@sentry/warden 0.0.0

package/src/diff/parser.ts

@@ -0,0 +1,149 @@
+/**
+ * Unified diff parser - extracts hunks from patch strings
+ */
+
+export interface DiffHunk {
+  /** Original file start line */
+  oldStart: number;
+  /** Original file line count */
+  oldCount: number;
+  /** New file start line */
+  newStart: number;
+  /** New file line count */
+  newCount: number;
+  /** Optional header (function/class name) */
+  header?: string;
+  /** The raw hunk content including the @@ line */
+  content: string;
+  /** Just the changed lines (without @@ header) */
+  lines: string[];
+}
+
+export interface ParsedDiff {
+  /** File path */
+  filename: string;
+  /** File status */
+  status: 'added' | 'removed' | 'modified' | 'renamed';
+  /** Individual hunks in this file */
+  hunks: DiffHunk[];
+  /** The full patch string */
+  rawPatch: string;
+}
+
+/**
+ * Parse a unified diff hunk header.
+ * Format: @@ -oldStart,oldCount +newStart,newCount @@ optional header
+ */
+function parseHunkHeader(line: string): Omit<DiffHunk, 'content' | 'lines'> | null {
+  const match = line.match(/^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(.*)$/);
+  if (!match || !match[1] || !match[3]) return null;
+
+  return {
+    oldStart: parseInt(match[1], 10),
+    oldCount: parseInt(match[2] ?? '1', 10),
+    newStart: parseInt(match[3], 10),
+    newCount: parseInt(match[4] ?? '1', 10),
+    header: match[5]?.trim() || undefined,
+  };
+}
+
+/** Intermediate hunk structure for parsing */
+interface HunkBuilder {
+  oldStart: number;
+  oldCount: number;
+  newStart: number;
+  newCount: number;
+  header?: string;
+  contentParts: string[];
+  lines: string[];
+}
+
+/**
+ * Parse a unified diff patch into hunks.
+ */
+export function parsePatch(patch: string): DiffHunk[] {
+  const lines = patch.split('\n');
+  const hunks: DiffHunk[] = [];
+  let currentHunk: HunkBuilder | null = null;
+
+  for (const line of lines) {
+    const header = parseHunkHeader(line);
+
+    if (header) {
+      // Save previous hunk if exists
+      if (currentHunk) {
+        hunks.push({
+          ...currentHunk,
+          content: currentHunk.contentParts.join('\n'),
+        });
+      }
+
+      // Start new hunk with array-based content builder
+      currentHunk = {
+        ...header,
+        contentParts: [line],
+        lines: [],
+      };
+    } else if (currentHunk) {
+      // Add line to current hunk (skip diff metadata lines)
+      if (!line.startsWith('diff --git') &&
+          !line.startsWith('index ') &&
+          !line.startsWith('--- ') &&
+          !line.startsWith('+++ ') &&
+          !line.startsWith('\\ No newline')) {
+        currentHunk.contentParts.push(line);
+        currentHunk.lines.push(line);
+      }
+    }
+  }
+
+  // Don't forget the last hunk
+  if (currentHunk) {
+    hunks.push({
+      ...currentHunk,
+      content: currentHunk.contentParts.join('\n'),
+    });
+  }
+
+  return hunks;
+}
+
+/**
+ * Parse a file's patch into a structured diff object.
+ */
+export function parseFileDiff(
+  filename: string,
+  patch: string,
+  status: 'added' | 'removed' | 'modified' | 'renamed' = 'modified'
+): ParsedDiff {
+  return {
+    filename,
+    status,
+    hunks: parsePatch(patch),
+    rawPatch: patch,
+  };
+}
+
+/**
+ * Get the line range covered by a hunk (in the new file).
+ */
+export function getHunkLineRange(hunk: DiffHunk): { start: number; end: number } {
+  return {
+    start: hunk.newStart,
+    end: hunk.newStart + hunk.newCount - 1,
+  };
+}
+
+/**
+ * Get an expanded line range for context.
+ */
+export function getExpandedLineRange(
+  hunk: DiffHunk,
+  contextLines = 20
+): { start: number; end: number } {
+  const range = getHunkLineRange(hunk);
+  return {
+    start: Math.max(1, range.start - contextLines),
+    end: range.end + contextLines,
+  };
+}

package/src/event/context.ts

@@ -0,0 +1,132 @@
+import type { Octokit } from '@octokit/rest';
+import { z } from 'zod';
+import {
+  EventContextSchema,
+  type EventContext,
+  type FileChange,
+  type PullRequestContext,
+  type RepositoryContext,
+} from '../types/index.js';
+
+// GitHub Action event payload schemas
+const GitHubUserSchema = z.object({
+  login: z.string(),
+});
+
+const GitHubRepoSchema = z.object({
+  name: z.string(),
+  full_name: z.string(),
+  default_branch: z.string(),
+  owner: GitHubUserSchema,
+});
+
+const GitHubPullRequestSchema = z.object({
+  number: z.number(),
+  title: z.string(),
+  body: z.string().nullable(),
+  user: GitHubUserSchema,
+  base: z.object({
+    ref: z.string(),
+  }),
+  head: z.object({
+    ref: z.string(),
+    sha: z.string(),
+  }),
+});
+
+const GitHubEventPayloadSchema = z.object({
+  action: z.string(),
+  repository: GitHubRepoSchema,
+  pull_request: GitHubPullRequestSchema.optional(),
+});
+
+export class EventContextError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = 'EventContextError';
+  }
+}
+
+export async function buildEventContext(
+  eventName: string,
+  eventPayload: unknown,
+  repoPath: string,
+  octokit: Octokit
+): Promise<EventContext> {
+  const payloadResult = GitHubEventPayloadSchema.safeParse(eventPayload);
+  if (!payloadResult.success) {
+    throw new EventContextError('Invalid event payload', { cause: payloadResult.error });
+  }
+
+  const payload = payloadResult.data;
+
+  const repository: RepositoryContext = {
+    owner: payload.repository.owner.login,
+    name: payload.repository.name,
+    fullName: payload.repository.full_name,
+    defaultBranch: payload.repository.default_branch,
+  };
+
+  let pullRequest: PullRequestContext | undefined;
+
+  if (eventName === 'pull_request' && payload.pull_request) {
+    const pr = payload.pull_request;
+
+    // Fetch files changed in the PR
+    const files = await fetchPullRequestFiles(
+      octokit,
+      repository.owner,
+      repository.name,
+      pr.number
+    );
+
+    pullRequest = {
+      number: pr.number,
+      title: pr.title,
+      body: pr.body,
+      author: pr.user.login,
+      baseBranch: pr.base.ref,
+      headBranch: pr.head.ref,
+      headSha: pr.head.sha,
+      files,
+    };
+  }
+
+  const context: EventContext = {
+    eventType: eventName as EventContext['eventType'],
+    action: payload.action,
+    repository,
+    pullRequest,
+    repoPath,
+  };
+
+  // Validate the final context
+  const result = EventContextSchema.safeParse(context);
+  if (!result.success) {
+    throw new EventContextError('Failed to build valid event context', { cause: result.error });
+  }
+
+  return result.data;
+}
+
+async function fetchPullRequestFiles(
+  octokit: Octokit,
+  owner: string,
+  repo: string,
+  pullNumber: number
+): Promise<FileChange[]> {
+  const { data: files } = await octokit.pulls.listFiles({
+    owner,
+    repo,
+    pull_number: pullNumber,
+    per_page: 100,
+  });
+
+  return files.map((file) => ({
+    filename: file.filename,
+    status: file.status as FileChange['status'],
+    additions: file.additions,
+    deletions: file.deletions,
+    patch: file.patch,
+  }));
+}

package/src/event/index.ts

@@ -0,0 +1,2 @@
+export * from './context.js';
+export * from './schedule-context.js';

package/src/event/schedule-context.ts

@@ -0,0 +1,101 @@
+import type { EventContext, FileChange } from '../types/index.js';
+import { expandAndCreateFileChanges } from '../cli/files.js';
+import { matchGlob } from '../triggers/matcher.js';
+
+export interface ScheduleContextOptions {
+  /** Glob patterns from trigger's filters.paths */
+  patterns: string[];
+  /** Glob patterns from trigger's filters.ignorePaths */
+  ignorePatterns?: string[];
+  /** Repository root path (GITHUB_WORKSPACE) */
+  repoPath: string;
+  /** Repository owner (from GITHUB_REPOSITORY) */
+  owner: string;
+  /** Repository name */
+  name: string;
+  /** Default branch name */
+  defaultBranch: string;
+  /** Current commit SHA */
+  headSha: string;
+}
+
+/**
+ * Build an EventContext for scheduled runs.
+ *
+ * Creates a synthetic pullRequest context from file globs using real repo info.
+ * The runner processes this normally because the files have patch data.
+ */
+export async function buildScheduleEventContext(
+  options: ScheduleContextOptions
+): Promise<EventContext> {
+  const {
+    patterns,
+    ignorePatterns,
+    repoPath,
+    owner,
+    name,
+    defaultBranch,
+    headSha,
+  } = options;
+
+  // Expand glob patterns and create FileChange objects with full content as patch
+  let fileChanges = await expandAndCreateFileChanges(patterns, repoPath);
+
+  // Filter out ignored patterns
+  if (ignorePatterns && ignorePatterns.length > 0) {
+    fileChanges = fileChanges.filter((file) => {
+      const isIgnored = ignorePatterns.some((pattern) =>
+        matchGlob(pattern, file.filename)
+      );
+      return !isIgnored;
+    });
+  }
+
+  return {
+    eventType: 'schedule',
+    action: 'scheduled',
+    repository: {
+      owner,
+      name,
+      fullName: `${owner}/${name}`,
+      defaultBranch,
+    },
+    // Synthetic pullRequest context for runner compatibility
+    pullRequest: {
+      number: 0, // No actual PR
+      title: 'Scheduled Analysis',
+      body: null,
+      author: 'warden',
+      baseBranch: defaultBranch,
+      headBranch: defaultBranch,
+      headSha,
+      files: fileChanges,
+    },
+    repoPath,
+  };
+}
+
+/**
+ * Filter file changes to only include files matching the given patterns.
+ * Used when a schedule trigger has specific path filters.
+ */
+export function filterFilesByPatterns(
+  files: FileChange[],
+  patterns: string[],
+  ignorePatterns?: string[]
+): FileChange[] {
+  let filtered = files.filter((file) =>
+    patterns.some((pattern) => matchGlob(pattern, file.filename))
+  );
+
+  if (ignorePatterns && ignorePatterns.length > 0) {
+    filtered = filtered.filter((file) => {
+      const isIgnored = ignorePatterns.some((pattern) =>
+        matchGlob(pattern, file.filename)
+      );
+      return !isIgnored;
+    });
+  }
+
+  return filtered;
+}

package/src/examples/examples.integration.test.ts

@@ -0,0 +1,66 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import { discoverExamples, loadExample, getExampleFiles } from './index.js';
+import { runSkill } from '../sdk/runner.js';
+import { buildFileEventContext } from '../cli/context.js';
+import { resolveSkillAsync } from '../skills/loader.js';
+
+describe('examples', () => {
+  const apiKey = process.env['WARDEN_ANTHROPIC_API_KEY'] ?? process.env['ANTHROPIC_API_KEY'];
+
+  beforeAll(() => {
+    if (!apiKey) {
+      throw new Error('ANTHROPIC_API_KEY (or WARDEN_ANTHROPIC_API_KEY) required for integration tests');
+    }
+  });
+
+  const examples = discoverExamples();
+
+  if (examples.length === 0) {
+    it.skip('no examples found', () => {
+      // Placeholder for when no examples exist
+    });
+  }
+
+  for (const exampleDir of examples) {
+    const meta = loadExample(exampleDir);
+    // Create a readable name from the path (e.g., "security-review/sql-injection")
+    const name = exampleDir.split('/').slice(-2).join('/');
+
+    it(`${name}: ${meta.description}`, { timeout: 60000 }, async () => {
+        const files = getExampleFiles(exampleDir);
+        const context = await buildFileEventContext({
+          patterns: files,
+          cwd: exampleDir,
+        });
+
+        const skill = await resolveSkillAsync(meta.skill);
+        const report = await runSkill(skill, context, { apiKey });
+
+        // Validate each expected finding
+        for (const expected of meta.expected) {
+          const pattern = new RegExp(expected.pattern, 'i');
+          const found = report.findings.some((f) => {
+            // Check severity matches
+            if (f.severity !== expected.severity) return false;
+
+            // Check pattern matches title or description
+            const text = `${f.title} ${f.description}`;
+            if (!pattern.test(text)) return false;
+
+            // If file specified, check location matches
+            if (expected.file && f.location) {
+              if (!f.location.path.endsWith(expected.file)) return false;
+            }
+
+            return true;
+          });
+
+          expect(
+            found,
+            `Expected ${expected.severity} finding matching "${expected.pattern}"${expected.file ? ` in ${expected.file}` : ''}. ` +
+              `Got ${report.findings.length} findings: ${report.findings.map((f) => `[${f.severity}] ${f.title}`).join(', ') || 'none'}`
+          ).toBe(true);
+        }
+    }); // LLM calls can be slow
+  }
+});

package/src/examples/index.test.ts

@@ -0,0 +1,101 @@
+import { describe, it, expect } from 'vitest';
+import { join } from 'node:path';
+import { discoverExamples, loadExample, getExampleFiles, ExampleMetaSchema } from './index.js';
+
+const examplesDir = join(import.meta.dirname, '..', '..', 'examples');
+
+describe('discoverExamples', () => {
+  it('returns array of example directories', () => {
+    const examples = discoverExamples(examplesDir);
+
+    // All discovered paths should contain _meta.json
+    for (const dir of examples) {
+      expect(dir).toContain('examples');
+    }
+  });
+
+  it('returns empty array for non-existent directory', () => {
+    const examples = discoverExamples('/non/existent/path');
+    expect(examples).toEqual([]);
+  });
+});
+
+describe('loadExample', () => {
+  it('loads and validates _meta.json', () => {
+    const examples = discoverExamples(examplesDir);
+    if (examples.length === 0) {
+      // Skip test when no examples exist
+      return;
+    }
+
+    const meta = loadExample(examples[0]!);
+    expect(meta).toHaveProperty('skill');
+    expect(meta).toHaveProperty('description');
+    expect(meta).toHaveProperty('expected');
+    expect(Array.isArray(meta.expected)).toBe(true);
+  });
+
+  it('throws for missing _meta.json', () => {
+    expect(() => loadExample('/non/existent')).toThrow('No _meta.json found');
+  });
+});
+
+describe('getExampleFiles', () => {
+  it('returns source files excluding _meta.json', () => {
+    const examples = discoverExamples(examplesDir);
+    if (examples.length === 0) {
+      // Skip test when no examples exist
+      return;
+    }
+
+    const files = getExampleFiles(examples[0]!);
+    expect(files.length).toBeGreaterThan(0);
+
+    // None of the files should be _meta.json
+    for (const file of files) {
+      expect(file).not.toContain('_meta.json');
+    }
+  });
+});
+
+describe('ExampleMetaSchema', () => {
+  it('validates correct _meta.json', () => {
+    const valid = {
+      skill: 'security-review',
+      description: 'Test example',
+      expected: [{ severity: 'critical', pattern: 'test' }],
+    };
+    const result = ExampleMetaSchema.safeParse(valid);
+    expect(result.success).toBe(true);
+  });
+
+  it('validates with optional file field', () => {
+    const valid = {
+      skill: 'security-review',
+      description: 'Test example',
+      expected: [{ severity: 'high', pattern: 'test', file: 'test.ts' }],
+    };
+    const result = ExampleMetaSchema.safeParse(valid);
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects invalid severity', () => {
+    const invalid = {
+      skill: 'security-review',
+      description: 'Test example',
+      expected: [{ severity: 'invalid', pattern: 'test' }],
+    };
+    const result = ExampleMetaSchema.safeParse(invalid);
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects missing required fields', () => {
+    const invalid = {
+      skill: 'security-review',
+      // missing description
+      expected: [],
+    };
+    const result = ExampleMetaSchema.safeParse(invalid);
+    expect(result.success).toBe(false);
+  });
+});

package/src/examples/index.ts

@@ -0,0 +1,122 @@
+import { readFileSync, readdirSync, existsSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { SeveritySchema } from '../types/index.js';
+
+/**
+ * Schema for expected findings in _meta.json
+ */
+export const ExpectedFindingSchema = z.object({
+  severity: SeveritySchema,
+  pattern: z.string(),
+  file: z.string().optional(),
+});
+export type ExpectedFinding = z.infer<typeof ExpectedFindingSchema>;
+
+/**
+ * Schema for _meta.json files
+ */
+export const ExampleMetaSchema = z.object({
+  skill: z.string(),
+  description: z.string(),
+  expected: z.array(ExpectedFindingSchema),
+});
+export type ExampleMeta = z.infer<typeof ExampleMetaSchema>;
+
+/**
+ * Get the default examples directory path.
+ */
+function getExamplesDir(): string {
+  // This file is at src/examples/index.ts, so we need to go up to repo root
+  return join(import.meta.dirname, '..', '..', 'examples');
+}
+
+/**
+ * Discover all examples with _meta.json files.
+ * Returns an array of absolute paths to example directories.
+ */
+export function discoverExamples(baseDir?: string): string[] {
+  const examplesDir = baseDir ?? getExamplesDir();
+  const examples: string[] = [];
+
+  if (!existsSync(examplesDir)) {
+    return examples;
+  }
+
+  // Recursively find directories containing _meta.json
+  function scanDir(dir: string): void {
+    const entries = readdirSync(dir);
+
+    for (const entry of entries) {
+      const entryPath = join(dir, entry);
+      const stat = statSync(entryPath);
+
+      if (stat.isDirectory()) {
+        const metaPath = join(entryPath, '_meta.json');
+        if (existsSync(metaPath)) {
+          examples.push(entryPath);
+        }
+        // Continue scanning subdirectories
+        scanDir(entryPath);
+      }
+    }
+  }
+
+  scanDir(examplesDir);
+  return examples;
+}
+
+/**
+ * Load and validate a _meta.json file from an example directory.
+ */
+export function loadExample(dir: string): ExampleMeta {
+  const metaPath = join(dir, '_meta.json');
+
+  if (!existsSync(metaPath)) {
+    throw new Error(`No _meta.json found in ${dir}`);
+  }
+
+  let content: string;
+  try {
+    content = readFileSync(metaPath, 'utf-8');
+  } catch (error) {
+    throw new Error(`Failed to read ${metaPath}: ${error}`);
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(content);
+  } catch (error) {
+    throw new Error(`Failed to parse ${metaPath}: ${error}`);
+  }
+
+  const validated = ExampleMetaSchema.safeParse(parsed);
+  if (!validated.success) {
+    const issues = validated.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join(', ');
+    throw new Error(`Invalid _meta.json in ${dir}: ${issues}`);
+  }
+
+  return validated.data;
+}
+
+/**
+ * Get all source files in an example directory (excludes _meta.json).
+ * Returns relative paths suitable for use with buildFileEventContext.
+ */
+export function getExampleFiles(dir: string): string[] {
+  const files: string[] = [];
+
+  const entries = readdirSync(dir);
+  for (const entry of entries) {
+    if (entry === '_meta.json') continue;
+
+    const entryPath = join(dir, entry);
+    const stat = statSync(entryPath);
+
+    if (stat.isFile()) {
+      files.push(entryPath);
+    }
+  }
+
+  return files;
+}

package/src/examples/setup.ts

@@ -0,0 +1,25 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { config as dotenvConfig } from 'dotenv';
+
+/**
+ * Load environment variables for integration tests.
+ * Loads in order (later files override earlier):
+ * 1. .env (base config)
+ * 2. .env.local (local overrides)
+ * 3. .env.test (test-specific overrides)
+ */
+function loadTestEnv(): void {
+  const root = join(import.meta.dirname, '..', '..');
+
+  const envFiles = ['.env', '.env.local', '.env.test'];
+
+  for (const file of envFiles) {
+    const path = join(root, file);
+    if (existsSync(path)) {
+      dotenvConfig({ path, override: true });
+    }
+  }
+}
+
+loadTestEnv();