@sentry/warden 0.20.0 → 0.22.0

package/skills/warden-sweep/references/resume-and-artifacts.md

@@ -0,0 +1,51 @@
+# Resume And Artifacts
+
+Use this reference when resuming a partial sweep or inspecting generated files.
+
+## Resume Rules
+
+Each phase is incremental:
+
+1. Check `data/manifest.json` for phase state.
+2. For scan, pass `--sweep-dir` to `scan.py`.
+3. For verify, skip existing `data/verify/<id>.json` files.
+4. For issue, `create_issue.py` skips if `issueUrl` exists in the manifest.
+5. For patch, skip existing entries in `data/patches.jsonl`.
+6. For organize, rerun safely.
+
+Continue from the first incomplete phase. Do not start a new sweep unless the user asks for a clean run.
+
+## Output Directory Structure
+
+```text
+.warden/sweeps/<run-id>/
+  summary.md                        # Stats, key findings, PR links
+  findings/                         # One markdown per verified finding
+    <finding-id>.md
+  security/                         # Security-specific view
+    index.jsonl                     # Security findings index
+    <finding-id>.md                 # Copies of security findings
+  data/                             # Structured data for tooling
+    manifest.json                   # Run metadata, phase state
+    scan-index.jsonl                # Per-file scan tracking
+    all-findings.jsonl              # Every finding from scan
+    verified.jsonl                  # Findings that passed verification
+    rejected.jsonl                  # Findings that failed verification
+    patches.jsonl                   # Finding -> PR URL -> reviewers
+    existing-prs.json               # Cached open Warden PRs
+    report.json                     # Machine-readable summary
+    verify/                         # Individual verification results
+      <finding-id>.json
+    logs/                           # Warden JSONL logs per file
+      <hash>.jsonl
+    pr-diffs/                       # Cached PR diffs for dedup
+      <number>.diff
+```
+
+## Failure Handling
+
+- Preserve partial artifacts.
+- Record per-finding errors in the relevant JSONL file.
+- Distinguish timed-out files from errored files.
+- Clean up worktrees before retrying patch work.
+- Re-run organize after manual recovery to refresh reports.

package/skills/warden-sweep/references/scan-phase.md

@@ -0,0 +1,46 @@
+# Scan Phase
+
+Run Warden across repository files and collect normalized findings.
+
+## Run
+
+```bash
+uv run <skill-root>/scripts/scan.py
+```
+
+To scan only specific files:
+
+```bash
+uv run <skill-root>/scripts/scan.py src/foo.ts src/bar.ts
+```
+
+To resume a partial scan:
+
+```bash
+uv run <skill-root>/scripts/scan.py --sweep-dir .warden/sweeps/<run-id>
+```
+
+## Process
+
+1. Parse the JSON stdout.
+2. Save `runId` and `sweepDir`.
+3. Treat exit code `1` as fatal and stop.
+4. Treat exit code `2` as partial: report timed-out and errored files separately, then continue only if the user accepts the partial results.
+5. Render every finding from the `findings` array.
+6. Update the checklist: Phase 1 complete.
+
+## Report Template
+
+```markdown
+## Scan Complete
+
+Scanned **{filesScanned}** files, **{filesTimedOut}** timed out, **{filesErrored}** errors.
+
+### Findings ({totalFindings} total)
+
+| # | Severity | Skill | File | Title |
+|---|----------|-------|------|-------|
+| 1 | **HIGH** | security-review | `src/db/query.ts:42` | SQL injection in query builder |
+```
+
+Bold severity for high and above.

package/skills/warden-sweep/references/script-interfaces.md

@@ -0,0 +1,127 @@
+# Script Interfaces
+
+Use this reference before running Warden Sweep scripts. Run scripts from the repository root and pass the host skill-root path.
+
+## Contents
+
+- `scan.py`
+- `index_prs.py`
+- `create_issue.py`
+- `organize.py`
+- `extract_findings.py`
+- `generate_report.py`
+- `find_reviewers.py`
+
+## `scripts/scan.py`
+
+Runs setup and scan in one call: generates a run ID, creates the sweep directory, checks dependencies, creates the `warden` label, enumerates files, runs Warden per file, writes `scan-index.jsonl`, and extracts findings.
+
+```bash
+uv run <skill-root>/scripts/scan.py [file ...]
+uv run <skill-root>/scripts/scan.py --sweep-dir .warden/sweeps/<run-id>
+```
+
+Stdout JSON:
+
+```json
+{
+  "runId": "abc123",
+  "sweepDir": ".warden/sweeps/abc123",
+  "filesScanned": 10,
+  "filesTimedOut": 0,
+  "filesErrored": 0,
+  "totalFindings": 3,
+  "findings": []
+}
+```
+
+Exit codes: `0` success, `1` fatal error, `2` partial scan.
+
+## `scripts/index_prs.py`
+
+Fetches open Warden-labeled PRs, builds a file-to-PR dedup index, and caches diffs for overlapping PRs.
+
+```bash
+uv run <skill-root>/scripts/index_prs.py <sweep-dir>
+```
+
+Stdout JSON includes `fileIndex`. Side effects:
+
+- writes `data/existing-prs.json`
+- writes `data/pr-diffs/<number>.diff` for overlapping PRs
+
+## `scripts/create_issue.py`
+
+Creates a GitHub tracking issue summarizing verified sweep results.
+
+```bash
+uv run <skill-root>/scripts/create_issue.py <sweep-dir>
+```
+
+Stdout JSON:
+
+```json
+{
+  "issueUrl": "https://github.com/owner/repo/issues/123",
+  "issueNumber": 123
+}
+```
+
+Idempotent: skips creation when `issueUrl` already exists in the manifest.
+
+## `scripts/organize.py`
+
+Tags security findings, labels security PRs, updates finding reports with PR links, posts final results to the tracking issue, generates the summary report, and finalizes the manifest.
+
+```bash
+uv run <skill-root>/scripts/organize.py <sweep-dir>
+```
+
+Stdout JSON includes final sweep counts and report paths. Side effects:
+
+- creates `security/index.jsonl`
+- copies security finding reports to `security/`
+- creates or reuses the `security` GitHub label
+- labels security PRs
+- appends PR links to `findings/*.md`
+- writes `summary.md` and `data/report.json`
+- updates `phases.organize` in `data/manifest.json`
+
+## `scripts/extract_findings.py`
+
+Parses Warden JSONL log files and extracts normalized findings. Usually called by `scan.py`.
+
+```bash
+uv run <skill-root>/scripts/extract_findings.py <log-path-or-directory> -o <output.jsonl>
+```
+
+Writes one normalized finding per line to `<output.jsonl>`.
+
+## `scripts/generate_report.py`
+
+Builds `summary.md` and `report.json` from sweep data. Usually called by `organize.py`.
+
+```bash
+uv run <skill-root>/scripts/generate_report.py <sweep-dir>
+```
+
+Side effects:
+
+- writes `<sweep-dir>/summary.md`
+- writes `<sweep-dir>/data/report.json`
+
+## `scripts/find_reviewers.py`
+
+Finds the top two git contributors for a file from the last 12 months.
+
+```bash
+uv run <skill-root>/scripts/find_reviewers.py <file-path>
+```
+
+Stdout JSON:
+
+```json
+{
+  "reviewers": ["user1", "user2"]
+}
+```

package/skills/warden-sweep/references/verify-phase.md

@@ -0,0 +1,69 @@
+# Verify Phase
+
+Deep-trace every finding before patching. This phase qualifies true issues and rejects false positives.
+
+## Input
+
+Read findings from:
+
+```text
+<sweep-dir>/data/all-findings.jsonl
+```
+
+## Process
+
+For each finding:
+
+1. If `data/verify/<finding-id>.json` exists, skip it.
+2. Launch verification work using the host agent's task/delegation mechanism when available. Process findings in parallel batches up to 8 if the host supports parallel work.
+3. Read `references/verify-prompt.md` and substitute the finding values into the `${...}` placeholders.
+4. Parse the returned JSON.
+5. Write the raw result to `data/verify/<finding-id>.json`.
+6. Append verified findings to `data/verified.jsonl`.
+7. Append rejected findings to `data/rejected.jsonl`.
+8. For verified findings, generate `findings/<finding-id>.md`.
+
+If the host does not support delegated tasks, run the same verification prompt serially.
+
+## Verified Finding Report
+
+````markdown
+# ${TITLE}
+
+**ID**: ${FINDING_ID} | **Severity**: ${SEVERITY} | **Confidence**: ${CONFIDENCE}
+**Skill**: ${SKILL} | **File**: ${FILE_PATH}:${START_LINE}
+
+## Description
+${DESCRIPTION}
+
+## Verification
+**Verdict**: Verified (${VERIFICATION_CONFIDENCE})
+**Reasoning**: ${REASONING}
+**Code trace**: ${TRACE_NOTES}
+
+## Suggested Fix
+${FIX_DESCRIPTION}
+```diff
+${FIX_DIFF}
+```
+````
+
+Update the manifest: set `phases.verify` to `"complete"`.
+
+## Report Template
+
+```markdown
+## Verification Complete
+
+**{verified}** verified, **{rejected}** rejected.
+
+### Verified Findings
+
+| # | Severity | Confidence | File | Title | Reasoning |
+|---|----------|------------|------|-------|-----------|
+| 1 | **HIGH** | high | `src/db/query.ts:42` | SQL injection in query builder | User input flows directly into... |
+
+### Rejected ({rejected_count})
+
+- `{findingId}` {file}: {reasoning}
+```

package/dist/cli/commands/logs.d.ts

@@ -1,19 +0,0 @@
-import type { CLIOptions, LogsOptions } from '../args.js';
-import type { Reporter } from '../output/reporter.js';
-/**
- * List all JSONL log files in .warden/logs/.
- */
-export declare function runLogsList(options: CLIOptions, reporter: Reporter): Promise<number>;
-/**
- * Show results from JSONL log files (replaces `warden replay`).
- */
-export declare function runLogsShow(logsOptions: LogsOptions, options: CLIOptions, reporter: Reporter): Promise<number>;
-/**
- * Garbage-collect expired log files.
- */
-export declare function runLogsGc(options: CLIOptions, reporter: Reporter): Promise<number>;
-/**
- * Dispatch to the appropriate logs subcommand.
- */
-export declare function runLogs(logsOptions: LogsOptions, options: CLIOptions, reporter: Reporter): Promise<number>;
-//# sourceMappingURL=logs.d.ts.map

package/dist/cli/commands/logs.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/logs.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAI1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAsHtD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAyL1F;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,CA0GjB;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAyCxF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAC3B,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,CASjB"}