@sentry/warden 0.35.1 → 0.36.0

package/skills/warden-sweep/references/script-interfaces.md

@@ -1,127 +0,0 @@
-# Script Interfaces
-
-Use this reference before running Warden Sweep scripts. Run scripts from the repository root and pass the host skill-root path.
-
-## Contents
-
-- `scan.py`
-- `index_prs.py`
-- `create_issue.py`
-- `organize.py`
-- `extract_findings.py`
-- `generate_report.py`
-- `find_reviewers.py`
-
-## `scripts/scan.py`
-
-Runs setup and scan in one call: generates a run ID, creates the sweep directory, checks dependencies, creates the `warden` label, enumerates files, runs Warden per file, writes `scan-index.jsonl`, and extracts findings.
-
-```bash
-uv run <skill-root>/scripts/scan.py [file ...]
-uv run <skill-root>/scripts/scan.py --sweep-dir .warden/sweeps/<run-id>
-```
-
-Stdout JSON:
-
-```json
-{
-  "runId": "abc123",
-  "sweepDir": ".warden/sweeps/abc123",
-  "filesScanned": 10,
-  "filesTimedOut": 0,
-  "filesErrored": 0,
-  "totalFindings": 3,
-  "findings": []
-}
-```
-
-Exit codes: `0` success, `1` fatal error, `2` partial scan.
-
-## `scripts/index_prs.py`
-
-Fetches open Warden-labeled PRs, builds a file-to-PR dedup index, and caches diffs for overlapping PRs.
-
-```bash
-uv run <skill-root>/scripts/index_prs.py <sweep-dir>
-```
-
-Stdout JSON includes `fileIndex`. Side effects:
-
-- writes `data/existing-prs.json`
-- writes `data/pr-diffs/<number>.diff` for overlapping PRs
-
-## `scripts/create_issue.py`
-
-Creates a GitHub tracking issue summarizing verified sweep results.
-
-```bash
-uv run <skill-root>/scripts/create_issue.py <sweep-dir>
-```
-
-Stdout JSON:
-
-```json
-{
-  "issueUrl": "https://github.com/owner/repo/issues/123",
-  "issueNumber": 123
-}
-```
-
-Idempotent: skips creation when `issueUrl` already exists in the manifest.
-
-## `scripts/organize.py`
-
-Tags security findings, labels security PRs, updates finding reports with PR links, posts final results to the tracking issue, generates the summary report, and finalizes the manifest.
-
-```bash
-uv run <skill-root>/scripts/organize.py <sweep-dir>
-```
-
-Stdout JSON includes final sweep counts and report paths. Side effects:
-
-- creates `security/index.jsonl`
-- copies security finding reports to `security/`
-- creates or reuses the `security` GitHub label
-- labels security PRs
-- appends PR links to `findings/*.md`
-- writes `summary.md` and `data/report.json`
-- updates `phases.organize` in `data/manifest.json`
-
-## `scripts/extract_findings.py`
-
-Parses Warden JSONL log files and extracts normalized findings. Usually called by `scan.py`.
-
-```bash
-uv run <skill-root>/scripts/extract_findings.py <log-path-or-directory> -o <output.jsonl>
-```
-
-Writes one normalized finding per line to `<output.jsonl>`.
-
-## `scripts/generate_report.py`
-
-Builds `summary.md` and `report.json` from sweep data. Usually called by `organize.py`.
-
-```bash
-uv run <skill-root>/scripts/generate_report.py <sweep-dir>
-```
-
-Side effects:
-
-- writes `<sweep-dir>/summary.md`
-- writes `<sweep-dir>/data/report.json`
-
-## `scripts/find_reviewers.py`
-
-Finds the top two git contributors for a file from the last 12 months.
-
-```bash
-uv run <skill-root>/scripts/find_reviewers.py <file-path>
-```
-
-Stdout JSON:
-
-```json
-{
-  "reviewers": ["user1", "user2"]
-}
-```

package/skills/warden-sweep/references/verify-phase.md

@@ -1,69 +0,0 @@
-# Verify Phase
-
-Deep-trace every finding before patching. This phase qualifies true issues and rejects false positives.
-
-## Input
-
-Read findings from:
-
-```text
-<sweep-dir>/data/all-findings.jsonl
-```
-
-## Process
-
-For each finding:
-
-1. If `data/verify/<finding-id>.json` exists, skip it.
-2. Launch verification work using the host agent's task/delegation mechanism when available. Process findings in parallel batches up to 8 if the host supports parallel work.
-3. Read `references/verify-prompt.md` and substitute the finding values into the `${...}` placeholders.
-4. Parse the returned JSON.
-5. Write the raw result to `data/verify/<finding-id>.json`.
-6. Append verified findings to `data/verified.jsonl`.
-7. Append rejected findings to `data/rejected.jsonl`.
-8. For verified findings, generate `findings/<finding-id>.md`.
-
-If the host does not support delegated tasks, run the same verification prompt serially.
-
-## Verified Finding Report
-
-````markdown
-# ${TITLE}
-
-**ID**: ${FINDING_ID} | **Severity**: ${SEVERITY} | **Confidence**: ${CONFIDENCE}
-**Skill**: ${SKILL} | **File**: ${FILE_PATH}:${START_LINE}
-
-## Description
-${DESCRIPTION}
-
-## Verification
-**Verdict**: Verified (${VERIFICATION_CONFIDENCE})
-**Reasoning**: ${REASONING}
-**Code trace**: ${TRACE_NOTES}
-
-## Suggested Fix
-${FIX_DESCRIPTION}
-```diff
-${FIX_DIFF}
-```
-````
-
-Update the manifest: set `phases.verify` to `"complete"`.
-
-## Report Template
-
-```markdown
-## Verification Complete
-
-**{verified}** verified, **{rejected}** rejected.
-
-### Verified Findings
-
-| # | Severity | Confidence | File | Title | Reasoning |
-|---|----------|------------|------|-------|-----------|
-| 1 | **HIGH** | high | `src/db/query.ts:42` | SQL injection in query builder | User input flows directly into... |
-
-### Rejected ({rejected_count})
-
-- `{findingId}` {file}: {reasoning}
-```

package/skills/warden-sweep/references/verify-prompt.md

@@ -1,25 +0,0 @@
-Verify a code analysis finding. Determine if this is a TRUE issue or a FALSE POSITIVE.
-Do NOT write or edit any files. Research only.
-
-## Finding
-- Title: ${TITLE}
-- Severity: ${SEVERITY} | Confidence: ${CONFIDENCE}
-- Skill: ${SKILL}
-- Location: ${FILE_PATH}:${START_LINE}-${END_LINE}
-- Description: ${DESCRIPTION}
-- Verification hint: ${VERIFICATION}
-
-## Instructions
-1. Read the file at the reported location. Examine at least 50 lines of surrounding context.
-2. Trace data flow to/from the flagged code using Grep/Glob.
-3. Check if the issue is mitigated elsewhere (guards, validation, try/catch upstream).
-4. Check if the issue is actually reachable in practice.
-
-Return your verdict as JSON:
-{
-  "findingId": "${FINDING_ID}",
-  "verdict": "verified" or "rejected",
-  "confidence": "high" or "medium" or "low",
-  "reasoning": "2-3 sentence explanation",
-  "traceNotes": "What code paths you examined"
-}

package/skills/warden-sweep/scripts/_utils.py

@@ -1,99 +0,0 @@
-"""Shared utilities for warden-sweep scripts."""
-from __future__ import annotations
-
-import json
-import os
-import subprocess
-from typing import Any
-
-
-def run_cmd(
-    args: list[str], timeout: int = 30, cwd: str | None = None
-) -> subprocess.CompletedProcess[str]:
-    """Run a command and return the result."""
-    return subprocess.run(
-        args,
-        capture_output=True,
-        text=True,
-        timeout=timeout,
-        cwd=cwd,
-    )
-
-
-def run_cmd_stdout(
-    args: list[str], timeout: int = 30, cwd: str | None = None
-) -> str | None:
-    """Run a command and return stripped stdout, or None on failure."""
-    try:
-        result = run_cmd(args, timeout=timeout, cwd=cwd)
-        return result.stdout.strip() if result.returncode == 0 else None
-    except (subprocess.TimeoutExpired, FileNotFoundError):
-        return None
-
-
-def read_json(path: str) -> dict[str, Any] | None:
-    """Read a JSON file and return parsed object, or None on failure."""
-    if not os.path.exists(path):
-        return None
-    try:
-        with open(path) as f:
-            return json.load(f)
-    except (json.JSONDecodeError, OSError):
-        return None
-
-
-def write_json(path: str, data: dict[str, Any]) -> None:
-    """Write a dict to a JSON file with trailing newline."""
-    with open(path, "w") as f:
-        json.dump(data, f, indent=2)
-        f.write("\n")
-
-
-def read_jsonl(path: str) -> list[dict[str, Any]]:
-    """Read a JSONL file and return list of parsed objects."""
-    entries: list[dict[str, Any]] = []
-    if not os.path.exists(path):
-        return entries
-    with open(path) as f:
-        for line in f:
-            line = line.strip()
-            if not line:
-                continue
-            try:
-                entries.append(json.loads(line))
-            except json.JSONDecodeError:
-                continue
-    return entries
-
-
-def severity_badge(severity: str) -> str:
-    """Return a markdown-friendly severity indicator."""
-    badges = {
-        "critical": "**CRITICAL**",
-        "high": "**HIGH**",
-        "medium": "MEDIUM",
-        "low": "LOW",
-        "info": "info",
-    }
-    return badges.get(severity, severity)
-
-
-def pr_number_from_url(pr_url: str) -> str:
-    """Extract the PR or issue number from a GitHub URL's last path segment."""
-    return pr_url.rstrip("/").split("/")[-1]
-
-
-def ensure_github_label(name: str, color: str, description: str) -> None:
-    """Create a GitHub label if it doesn't exist (idempotent)."""
-    try:
-        subprocess.run(
-            [
-                "gh", "label", "create", name,
-                "--color", color,
-                "--description", description,
-            ],
-            capture_output=True,
-            timeout=15,
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError):
-        pass

package/skills/warden-sweep/scripts/create_issue.py

@@ -1,189 +0,0 @@
-#!/usr/bin/env python3
-# /// script
-# requires-python = ">=3.9"
-# ///
-"""
-Warden Sweep: Create tracking issue.
-
-Creates a GitHub issue summarizing the sweep results after verification
-but before patching. Gives every PR a parent to reference and gives
-reviewers a single place to see the full picture.
-
-Usage:
-    uv run create_issue.py <sweep-dir>
-
-Stdout: JSON with issueUrl and issueNumber
-Stderr: Progress lines
-
-Idempotent: if issueUrl already exists in manifest, skips creation.
-"""
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import subprocess
-import sys
-from typing import Any
-
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from _utils import (  # noqa: E402
-    ensure_github_label,
-    pr_number_from_url,
-    read_json,
-    read_jsonl,
-    severity_badge,
-    write_json,
-)
-
-
-def build_issue_body(
-    run_id: str,
-    scan_index: list[dict[str, Any]],
-    all_findings: list[dict[str, Any]],
-    verified: list[dict[str, Any]],
-    rejected: list[dict[str, Any]],
-) -> str:
-    """Build the GitHub issue body markdown."""
-    files_scanned = sum(1 for e in scan_index if e.get("status") == "complete")
-    files_timed_out = sum(
-        1 for e in scan_index
-        if e.get("status") == "error" and e.get("error") == "timeout"
-    )
-    files_errored = sum(
-        1 for e in scan_index
-        if e.get("status") == "error" and e.get("error") != "timeout"
-    )
-
-    # Collect unique skills from scan index
-    skills: set[str] = set()
-    for entry in scan_index:
-        for skill in entry.get("skills", []):
-            skills.add(skill)
-
-    lines = [
-        f"## Warden Sweep `{run_id}`",
-        "",
-        "| Metric | Count |",
-        "|--------|-------|",
-        f"| Files scanned | {files_scanned} |",
-        f"| Files timed out | {files_timed_out} |",
-        f"| Files errored | {files_errored} |",
-        f"| Total findings | {len(all_findings)} |",
-        f"| Verified | {len(verified)} |",
-        f"| Rejected | {len(rejected)} |",
-        "",
-    ]
-
-    if verified:
-        lines.append("### Verified Findings")
-        lines.append("")
-        lines.append("| Severity | Skill | File | Title |")
-        lines.append("|----------|-------|------|-------|")
-        for f in verified:
-            sev = severity_badge(f.get("severity", "info"))
-            skill = f.get("skill", "")
-            file_path = f.get("file", "")
-            start_line = f.get("startLine")
-            location = f"{file_path}:{start_line}" if start_line else file_path
-            title = f.get("title", "")
-            lines.append(f"| {sev} | {skill} | `{location}` | {title} |")
-        lines.append("")
-
-    if skills:
-        lines.append("### Skills Run")
-        lines.append("")
-        lines.append(", ".join(sorted(skills)))
-        lines.append("")
-
-    lines.append("> Generated by Warden Sweep. PRs referencing this issue will appear below.")
-
-    return "\n".join(lines) + "\n"
-
-
-def create_github_issue(title: str, body: str) -> dict[str, Any]:
-    """Create a GitHub issue with the warden label. Returns issueUrl and issueNumber."""
-    ensure_github_label("warden", "5319E7", "Automated fix from Warden Sweep")
-
-    result = subprocess.run(
-        [
-            "gh", "issue", "create",
-            "--label", "warden",
-            "--title", title,
-            "--body", body,
-        ],
-        capture_output=True,
-        text=True,
-        timeout=30,
-    )
-
-    if result.returncode != 0:
-        raise RuntimeError(f"gh issue create failed: {result.stderr.strip()}")
-
-    issue_url = result.stdout.strip()
-    try:
-        issue_number = int(pr_number_from_url(issue_url))
-    except (ValueError, IndexError):
-        raise RuntimeError(f"Could not parse issue number from gh output: {issue_url}")
-
-    return {"issueUrl": issue_url, "issueNumber": issue_number}
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser(
-        description="Warden Sweep: Create tracking issue"
-    )
-    parser.add_argument("sweep_dir", help="Path to the sweep directory")
-    args = parser.parse_args()
-
-    sweep_dir = args.sweep_dir
-    data_dir = os.path.join(sweep_dir, "data")
-    manifest_path = os.path.join(data_dir, "manifest.json")
-
-    if not os.path.isdir(sweep_dir):
-        print(
-            json.dumps({"error": f"Sweep directory not found: {sweep_dir}"}),
-            file=sys.stdout,
-        )
-        sys.exit(1)
-
-    manifest = read_json(manifest_path) or {}
-
-    # Idempotency: if issue already exists, return existing values
-    if manifest.get("issueUrl"):
-        output = {
-            "issueUrl": manifest["issueUrl"],
-            "issueNumber": manifest.get("issueNumber", 0),
-        }
-        print(json.dumps(output))
-        return
-
-    run_id = manifest.get("runId", "unknown")
-
-    # Read sweep data
-    scan_index = read_jsonl(os.path.join(data_dir, "scan-index.jsonl"))
-    all_findings = read_jsonl(os.path.join(data_dir, "all-findings.jsonl"))
-    verified = read_jsonl(os.path.join(data_dir, "verified.jsonl"))
-    rejected = read_jsonl(os.path.join(data_dir, "rejected.jsonl"))
-
-    files_scanned = sum(1 for e in scan_index if e.get("status") == "complete")
-
-    # Build issue
-    title = f"Warden Sweep {run_id}: {len(verified)} findings across {files_scanned} files"
-    body = build_issue_body(run_id, scan_index, all_findings, verified, rejected)
-
-    print("Creating tracking issue...", file=sys.stderr)
-    result = create_github_issue(title, body)
-    print(f"Created issue: {result['issueUrl']}", file=sys.stderr)
-
-    # Write issueUrl and issueNumber to manifest
-    manifest["issueUrl"] = result["issueUrl"]
-    manifest["issueNumber"] = result["issueNumber"]
-    manifest.setdefault("phases", {})["issue"] = "complete"
-    write_json(manifest_path, manifest)
-
-    print(json.dumps(result))
-
-
-if __name__ == "__main__":
-    main()