@sentry/warden 0.21.0 → 0.23.0

package/dist/sdk/analyze.js

@@ -1,33 +1,69 @@
-import { query } from '@anthropic-ai/claude-agent-sdk';
 import { getHunkLineRange } from '../diff/index.js';
-import { Sentry, emitExtractionMetrics, emitRetryMetric, emitDedupMetrics, emitFixGateMetrics, logger } from '../sentry.js';
-import { SkillRunnerError, WardenAuthenticationError, isRetryableError, isAuthenticationError, isAuthenticationErrorMessage, isSubprocessError, classifyError, mapExtractionErrorCode } from './errors.js';
+import { Sentry, emitExtractionMetrics, emitRetryMetric } from '../sentry.js';
+import { SkillRunnerError, WardenAuthenticationError, isRetryableError, isAuthenticationError, isAuthenticationErrorMessage, isSubprocessError, classifyError, mapExtractionErrorCode, sanitizeErrorMessage } from './errors.js';
 import { DEFAULT_RETRY_CONFIG, calculateRetryDelay, sleep } from './retry.js';
-import { extractUsage, aggregateUsage, emptyUsage, estimateTokens, aggregateAuxiliaryUsage } from './usage.js';
+import { aggregateUsage, emptyUsage, estimateTokens, aggregateAuxiliaryUsage } from './usage.js';
 import { buildHunkSystemPrompt, buildHunkUserPrompt } from './prompt.js';
-import { extractFindingsJson, extractFindingsWithLLM, validateFindings, deduplicateFindings, mergeCrossLocationFindings } from './extract.js';
-import { sanitizeFindingsSuggestedFixes } from './fix-quality.js';
+import { extractFindingsJson, extractFindingsWithLLM, validateFindings } from './extract.js';
+import { postProcessFindings } from './post-process.js';
+import { buildFileReports } from './report-files.js';
+import { getRuntime, getRuntimeProviderOptions } from './runtimes/index.js';
 import { LARGE_PROMPT_THRESHOLD_CHARS, DEFAULT_FILE_CONCURRENCY, } from './types.js';
 import { prepareFiles } from './prepare.js';
 import { runPool } from '../utils/index.js';
+function notifyHunkFailed(callbacks, lineRange, message) {
+    if (callbacks) {
+        callbacks.onHunkFailed?.(lineRange, message);
+        return;
+    }
+    console.error(`Hunk analysis failed for ${lineRange}.`);
+}
+function isAbortRequested(error, abortController) {
+    return (abortController?.signal.aborted ?? false) || classifyError(error).code === 'aborted';
+}
+function isCircuitBreakerCode(code) {
+    return code === 'auth_failed' || code === 'provider_unavailable';
+}
+function hunkFailureFromCircuit(reason, usage, attempts) {
+    return {
+        findings: [],
+        usage: aggregateUsage(usage),
+        failed: true,
+        extractionFailed: false,
+        failureCode: reason.code,
+        failureMessage: reason.message,
+        attempts,
+    };
+}
+function recordCircuitFailure(options, code, message) {
+    if (!isCircuitBreakerCode(code))
+        return undefined;
+    options.circuitBreaker?.recordFailure(code, message);
+    return options.circuitBreaker?.reason;
+}
 /**
  * Parse findings from a hunk analysis result.
  * Uses a two-tier extraction strategy:
  * 1. Regex-based extraction (fast, handles well-formed output)
  * 2. LLM fallback using haiku (handles malformed output gracefully)
  */
-async function parseHunkOutput(result, filename, apiKey, auxiliaryMaxRetries) {
-    if (result.subtype !== 'success') {
+async function parseHunkOutput(result, filename, options) {
+    if (result.status !== 'success') {
         // SDK error - not an extraction failure, just no findings
         return { findings: [], extractionFailed: false, extractionMethod: 'none' };
     }
     // Tier 1: Try regex-based extraction first (fast)
-    const extracted = extractFindingsJson(result.result);
+    const extracted = extractFindingsJson(result.text);
     if (extracted.success) {
         return { findings: validateFindings(extracted.findings, filename), extractionFailed: false, extractionMethod: 'regex' };
     }
     // Tier 2: Try LLM fallback for malformed output
-    const fallback = await extractFindingsWithLLM(result.result, apiKey, auxiliaryMaxRetries);
+    const fallback = await extractFindingsWithLLM(result.text, {
+        apiKey: options.apiKey,
+        runtime: options.runtime,
+        model: options.auxiliaryModel,
+        maxRetries: options.auxiliaryMaxRetries,
+    });
     if (fallback.success) {
         return { findings: validateFindings(fallback.findings, filename), extractionFailed: false, extractionMethod: 'llm', extractionUsage: fallback.usage };
     }
@@ -64,201 +100,6 @@ export function filterOutOfRangeFindings(findings, hunkRange) {
     }
     return { filtered, dropped };
 }
-/**
- * Execute a single SDK query attempt.
- * Captures stderr for better error diagnostics when Claude Code fails.
- */
-async function executeQuery(systemPrompt, userPrompt, repoPath, options, skillName) {
-    const { maxTurns = 50, model, abortController, pathToClaudeCodeExecutable } = options;
-    const modelId = model ?? 'unknown';
-    return Sentry.startSpan({
-        op: 'gen_ai.invoke_agent',
-        name: `invoke_agent ${skillName}`,
-        attributes: {
-            'gen_ai.operation.name': 'invoke_agent',
-            'gen_ai.provider.name': 'anthropic',
-            'gen_ai.agent.name': skillName,
-            'gen_ai.request.model': modelId,
-            'warden.request.max_turns': maxTurns,
-        },
-    }, async (span) => {
-        span.setAttribute('gen_ai.request.messages', JSON.stringify([
-            { role: 'system', content: systemPrompt },
-            { role: 'user', content: userPrompt },
-        ]));
-        // Capture stderr output for better error diagnostics
-        const stderrChunks = [];
-        const stream = query({
-            prompt: userPrompt,
-            options: {
-                maxTurns,
-                cwd: repoPath,
-                systemPrompt,
-                // Only allow read-only tools - context is already provided in the prompt
-                allowedTools: ['Read', 'Grep', 'Glob'],
-                // Explicitly block modification/side-effect tools as defense-in-depth
-                disallowedTools: ['Write', 'Edit', 'Bash', 'WebFetch', 'WebSearch', 'Task', 'TodoWrite'],
-                permissionMode: 'bypassPermissions',
-                // Prevent SDK from writing session .jsonl files and polluting Claude Code's session index
-                persistSession: false,
-                model,
-                abortController,
-                pathToClaudeCodeExecutable,
-                stderr: (data) => {
-                    stderrChunks.push(data);
-                },
-            },
-        });
-        let resultMessage;
-        let authError;
-        // Per-turn tracing: buffer assistant messages and tool progress to create
-        // child spans (gen_ai.chat + gen_ai.execute_tool) under the invoke_agent span.
-        // We flush the previous turn when a new assistant message or result arrives,
-        // ensuring tool_progress events are captured before span creation.
-        let turnCount = 0;
-        let pendingTurn = null;
-        const pendingToolProgress = new Map();
-        /** Flush buffered turn data into gen_ai.chat and gen_ai.execute_tool child spans. */
-        function flushPendingTurn() {
-            if (!pendingTurn)
-                return;
-            turnCount++;
-            const turn = pendingTurn;
-            const toolProgress = new Map(pendingToolProgress);
-            pendingTurn = null;
-            pendingToolProgress.clear();
-            try {
-                const totalInput = turn.inputTokens + turn.cacheRead + turn.cacheWrite;
-                Sentry.startSpan({
-                    op: 'gen_ai.chat',
-                    name: `chat ${skillName} turn ${turnCount}`,
-                    attributes: {
-                        'gen_ai.operation.name': 'chat',
-                        'gen_ai.provider.name': 'anthropic',
-                        'gen_ai.agent.name': skillName,
-                        'gen_ai.request.model': modelId,
-                        'gen_ai.response.model': turn.model,
-                        'gen_ai.usage.input_tokens': totalInput,
-                        'gen_ai.usage.output_tokens': turn.outputTokens,
-                        'gen_ai.usage.input_tokens.cached': turn.cacheRead,
-                        'gen_ai.usage.input_tokens.cache_write': turn.cacheWrite,
-                        'gen_ai.usage.total_tokens': totalInput + turn.outputTokens,
-                        'gen_ai.tool_use.count': turn.toolUses.length,
-                    },
-                }, () => {
-                    for (const toolUse of turn.toolUses) {
-                        const elapsed = toolProgress.get(toolUse.id);
-                        Sentry.startSpan({
-                            op: 'gen_ai.execute_tool',
-                            name: toolUse.name,
-                            attributes: {
-                                'gen_ai.tool.name': toolUse.name,
-                                ...(elapsed !== undefined && { 'tool.elapsed_seconds': elapsed }),
-                            },
-                        }, () => { });
-                    }
-                });
-            }
-            catch {
-                // Telemetry should never break the workflow
-            }
-        }
-        try {
-            for await (const message of stream) {
-                if (message.type === 'assistant') {
-                    flushPendingTurn();
-                    const msg = message.message;
-                    const toolUses = msg.content
-                        .filter((block) => block.type === 'tool_use')
-                        .map(({ id, name }) => ({ id, name }));
-                    pendingTurn = {
-                        toolUses,
-                        inputTokens: msg.usage?.input_tokens ?? 0,
-                        outputTokens: msg.usage?.output_tokens ?? 0,
-                        cacheRead: msg.usage?.cache_read_input_tokens ?? 0,
-                        cacheWrite: msg.usage?.cache_creation_input_tokens ?? 0,
-                        model: msg.model,
-                    };
-                }
-                else if (message.type === 'tool_progress') {
-                    pendingToolProgress.set(message.tool_use_id, message.elapsed_time_seconds);
-                }
-                else if (message.type === 'result') {
-                    flushPendingTurn();
-                    resultMessage = message;
-                }
-                else if (message.type === 'auth_status' && message.error) {
-                    authError = message.error;
-                }
-            }
-        }
-        catch (error) {
-            // Re-throw with stderr info if available
-            const stderr = stderrChunks.join('').trim();
-            if (stderr) {
-                const originalMessage = error instanceof Error ? error.message : String(error);
-                const enhancedError = new Error(`${originalMessage}\nClaude Code stderr: ${stderr}`);
-                enhancedError.cause = error;
-                throw enhancedError;
-            }
-            throw error;
-        }
-        finally {
-            // Flush any pending turn data for trace completeness
-            flushPendingTurn();
-        }
-        // Set response attributes from SDK result
-        if (resultMessage) {
-            const usage = resultMessage.usage;
-            if (usage) {
-                const inputTokens = usage.input_tokens ?? 0;
-                const outputTokens = usage.output_tokens ?? 0;
-                const cacheRead = usage.cache_read_input_tokens ?? 0;
-                const cacheWrite = usage.cache_creation_input_tokens ?? 0;
-                // Anthropic API's input_tokens is only the non-cached portion.
-                // OpenTelemetry gen_ai.usage.input_tokens expects the total input tokens.
-                const totalInputTokens = inputTokens + cacheRead + cacheWrite;
-                span.setAttribute('gen_ai.usage.input_tokens', totalInputTokens);
-                span.setAttribute('gen_ai.usage.output_tokens', outputTokens);
-                span.setAttribute('gen_ai.usage.input_tokens.cached', cacheRead);
-                span.setAttribute('gen_ai.usage.input_tokens.cache_write', cacheWrite);
-                span.setAttribute('gen_ai.usage.total_tokens', totalInputTokens + outputTokens);
-            }
-            if (resultMessage.total_cost_usd !== undefined) {
-                span.setAttribute('gen_ai.cost.total_tokens', resultMessage.total_cost_usd);
-            }
-            if (resultMessage.uuid) {
-                span.setAttribute('gen_ai.response.id', resultMessage.uuid);
-            }
-            if (resultMessage.modelUsage) {
-                const models = Object.keys(resultMessage.modelUsage);
-                if (models.length === 1 && models[0]) {
-                    // Single model: set per OTel spec (string, one model)
-                    span.setAttribute('gen_ai.response.model', models[0]);
-                }
-                // Multiple models: don't set gen_ai.response.model on the parent.
-                // Per-turn gen_ai.chat child spans carry the correct model each.
-            }
-            if (resultMessage.subtype === 'success' && resultMessage.result) {
-                span.setAttribute('gen_ai.response.text', JSON.stringify([resultMessage.result]));
-            }
-            // Optional SDK metadata attributes
-            const optionalAttrs = {
-                'gen_ai.conversation.id': resultMessage.session_id,
-                'sdk.duration_ms': resultMessage.duration_ms,
-                'sdk.duration_api_ms': resultMessage.duration_api_ms,
-                'sdk.num_turns': resultMessage.num_turns,
-            };
-            for (const [key, value] of Object.entries(optionalAttrs)) {
-                if (value !== undefined) {
-                    span.setAttribute(key, value);
-                }
-            }
-        }
-        const stderr = stderrChunks.join('').trim() || undefined;
-        return { result: resultMessage, authError, stderr };
-    });
-}
 /**
  * Analyze a single hunk with retry logic for transient failures.
  */
@@ -272,7 +113,7 @@ async function analyzeHunk(skill, hunkCtx, repoPath, options, callbacks, prConte
             'hunk.line_range': lineRange,
         },
     }, async (span) => {
-        const { apiKey, abortController, retry } = options;
+        const { abortController, retry } = options;
         const systemPrompt = buildHunkSystemPrompt(skill);
         const userPrompt = buildHunkUserPrompt(skill, hunkCtx, prContext);
         // Report prompt size information
@@ -295,11 +136,13 @@ async function analyzeHunk(skill, hunkCtx, repoPath, options, callbacks, prConte
         // Track accumulated usage across retry attempts for accurate cost reporting
         const accumulatedUsage = [];
         for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {
+            const circuitReason = options.circuitBreaker?.reason;
+            if (circuitReason) {
+                return hunkFailureFromCircuit(circuitReason, accumulatedUsage, attempt);
+            }
             // Check for abort before each attempt
             if (abortController?.signal.aborted) {
-                if (callbacks?.onHunkFailed) {
-                    callbacks.onHunkFailed(callbacks.lineRange, 'Analysis aborted');
-                }
+                callbacks?.onHunkFailed?.(callbacks.lineRange, 'Analysis aborted');
                 return {
                     findings: [],
                     usage: aggregateUsage(accumulatedUsage),
@@ -311,19 +154,30 @@ async function analyzeHunk(skill, hunkCtx, repoPath, options, callbacks, prConte
                 };
             }
             try {
-                const { result: resultMessage, authError } = await executeQuery(systemPrompt, userPrompt, repoPath, options, skill.name);
+                const runtimeName = options.runtime ?? 'claude';
+                const runtime = getRuntime(runtimeName);
+                const { result: resultMessage, authError } = await runtime.runSkill({
+                    systemPrompt,
+                    userPrompt,
+                    repoPath,
+                    skillName: skill.name,
+                    tools: skill.tools,
+                    options: {
+                        maxTurns: options.maxTurns,
+                        model: options.model,
+                        abortController: options.abortController,
+                    },
+                    providerOptions: getRuntimeProviderOptions(runtimeName, {
+                        pathToClaudeCodeExecutable: options.pathToClaudeCodeExecutable,
+                    }),
+                });
                 // Check for authentication errors from auth_status messages
                 // auth_status errors are always auth-related - throw immediately
                 if (authError) {
                     throw new WardenAuthenticationError(authError);
                 }
                 if (!resultMessage) {
-                    if (callbacks?.onHunkFailed) {
-                        callbacks.onHunkFailed(callbacks.lineRange, 'SDK returned no result');
-                    }
-                    else {
-                        console.error('SDK returned no result');
-                    }
+                    notifyHunkFailed(callbacks, callbacks?.lineRange ?? lineRange, 'SDK returned no result');
                     return {
                         findings: [],
                         usage: aggregateUsage(accumulatedUsage),
@@ -335,13 +189,13 @@ async function analyzeHunk(skill, hunkCtx, repoPath, options, callbacks, prConte
                     };
                 }
                 // Extract usage from the result, regardless of success/error status
-                const usage = extractUsage(resultMessage);
+                const usage = resultMessage.usage;
                 accumulatedUsage.push(usage);
                 // Check if the SDK returned an error result (e.g., max turns, budget exceeded)
-                const isError = resultMessage.is_error || resultMessage.subtype !== 'success';
+                const isError = resultMessage.status !== 'success';
                 if (isError) {
                     // Extract error messages from SDK result
-                    const errorMessages = 'errors' in resultMessage ? resultMessage.errors : [];
+                    const errorMessages = resultMessage.errors;
                     // Check if any error indicates authentication failure
                     for (const err of errorMessages) {
                         if (isAuthenticationErrorMessage(err)) {
@@ -350,25 +204,31 @@ async function analyzeHunk(skill, hunkCtx, repoPath, options, callbacks, prConte
                     }
                     // SDK error - log and return failure with error details
                     const errorSummary = errorMessages.length > 0
-                        ? errorMessages.join('; ')
-                        : `SDK error: ${resultMessage.subtype}`;
-                    if (callbacks?.onHunkFailed) {
-                        callbacks.onHunkFailed(callbacks.lineRange, `SDK execution failed: ${errorSummary}`);
-                    }
-                    else {
-                        console.error(`SDK execution failed: ${errorSummary}`);
+                        ? sanitizeErrorMessage(errorMessages.join('; '))
+                        : `Runtime error: ${resultMessage.status}`;
+                    const failureCode = resultMessage.status === 'turn_limit'
+                        ? 'max_turns'
+                        : resultMessage.status === 'provider_error'
+                            ? 'provider_unavailable'
+                            : 'sdk_error';
+                    const failureMessage = `Runtime execution failed: ${errorSummary}`;
+                    const openReason = recordCircuitFailure(options, failureCode, failureMessage);
+                    notifyHunkFailed(callbacks, callbacks?.lineRange ?? lineRange, failureMessage);
+                    if (openReason) {
+                        return hunkFailureFromCircuit(openReason, accumulatedUsage, attempt + 1);
                     }
                     return {
                         findings: [],
                         usage: aggregateUsage(accumulatedUsage),
                         failed: true,
                         extractionFailed: false,
-                        failureCode: resultMessage.subtype === 'error_max_turns' ? 'max_turns' : 'sdk_error',
-                        failureMessage: `SDK execution failed: ${errorSummary}`,
+                        failureCode,
+                        failureMessage,
                         attempts: attempt + 1,
                     };
                 }
-                const parseResult = await parseHunkOutput(resultMessage, hunkCtx.filename, apiKey, options.auxiliaryMaxRetries);
+                options.circuitBreaker?.recordSuccess();
+                const parseResult = await parseHunkOutput(resultMessage, hunkCtx.filename, options);
                 // Filter findings outside hunk line range (defense-in-depth)
                 const hunkRange = getHunkLineRange(hunkCtx.hunk);
                 const { filtered: filteredFindings, dropped } = filterOutOfRangeFindings(parseResult.findings, hunkRange);
@@ -409,28 +269,46 @@ async function analyzeHunk(skill, hunkCtx, repoPath, options, callbacks, prConte
             }
             catch (error) {
                 lastError = error;
+                if (isAbortRequested(error, abortController)) {
+                    callbacks?.onHunkFailed?.(callbacks.lineRange, 'Analysis aborted');
+                    return {
+                        findings: [],
+                        usage: aggregateUsage(accumulatedUsage),
+                        failed: true,
+                        extractionFailed: false,
+                        failureCode: 'aborted',
+                        failureMessage: 'Analysis aborted',
+                        attempts: attempt + 1,
+                    };
+                }
                 // Re-throw authentication errors (they shouldn't be retried)
                 if (error instanceof WardenAuthenticationError) {
+                    const message = sanitizeErrorMessage(error.message);
+                    options.circuitBreaker?.recordFailure('auth_failed', message);
                     throw error;
                 }
                 // Subprocess IPC failures (EPIPE, ECONNRESET, etc.) indicate the Claude CLI
                 // can't communicate — surface as an auth error with actionable guidance
                 if (isSubprocessError(error)) {
                     const errorMessage = error instanceof Error ? error.message : String(error);
+                    options.circuitBreaker?.recordFailure('auth_failed', sanitizeErrorMessage(errorMessage));
                     throw new WardenAuthenticationError(`Claude Code subprocess failed (${errorMessage}).\n` +
                         `This usually means the claude CLI cannot run in this environment.`, { cause: error });
                 }
                 // Authentication errors should surface immediately with helpful guidance
                 if (isAuthenticationError(error)) {
+                    const errorMessage = error instanceof Error ? error.message : String(error);
+                    options.circuitBreaker?.recordFailure('auth_failed', sanitizeErrorMessage(errorMessage));
                     throw new WardenAuthenticationError(undefined, { cause: error });
                 }
                 // Don't retry if not a retryable error or we've exhausted retries
-                if (!isRetryableError(error) || attempt >= retryConfig.maxRetries) {
+                const shouldRetry = isRetryableError(error) && attempt < retryConfig.maxRetries;
+                if (!shouldRetry) {
                     break;
                 }
                 // Calculate delay and wait before retry
                 const delayMs = calculateRetryDelay(attempt, retryConfig);
-                const errorMessage = error instanceof Error ? error.message : String(error);
+                const errorMessage = sanitizeErrorMessage(error instanceof Error ? error.message : String(error));
                 Sentry.addBreadcrumb({
                     category: 'retry',
                     message: `Retrying hunk analysis`,
@@ -445,9 +323,7 @@ async function analyzeHunk(skill, hunkCtx, repoPath, options, callbacks, prConte
                 }
                 catch {
                     // Aborted during sleep
-                    if (callbacks?.onHunkFailed) {
-                        callbacks.onHunkFailed(callbacks.lineRange, 'Analysis aborted during retry delay');
-                    }
+                    callbacks?.onHunkFailed?.(callbacks.lineRange, 'Analysis aborted during retry delay');
                     return {
                         findings: [],
                         usage: aggregateUsage(accumulatedUsage),
@@ -461,15 +337,10 @@ async function analyzeHunk(skill, hunkCtx, repoPath, options, callbacks, prConte
             }
         }
         // All attempts failed - return failure with any accumulated usage
-        const finalError = lastError instanceof Error ? lastError.message : String(lastError);
+        const finalError = sanitizeErrorMessage(lastError instanceof Error ? lastError.message : String(lastError));
         // Log the final error
         if (lastError) {
-            if (callbacks?.onHunkFailed) {
-                callbacks.onHunkFailed(callbacks.lineRange, `All retry attempts failed: ${finalError}`);
-            }
-            else {
-                console.error(`All retry attempts failed: ${finalError}`);
-            }
+            notifyHunkFailed(callbacks, callbacks?.lineRange ?? lineRange, `All retry attempts failed: ${finalError}`);
         }
         // Also notify via callback if verbose
         if (options.verbose) {
@@ -477,7 +348,12 @@ async function analyzeHunk(skill, hunkCtx, repoPath, options, callbacks, prConte
         }
         span.setAttribute('hunk.failed', true);
         span.setAttribute('finding.count', 0);
-        const { code: retryCode, message: retryMsg } = classifyError(lastError);
+        const { code: retryCode, message } = classifyError(lastError);
+        const retryMsg = sanitizeErrorMessage(message);
+        const openReason = recordCircuitFailure(options, retryCode, retryMsg);
+        if (openReason) {
+            return hunkFailureFromCircuit(openReason, accumulatedUsage, retryConfig.maxRetries + 1);
+        }
         return {
             findings: [],
             usage: aggregateUsage(accumulatedUsage),
@@ -543,13 +419,15 @@ export async function analyzeFile(skill, file, repoPath, options = {}, callbacks
                     onHunkFailed: callbacks.onHunkFailed,
                 }
                 : undefined;
+            const hunkStartTime = Date.now();
             const result = await analyzeHunk(skill, hunk, repoPath, options, hunkCallbacks, prContext);
+            const hunkDurationMs = Date.now() - hunkStartTime;
             // `failed` and `extractionFailed` are conceptually mutually exclusive:
             // if analysis failed (no output produced), there's nothing to extract.
             // Use else-if so a future change that violates this invariant doesn't
             // silently double-count (one hunk → two hunkFailures entries +
             // failedHunks AND failedExtractions both incremented).
-            if (result.failed) {
+            if (result.failed && result.failureCode !== 'aborted') {
                 failedHunks++;
                 hunkFailures.push({
                     type: 'analysis',
@@ -573,6 +451,24 @@ export async function analyzeFile(skill, file, repoPath, options = {}, callbacks
             }
             attachElapsedTime(result.findings, callbacks?.skillStartTime);
             callbacks?.onHunkComplete?.(hunkIndex + 1, result.findings, result.usage);
+            const chunkResult = {
+                filename: file.filename,
+                model: options.model,
+                index: hunkIndex + 1,
+                total: file.hunks.length,
+                lineRange,
+                findings: result.findings,
+                usage: result.usage,
+                durationMs: hunkDurationMs,
+                failed: result.failed && result.failureCode !== 'aborted',
+                extractionFailed: result.extractionFailed,
+                failureCode: result.failureCode,
+                failureMessage: result.failureMessage,
+                extractionError: result.extractionError,
+                extractionPreview: result.extractionPreview,
+                auxiliaryUsage: result.auxiliaryUsage,
+            };
+            callbacks?.onChunkComplete?.(chunkResult);
             fileFindings.push(...result.findings);
             fileUsage.push(result.usage);
             if (result.auxiliaryUsage) {
@@ -763,59 +659,53 @@ export async function runSkill(skill, context, options = {}) {
     // at most one (analyzeFile makes them mutually exclusive), and an
     // extraction-only failure scenario would otherwise slip through silently.
     const totalAttemptFailures = totalFailedHunks + totalFailedExtractions;
+    const circuitReason = options.circuitBreaker?.reason;
+    if (circuitReason && totalAttemptFailures > 0 && allFindings.length === 0) {
+        throw new SkillRunnerError(circuitReason.message, { code: circuitReason.code });
+    }
     if (totalAttemptFailures > 0 && totalAttemptFailures === totalHunks && allFindings.length === 0) {
+        const analysisFailures = allHunkFailures.filter((failure) => failure.type === 'analysis');
+        if (analysisFailures.length > 0
+            && analysisFailures.every((failure) => failure.code === 'provider_unavailable')) {
+            throw new SkillRunnerError(`Provider unavailable: all ${totalHunks} chunk${totalHunks === 1 ? '' : 's'} failed to analyze. Warden stopped early.`, { code: 'provider_unavailable' });
+        }
         throw new SkillRunnerError(`All ${totalHunks} chunk${totalHunks === 1 ? '' : 's'} failed to analyze. ` +
             `This usually indicates an authentication problem. ` +
             `Verify WARDEN_ANTHROPIC_API_KEY is set correctly, or run 'claude login' if using Claude Code subscription.`, { code: 'all_hunks_failed' });
     }
-    // Deduplicate findings
-    const uniqueFindings = deduplicateFindings(allFindings);
-    emitDedupMetrics(skill.name, allFindings.length, uniqueFindings.length);
-    // Merge findings that describe the same issue at different locations
-    const mergeResult = await mergeCrossLocationFindings(uniqueFindings, {
-        apiKey: options.apiKey,
-        repoPath: context.repoPath,
-        maxRetries: options.auxiliaryMaxRetries,
-    });
-    let mergedFindings = mergeResult.findings;
-    if (mergeResult.usage) {
-        allAuxiliaryUsage.push({ agent: 'merge', usage: mergeResult.usage });
-    }
-    const sanitized = await sanitizeFindingsSuggestedFixes(mergedFindings, {
+    const processed = await postProcessFindings(allFindings, {
+        skill,
         repoPath: context.repoPath,
         apiKey: options.apiKey,
-        maxRetries: options.auxiliaryMaxRetries,
+        runtime: options.runtime,
+        auxiliaryModel: options.auxiliaryModel,
+        synthesisModel: options.synthesisModel,
+        auxiliaryMaxRetries: options.auxiliaryMaxRetries,
+        verifyFindings: options.verifyFindings,
+        maxTurns: options.maxTurns,
+        abortController: options.abortController,
+        pathToClaudeCodeExecutable: options.pathToClaudeCodeExecutable,
+        prContext,
+        onFindingProcessing: options.callbacks?.onFindingProcessing,
     });
-    mergedFindings = sanitized.findings;
-    if (sanitized.usage) {
-        allAuxiliaryUsage.push({ agent: 'fix_gate', usage: sanitized.usage });
-    }
-    emitFixGateMetrics(skill.name, sanitized.stats.checked, sanitized.stats.strippedDeterministic, sanitized.stats.strippedSemantic, sanitized.stats.semanticUnavailable);
-    if (sanitized.stats.checked > 0) {
-        logger.info('Suggested fix quality gate', {
-            'fix_gate.checked': sanitized.stats.checked,
-            'fix_gate.stripped_deterministic': sanitized.stats.strippedDeterministic,
-            'fix_gate.stripped_semantic': sanitized.stats.strippedSemantic,
-            'fix_gate.semantic_unavailable': sanitized.stats.semanticUnavailable,
-        });
-    }
+    const finalFindings = processed.findings;
+    allAuxiliaryUsage.push(...processed.auxiliaryUsage);
     // Generate summary
-    const summary = generateSummary(skill.name, mergedFindings);
+    const summary = generateSummary(skill.name, finalFindings);
     // Aggregate usage across all hunks
     const totalUsage = aggregateUsage(allUsage);
     const report = {
         skill: skill.name,
         summary,
-        findings: mergedFindings,
+        findings: finalFindings,
         usage: totalUsage,
         durationMs: Date.now() - startTime,
         model: options.model,
-        files: fileResults.map((fr) => ({
+        files: buildFileReports(fileResults.map((fr) => ({
             filename: fr.filename,
-            findings: fr.result.findings.length,
             durationMs: fr.durationMs,
             usage: fr.result.usage,
-        })),
+        })), finalFindings),
     };
     if (skippedFiles.length > 0) {
         report.skippedFiles = skippedFiles;