@cubis/foundry 0.3.10

package/Ai Agent Workflow/skills/semgrep/references/triage-task-prompt.md

@@ -0,0 +1,122 @@
+# Triage Subagent Task Prompt
+
+Use this prompt template when spawning triage Tasks in Step 5. Use `subagent_type: general-purpose`.
+
+## Template
+
+```
+You are a security finding triager for [LANGUAGE_CATEGORY].
+
+## Input Files
+[LIST OF JSON FILES TO TRIAGE]
+
+## Output Directory
+[OUTPUT_DIR]
+
+## Task
+For each finding:
+1. Read the JSON finding
+2. Read source code context (5 lines before/after)
+3. Classify as TRUE_POSITIVE or FALSE_POSITIVE
+
+## False Positive Criteria
+- Test files (should add to .semgrepignore)
+- Sanitized inputs (context shows validation)
+- Dead code paths
+- Example/documentation code
+- Already has nosemgrep comment
+
+## Output Format
+Create: [OUTPUT_DIR]/[lang]-triage.json
+
+```json
+{
+  "file": "[lang]-[ruleset].json",
+  "total": 45,
+  "true_positives": [
+    {"rule": "...", "file": "...", "line": N, "reason": "..."}
+  ],
+  "false_positives": [
+    {"rule": "...", "file": "...", "line": N, "reason": "..."}
+  ]
+}
+```
+
+## Report
+Return summary:
+- Total findings: N
+- True positives: N
+- False positives: N (with breakdown by reason)
+```
+
+## Variable Substitutions
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `[LANGUAGE_CATEGORY]` | Language group being triaged | Python, JavaScript, Docker |
+| `[OUTPUT_DIR]` | Results directory with run number | semgrep-results-001 |
+
+## Example: Python Triage Task
+
+```
+You are a security finding triager for Python.
+
+## Input Files
+- semgrep-results-001/python-python.json
+- semgrep-results-001/python-django.json
+- semgrep-results-001/python-security-audit.json
+- semgrep-results-001/python-secrets.json
+- semgrep-results-001/python-trailofbits.json
+
+## Output Directory
+semgrep-results-001
+
+## Task
+For each finding:
+1. Read the JSON finding
+2. Read source code context (5 lines before/after)
+3. Classify as TRUE_POSITIVE or FALSE_POSITIVE
+
+## False Positive Criteria
+- Test files (should add to .semgrepignore)
+- Sanitized inputs (context shows validation)
+- Dead code paths
+- Example/documentation code
+- Already has nosemgrep comment
+
+## Output Format
+Create: semgrep-results-001/python-triage.json
+
+```json
+{
+  "file": "python-django.json",
+  "total": 45,
+  "true_positives": [
+    {"rule": "python.django.security.injection.sql-injection", "file": "views.py", "line": 42, "reason": "User input directly in raw SQL query"}
+  ],
+  "false_positives": [
+    {"rule": "python.django.security.injection.sql-injection", "file": "tests/test_views.py", "line": 15, "reason": "Test file with mock data"}
+  ]
+}
+```
+
+## Report
+Return summary:
+- Total findings: 45
+- True positives: 12
+- False positives: 33 (18 test files, 10 sanitized inputs, 5 dead code)
+```
+
+## Triage Decision Tree
+
+```
+Finding
+├── Is it in a test file? → FALSE_POSITIVE (add to .semgrepignore)
+├── Is it in example/docs? → FALSE_POSITIVE
+├── Does it have nosemgrep comment? → FALSE_POSITIVE (already acknowledged)
+├── Is the input sanitized/validated upstream?
+│   └── Check 10-20 lines before for validation → FALSE_POSITIVE if validated
+├── Is the code path reachable?
+│   └── Check if function is called/exported → FALSE_POSITIVE if dead code
+└── None of the above → TRUE_POSITIVE
+```

package/Ai Agent Workflow/skills/semgrep/scripts/merge_triaged_sarif.py

@@ -0,0 +1,252 @@
+# /// script
+# requires-python = ">=3.11"
+# dependencies = []
+# ///
+"""Merge and filter SARIF files to include only triaged true positives.
+
+Usage:
+    uv run merge_triaged_sarif.py OUTPUT_DIR
+
+Reads *-triage.json and *.sarif files from OUTPUT_DIR, produces
+OUTPUT_DIR/findings-triaged.sarif containing only true positives.
+
+Attempts to use SARIF Multitool for merging if available, falls back to
+pure Python implementation.
+"""
+
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+
+def load_true_positives(triage_dir: Path) -> set[tuple[str, str, int]]:
+    """Load true positives from all triage files as (rule_id, file, line) tuples."""
+    true_positives: set[tuple[str, str, int]] = set()
+
+    for triage_file in triage_dir.glob("*-triage.json"):
+        try:
+            data = json.loads(triage_file.read_text())
+        except json.JSONDecodeError as e:
+            print(f"Warning: Failed to parse {triage_file}: {e}", file=sys.stderr)
+            continue
+
+        for tp in data.get("true_positives", []):
+            rule = tp.get("rule", "")
+            file_path = tp.get("file", "")
+            line = tp.get("line", 0)
+            if rule and file_path and line:
+                true_positives.add((rule, file_path, line))
+
+    return true_positives
+
+
+def extract_result_key(result: dict) -> tuple[str, str, int] | None:
+    """Extract (rule_id, file, line) from a SARIF result."""
+    rule_id = result.get("ruleId", "")
+    locations = result.get("locations", [])
+    if not locations:
+        return None
+
+    phys_loc = locations[0].get("physicalLocation", {})
+    artifact_loc = phys_loc.get("artifactLocation", {})
+    uri = artifact_loc.get("uri", "")
+    region = phys_loc.get("region", {})
+    line = region.get("startLine", 0)
+
+    if not (rule_id and uri and line):
+        return None
+
+    return (rule_id, uri, line)
+
+
+def normalize_file_path(uri: str) -> str:
+    """Normalize file path for matching (handle relative vs absolute)."""
+    if uri.startswith("file://"):
+        uri = uri[7:]
+    return uri.lstrip("./")
+
+
+def has_sarif_multitool() -> bool:
+    """Check if SARIF Multitool is pre-installed via npx."""
+    if not shutil.which("npx"):
+        return False
+    try:
+        result = subprocess.run(
+            ["npx", "--no-install", "@microsoft/sarif-multitool", "--version"],
+            capture_output=True,
+            timeout=30,
+        )
+        return result.returncode == 0
+    except (subprocess.TimeoutExpired, OSError):
+        return False
+
+
+def merge_with_multitool(sarif_dir: Path) -> dict | None:
+    """Use SARIF Multitool to merge SARIF files. Returns merged SARIF or None."""
+    sarif_files = list(sarif_dir.glob("*.sarif"))
+    if not sarif_files:
+        return None
+
+    with tempfile.NamedTemporaryFile(suffix=".sarif", delete=False) as tmp:
+        tmp_path = Path(tmp.name)
+
+    try:
+        cmd = [
+            "npx",
+            "--no-install",
+            "@microsoft/sarif-multitool",
+            "merge",
+            *[str(f) for f in sarif_files],
+            "--output-file",
+            str(tmp_path),
+            "--force",
+        ]
+        result = subprocess.run(cmd, capture_output=True, timeout=120)
+        if result.returncode != 0:
+            print(f"SARIF Multitool merge failed: {result.stderr.decode()}", file=sys.stderr)
+            return None
+
+        return json.loads(tmp_path.read_text())
+    except (subprocess.TimeoutExpired, json.JSONDecodeError, OSError) as e:
+        print(f"SARIF Multitool error: {e}", file=sys.stderr)
+        return None
+    finally:
+        tmp_path.unlink(missing_ok=True)
+
+
+def merge_sarif_pure_python(sarif_dir: Path) -> dict:
+    """Pure Python SARIF merge (fallback)."""
+    merged = {
+        "version": "2.1.0",
+        "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+        "runs": [],
+    }
+
+    seen_rules: dict[str, dict] = {}
+    all_results: list[dict] = []
+    tool_info: dict | None = None
+
+    for sarif_file in sarif_dir.glob("*.sarif"):
+        try:
+            data = json.loads(sarif_file.read_text())
+        except json.JSONDecodeError as e:
+            print(f"Warning: Failed to parse {sarif_file}: {e}", file=sys.stderr)
+            continue
+
+        for run in data.get("runs", []):
+            if tool_info is None and run.get("tool"):
+                tool_info = run["tool"]
+
+            driver = run.get("tool", {}).get("driver", {})
+            for rule in driver.get("rules", []):
+                rule_id = rule.get("id", "")
+                if rule_id and rule_id not in seen_rules:
+                    seen_rules[rule_id] = rule
+
+            all_results.extend(run.get("results", []))
+
+    if all_results:
+        merged_run = {
+            "tool": tool_info or {"driver": {"name": "semgrep", "rules": []}},
+            "results": all_results,
+        }
+        merged_run["tool"]["driver"]["rules"] = list(seen_rules.values())
+        merged["runs"].append(merged_run)
+
+    return merged
+
+
+def filter_sarif_by_triage(sarif: dict, true_positives: set[tuple[str, str, int]]) -> dict:
+    """Filter SARIF results to include only triaged true positives."""
+    normalized_tps: set[tuple[str, str, int]] = set()
+    for rule, file_path, line in true_positives:
+        normalized_tps.add((rule, normalize_file_path(file_path), line))
+
+    filtered = {
+        "version": sarif.get("version", "2.1.0"),
+        "$schema": sarif.get("$schema", "https://json.schemastore.org/sarif-2.1.0.json"),
+        "runs": [],
+    }
+
+    for run in sarif.get("runs", []):
+        filtered_results = []
+        for result in run.get("results", []):
+            key = extract_result_key(result)
+            if key is None:
+                continue
+
+            rule_id, uri, line = key
+            normalized_key = (rule_id, normalize_file_path(uri), line)
+
+            if normalized_key in normalized_tps:
+                filtered_results.append(result)
+
+        if filtered_results:
+            result_rule_ids = {r.get("ruleId") for r in filtered_results}
+            driver = run.get("tool", {}).get("driver", {})
+            filtered_rules = [r for r in driver.get("rules", []) if r.get("id") in result_rule_ids]
+
+            filtered_run = {
+                "tool": {
+                    "driver": {
+                        **driver,
+                        "rules": filtered_rules,
+                    }
+                },
+                "results": filtered_results,
+            }
+            filtered["runs"].append(filtered_run)
+
+    return filtered
+
+
+def main() -> int:
+    if len(sys.argv) != 2:
+        print(f"Usage: {sys.argv[0]} OUTPUT_DIR", file=sys.stderr)
+        return 1
+
+    output_dir = Path(sys.argv[1])
+    if not output_dir.is_dir():
+        print(f"Error: {output_dir} is not a directory", file=sys.stderr)
+        return 1
+
+    # Load true positives from triage files
+    true_positives = load_true_positives(output_dir)
+    if not true_positives:
+        print("Warning: No true positives found in triage files", file=sys.stderr)
+
+    print(f"Found {len(true_positives)} true positives from triage")
+
+    # Try SARIF Multitool first, fall back to pure Python
+    merged: dict | None = None
+    if has_sarif_multitool():
+        print("Using SARIF Multitool for merge...")
+        merged = merge_with_multitool(output_dir)
+        if merged:
+            print("SARIF Multitool merge successful")
+
+    if merged is None:
+        print("Using pure Python merge (SARIF Multitool not available or failed)")
+        merged = merge_sarif_pure_python(output_dir)
+
+    # Filter to true positives only
+    filtered = filter_sarif_by_triage(merged, true_positives)
+
+    result_count = sum(len(run.get("results", [])) for run in filtered.get("runs", []))
+    print(f"Filtered SARIF contains {result_count} true positives")
+
+    # Write output
+    output_file = output_dir / "findings-triaged.sarif"
+    output_file.write_text(json.dumps(filtered, indent=2))
+    print(f"Written to {output_file}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/Ai Agent Workflow/skills/sentry-automation/SKILL.md

@@ -0,0 +1,232 @@
+---
+name: sentry-automation
+description: "Automate Sentry tasks via Rube MCP (Composio): manage issues/events, configure alerts, track releases, monitor projects and teams. Always search tools first for current schemas."
+requires:
+  mcp: [rube]
+---
+
+# Sentry Automation via Rube MCP
+
+Automate Sentry error tracking and monitoring operations through Composio's Sentry toolkit via Rube MCP.
+
+## Prerequisites
+
+- Rube MCP must be connected (RUBE_SEARCH_TOOLS available)
+- Active Sentry connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `sentry`
+- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas
+
+## Setup
+
+**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API keys needed — just add the endpoint and it works.
+
+
+1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds
+2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `sentry`
+3. If connection is not ACTIVE, follow the returned auth link to complete Sentry OAuth
+4. Confirm connection status shows ACTIVE before running any workflows
+
+## Core Workflows
+
+### 1. Investigate Issues
+
+**When to use**: User wants to find, inspect, or triage error issues
+
+**Tool sequence**:
+1. `SENTRY_LIST_AN_ORGANIZATIONS_ISSUES` - List issues across the organization [Required]
+2. `SENTRY_GET_ORGANIZATION_ISSUE_DETAILS` - Get detailed info on a specific issue [Optional]
+3. `SENTRY_LIST_AN_ISSUES_EVENTS` - View individual error events for an issue [Optional]
+4. `SENTRY_RETRIEVE_AN_ISSUE_EVENT` - Get full event details with stack trace [Optional]
+5. `SENTRY_RETRIEVE_ISSUE_TAG_DETAILS` - Inspect tag distribution for an issue [Optional]
+
+**Key parameters**:
+- `organization_id_or_slug`: Organization identifier
+- `issue_id`: Numeric issue ID
+- `query`: Search query (e.g., `is:unresolved`, `assigned:me`, `browser:Chrome`)
+- `sort`: Sort order (`date`, `new`, `freq`, `priority`)
+- `statsPeriod`: Time window for stats (`24h`, `14d`, etc.)
+
+**Pitfalls**:
+- `organization_id_or_slug` is the org slug (e.g., 'my-org'), not the display name
+- Issue IDs are numeric; do not confuse with event IDs which are UUIDs
+- Query syntax uses Sentry's search format: `is:unresolved`, `assigned:me`, `!has:release`
+- Events within an issue can have different stack traces; inspect individual events for details
+
+### 2. Manage Project Issues
+
+**When to use**: User wants to view issues scoped to a specific project
+
+**Tool sequence**:
+1. `SENTRY_RETRIEVE_ORGANIZATION_PROJECTS` - List projects to find project slug [Prerequisite]
+2. `SENTRY_RETRIEVE_PROJECT_ISSUES_LIST` - List issues for a specific project [Required]
+3. `SENTRY_RETRIEVE_ISSUE_EVENTS_BY_ID` - Get events for a specific issue [Optional]
+
+**Key parameters**:
+- `organization_id_or_slug`: Organization identifier
+- `project_id_or_slug`: Project identifier
+- `query`: Search filter string
+- `statsPeriod`: Stats time window
+
+**Pitfalls**:
+- Project slugs are different from project display names
+- Always resolve project names to slugs via RETRIEVE_ORGANIZATION_PROJECTS first
+- Project-scoped issue lists may have different pagination than org-scoped lists
+
+### 3. Configure Alert Rules
+
+**When to use**: User wants to create or manage alert rules for a project
+
+**Tool sequence**:
+1. `SENTRY_RETRIEVE_ORGANIZATION_PROJECTS` - Find project for the alert [Prerequisite]
+2. `SENTRY_RETRIEVE_PROJECT_RULES_BY_ORG_AND_PROJECT_ID` - List existing rules [Optional]
+3. `SENTRY_CREATE_PROJECT_RULE_FOR_ALERTS` - Create a new alert rule [Required]
+4. `SENTRY_CREATE_ORGANIZATION_ALERT_RULE` - Create org-level metric alert [Alternative]
+5. `SENTRY_UPDATE_ORGANIZATION_ALERT_RULES` - Update existing alert rules [Optional]
+6. `SENTRY_RETRIEVE_ALERT_RULE_DETAILS` - Inspect specific alert rule [Optional]
+7. `SENTRY_GET_PROJECT_RULE_DETAILS` - Get project-level rule details [Optional]
+
+**Key parameters**:
+- `name`: Alert rule name
+- `conditions`: Array of trigger conditions
+- `actions`: Array of actions to perform when triggered
+- `filters`: Array of event filters
+- `frequency`: How often to trigger (in minutes)
+- `actionMatch`: 'all', 'any', or 'none' for condition matching
+
+**Pitfalls**:
+- Project-level rules (CREATE_PROJECT_RULE) and org-level metric alerts (CREATE_ORGANIZATION_ALERT_RULE) are different
+- Conditions, actions, and filters use specific JSON schemas; check Sentry docs for valid types
+- `frequency` is in minutes; setting too low causes alert fatigue
+- `actionMatch` defaults may vary; explicitly set to avoid unexpected behavior
+
+### 4. Manage Releases
+
+**When to use**: User wants to create, track, or manage release versions
+
+**Tool sequence**:
+1. `SENTRY_LIST_ORGANIZATION_RELEASES` - List existing releases [Optional]
+2. `SENTRY_CREATE_RELEASE_FOR_ORGANIZATION` - Create a new release [Required]
+3. `SENTRY_UPDATE_RELEASE_DETAILS_FOR_ORGANIZATION` - Update release metadata [Optional]
+4. `SENTRY_CREATE_RELEASE_DEPLOY_FOR_ORG` - Record a deployment for a release [Optional]
+5. `SENTRY_UPLOAD_RELEASE_FILE_TO_ORGANIZATION` - Upload source maps or files [Optional]
+
+**Key parameters**:
+- `version`: Release version string (e.g., '1.0.0', commit SHA)
+- `projects`: Array of project slugs this release belongs to
+- `dateReleased`: Release timestamp (ISO 8601)
+- `environment`: Deployment environment name (e.g., 'production', 'staging')
+
+**Pitfalls**:
+- Release versions must be unique within an organization
+- Releases can span multiple projects; use the `projects` array
+- Deploying a release is separate from creating it; use CREATE_RELEASE_DEPLOY
+- Source map uploads require the release to exist first
+
+### 5. Monitor Organization and Teams
+
+**When to use**: User wants to view org structure, teams, or member lists
+
+**Tool sequence**:
+1. `SENTRY_GET_ORGANIZATION_DETAILS` or `SENTRY_GET_ORGANIZATION_BY_ID_OR_SLUG` - Get org info [Required]
+2. `SENTRY_LIST_TEAMS_IN_ORGANIZATION` - List all teams [Optional]
+3. `SENTRY_LIST_ORGANIZATION_MEMBERS` - List org members [Optional]
+4. `SENTRY_GET_PROJECT_LIST` - List all accessible projects [Optional]
+
+**Key parameters**:
+- `organization_id_or_slug`: Organization identifier
+- `cursor`: Pagination cursor for large result sets
+
+**Pitfalls**:
+- Organization slugs are URL-safe identifiers, not display names
+- Member lists may be paginated; follow cursor pagination
+- Team and member visibility depends on the authenticated user's permissions
+
+### 6. Manage Monitors (Cron Monitoring)
+
+**When to use**: User wants to update cron job monitoring configuration
+
+**Tool sequence**:
+1. `SENTRY_UPDATE_A_MONITOR` - Update monitor configuration [Required]
+
+**Key parameters**:
+- `organization_id_or_slug`: Organization identifier
+- `monitor_id_or_slug`: Monitor identifier
+- `name`: Monitor display name
+- `schedule`: Cron schedule expression or interval
+- `checkin_margin`: Grace period in minutes for late check-ins
+- `max_runtime`: Maximum expected runtime in minutes
+
+**Pitfalls**:
+- Monitor slugs are auto-generated from the name; use slug for API calls
+- Schedule changes take effect immediately
+- Missing check-ins trigger alerts after the margin period
+
+## Common Patterns
+
+### ID Resolution
+
+**Organization name -> Slug**:
+```
+1. Call SENTRY_GET_ORGANIZATION_DETAILS
+2. Extract slug field from response
+```
+
+**Project name -> Slug**:
+```
+1. Call SENTRY_RETRIEVE_ORGANIZATION_PROJECTS
+2. Find project by name, extract slug
+```
+
+### Pagination
+
+- Sentry uses cursor-based pagination with `Link` headers
+- Check response for cursor values
+- Pass cursor in next request until no more pages
+
+### Search Query Syntax
+
+- `is:unresolved` - Unresolved issues
+- `is:resolved` - Resolved issues
+- `assigned:me` - Assigned to current user
+- `assigned:team-slug` - Assigned to a team
+- `!has:release` - Issues without a release
+- `first-release:1.0.0` - Issues first seen in release
+- `times-seen:>100` - Seen more than 100 times
+- `browser:Chrome` - Filter by browser tag
+
+## Known Pitfalls
+
+**ID Formats**:
+- Organization: use slug (e.g., 'my-org'), not display name
+- Project: use slug (e.g., 'my-project'), not display name
+- Issue IDs: numeric integers
+- Event IDs: UUIDs (32-char hex strings)
+
+**Permissions**:
+- API token scopes must match the operations being performed
+- Organization-level operations require org-level permissions
+- Project-level operations require project access
+
+**Rate Limits**:
+- Sentry enforces per-organization rate limits
+- Implement backoff on 429 responses
+- Bulk operations should be staggered
+
+## Quick Reference
+
+| Task | Tool Slug | Key Params |
+|------|-----------|------------|
+| List org issues | SENTRY_LIST_AN_ORGANIZATIONS_ISSUES | organization_id_or_slug, query |
+| Get issue details | SENTRY_GET_ORGANIZATION_ISSUE_DETAILS | organization_id_or_slug, issue_id |
+| List issue events | SENTRY_LIST_AN_ISSUES_EVENTS | issue_id |
+| Get event details | SENTRY_RETRIEVE_AN_ISSUE_EVENT | organization_id_or_slug, event_id |
+| List project issues | SENTRY_RETRIEVE_PROJECT_ISSUES_LIST | organization_id_or_slug, project_id_or_slug |
+| List projects | SENTRY_RETRIEVE_ORGANIZATION_PROJECTS | organization_id_or_slug |
+| Get org details | SENTRY_GET_ORGANIZATION_DETAILS | organization_id_or_slug |
+| List teams | SENTRY_LIST_TEAMS_IN_ORGANIZATION | organization_id_or_slug |
+| List members | SENTRY_LIST_ORGANIZATION_MEMBERS | organization_id_or_slug |
+| Create alert rule | SENTRY_CREATE_PROJECT_RULE_FOR_ALERTS | organization_id_or_slug, project_id_or_slug |
+| Create metric alert | SENTRY_CREATE_ORGANIZATION_ALERT_RULE | organization_id_or_slug |
+| Create release | SENTRY_CREATE_RELEASE_FOR_ORGANIZATION | organization_id_or_slug, version |
+| Deploy release | SENTRY_CREATE_RELEASE_DEPLOY_FOR_ORG | organization_id_or_slug, version |
+| List releases | SENTRY_LIST_ORGANIZATION_RELEASES | organization_id_or_slug |
+| Update monitor | SENTRY_UPDATE_A_MONITOR | organization_id_or_slug, monitor_id_or_slug |