CI is rerunning on this exact head, including the native regression.

Fixture correction (79f76b3f)

The legacy catalog is phone-specific. The native suite now compiles a separate explicitly universal image set with Xcode actool and tests both idioms through XCArchive, IPA, and embedded-binary uploads: eight native cases. Both original real catalogs and all pixel, filename-association, and repeat-upload checks are retained.

Local typecheck, lint, workspace tests, documentation/generated-file checks, and all 65 CI-policy tests passed. macOS CI passed all eight native cases on 79f76b3f, including universal assets uploaded through the embedded binary: https://github.com/getsentry/toolkit/actions/runs/38667923127/job/116204089698 .

[cursor]

Stale Bugbot comment from a previous run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
sentry-local	Skipped		Oct 15, 2026 1:51am UTC

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e24253e. Configure here.}

[BYK]

Reviewed the final Warden helper-path annotation against the exact-head macOS run. It repeats the earlier lookup finding: SwiftPM provides the release alias, and all eight native cases passed on 79f76b3, including source-mode XCArchive/IPA normalization and universal-image upload through the embedded binary. The remaining annotation is a false positive; no code change is needed. Native evidence: https://github.com/getsentry/toolkit/actions/runs/38667923127/job/116204089698