@sentry/warden 0.35.1 → 0.36.0

package/skills/warden-sweep/SKILL.md

@@ -1,78 +0,0 @@
----
-name: warden-sweep
-description: Full-repository code sweep. Scans every file with Warden, verifies findings through deep tracing, creates draft PRs for validated issues. Use when asked to "sweep the repo", "scan everything", "find all bugs", "full codebase review", "batch code analysis", or run Warden across the entire repository.
-disable-model-invocation: true
----
-
-# Warden Sweep
-
-Run a full-repository Warden sweep: scan files, verify findings, create a tracking issue, open draft PRs for validated issues, and organize the final report.
-
-**Requires**: `warden`, `gh`, `git`, `jq`, `uv`.
-
-Run commands from the repository root. Use the host's skill-root path for bundled scripts and references.
-
-Output goes to `.warden/sweeps/<run-id>/`.
-
-## References
-
-Load only the reference for the current phase:
-
-| Need | Read |
-|------|------|
-| Script arguments, outputs, and side effects | `references/script-interfaces.md` |
-| Phase 1 scan workflow | `references/scan-phase.md` |
-| Phase 2 verification workflow | `references/verify-phase.md` |
-| Phase 3 tracking issue workflow | `references/issue-phase.md` |
-| Phase 4 patch and draft PR workflow | `references/patch-phase.md` |
-| Phase 5 organize and final report workflow | `references/organize-phase.md` |
-| Resume behavior and artifact layout | `references/resume-and-artifacts.md` |
-| Verification task prompt template | `references/verify-prompt.md` |
-| Patch task prompt template | `references/patch-prompt.md` |
-
-## Workflow
-
-Track progress across phases:
-
-- [ ] Phase 1: Scan repository files with Warden.
-- [ ] Phase 2: Verify findings before patching.
-- [ ] Phase 3: Create a tracking issue.
-- [ ] Phase 4: Patch verified findings and open draft PRs.
-- [ ] Phase 5: Organize results and produce the final report.
-
-## Phase Order
-
-1. Read `references/script-interfaces.md` once before running scripts.
-2. Run Phase 1 from `references/scan-phase.md`. Save `runId` and `sweepDir`.
-3. Run Phase 2 from `references/verify-phase.md`. Verify every finding before patching.
-4. Run Phase 3 from `references/issue-phase.md`. Continue if issue creation fails.
-5. Run Phase 4 from `references/patch-phase.md`. Patch sequentially, one finding at a time.
-6. Run Phase 5 from `references/organize-phase.md`.
-7. For interrupted or partial runs, read `references/resume-and-artifacts.md` and continue from the first incomplete phase.
-
-## Non-Negotiable Rules
-
-- Verify findings before creating fixes.
-- Use draft PRs for generated patches.
-- Branch every patch from the repository default branch.
-- Patch findings sequentially; do not run patch workers in parallel.
-- Skip existing entries in sweep artifacts instead of duplicating work.
-- Record failures in sweep data and continue to the next finding when possible.
-- Clean up each worktree after patch success or failure.
-
-## Final Response
-
-After organizing, report:
-
-```markdown
-## Sweep Complete
-
-| Metric | Count |
-|--------|-------|
-| Files scanned | {filesScanned} |
-| Findings verified | {verified} |
-| PRs created | {prsCreated} |
-| Security findings | {securityFindings} |
-
-Full report: `{summaryPath}`
-```

package/skills/warden-sweep/SOURCES.md

@@ -1,43 +0,0 @@
-# Warden Sweep Sources
-
-## Source Inventory
-
-| Source | Trust tier | Confidence | Usage constraints |
-|--------|------------|------------|-------------------|
-| `packages/warden/skills/warden-sweep/SKILL.md` | canonical runtime | high | Keep as router and phase overview. |
-| `packages/warden/skills/warden-sweep/references/*.md` | bundled runtime references | high | Keep focused by phase or lookup need. |
-| `packages/warden/skills/warden-sweep/scripts/*.py` | executable workflow | high | Script interfaces in references must match these files. |
-| `packages/warden/src/cli/output/jsonl.ts` | Warden output contract | high | Verify JSONL parsing assumptions when Warden output changes. |
-| `packages/warden/src/output/renderer.ts` and `packages/warden/src/types/` | finding/report semantics | high | Verify severity, confidence, and finding fields here. |
-| GitHub CLI commands used by scripts | external tool contract | medium | Confirm command flags when GitHub CLI behavior changes. |
-
-## Coverage Matrix
-
-| Dimension | Coverage status | Evidence |
-|-----------|-----------------|----------|
-| Workflow phases | covered | `SKILL.md` routes scan, verify, issue, patch, organize, and resume behavior to focused references. |
-| Script interfaces | covered | `references/script-interfaces.md` lists scripts, arguments, outputs, and side effects. |
-| Artifact schema | covered | `references/resume-and-artifacts.md` documents directories and key JSONL/JSON files. |
-| Verification behavior | covered | `references/verify-phase.md` and `references/verify-prompt.md` define qualification and rejection behavior. |
-| Patch behavior | covered | `references/patch-phase.md` and `references/patch-prompt.md` define triage, worktree isolation, draft PR creation, and cleanup. |
-| Known issues/workarounds | partial | Resume, partial scans, skipped findings, and existing PR dedup are covered; CI follow-up and rate-limit recovery are not. |
-| Version/migration variance | partial | Current artifact names and script interfaces are documented; no formal migration path exists for old sweep directories. |
-
-## Decisions
-
-- Split phase detail out of `SKILL.md` so agents load only the current phase instructions.
-- Keep script interface documentation separate from phase runbooks because scripts are reused across phases and by resume workflows.
-- Describe verification and patch work in host-neutral terms while allowing parallel agent tasks when the host supports them.
-- Keep prompt templates as separate references because they are substituted into delegated verification and patch work.
-- Keep generated sweep artifacts under `.warden/sweeps/<run-id>/` so runs are resumable and isolated from normal source files.
-
-## Open Gaps
-
-- Add a redacted fixture sweep to validate the full workflow without touching real GitHub repositories.
-- Document rate-limit and permission failure recovery if these become common in real sweeps.
-- Add migration notes if artifact schemas change after users have existing sweep directories.
-- Consider adding a script-level dry-run mode for issue and PR creation.
-
-## Changelog
-
-- 2026-04-27: Reverse-engineered maintenance spec and split the distributed `warden-sweep` workflow into phase references.

package/skills/warden-sweep/SPEC.md

@@ -1,126 +0,0 @@
-# Warden Sweep Skill Specification
-
-## Intent
-
-The `warden-sweep` skill runs a full-repository Warden scan, verifies findings through deeper code tracing, and creates draft PRs for validated issues.
-
-It exists for batch remediation work where a normal targeted Warden run is too narrow. The workflow is intentionally conservative: scan broadly, verify before patching, deduplicate against existing PRs, and record every decision in sweep artifacts.
-
-## Scope
-
-In scope:
-
-- Scanning a repository file-by-file with Warden.
-- Extracting and normalizing Warden findings.
-- Verifying findings before any code changes are attempted.
-- Creating a tracking issue for the sweep.
-- Creating one draft PR per validated issue that passes patch triage.
-- Organizing reports, security findings, PR links, and resumable sweep state.
-
-Out of scope:
-
-- Replacing human review of generated PRs.
-- Applying fixes directly to the user's current branch.
-- Patching low-confidence or unverified findings.
-- Running generic codebase review without Warden scan artifacts.
-- Managing CI iteration after PR creation.
-
-## Users And Trigger Context
-
-- Primary users: maintainers asking an agent to perform broad Warden-backed repository cleanup.
-- Common user requests: "sweep the repo", "scan everything", "find all bugs", "full codebase review", "batch code analysis", "run Warden across the whole repository".
-- Should not trigger for: normal pre-commit Warden runs, single-file checks, generic code review, or PR feedback iteration.
-
-## Runtime Contract
-
-- Required first actions:
-  - Confirm the repository has the required tools: `warden`, `gh`, `git`, `jq`, and `uv`.
-  - Run `scripts/scan.py` from the repository root using the host skill-root path.
-  - Preserve the returned `runId` and `sweepDir`.
-  - Resume existing sweep artifacts instead of duplicating work when a sweep directory is provided.
-- Required outputs:
-  - Phase summaries after scan, verification, issue creation, patching, and organization.
-  - Final pointer to the generated summary report.
-  - Explicit counts for scanned files, timeouts/errors, verified/rejected findings, created/existing/failed PRs, and security findings.
-- Non-negotiable constraints:
-  - Verify findings before patching.
-  - Patch findings sequentially to avoid worktree and branch cross-contamination.
-  - Create draft PRs, not direct commits to the default branch.
-  - Record errors in sweep data and continue to the next finding when possible.
-  - Clean up worktrees after patch attempts.
-- Expected bundled files loaded at runtime:
-  - `references/script-interfaces.md`
-  - `references/scan-phase.md`
-  - `references/verify-phase.md`
-  - `references/issue-phase.md`
-  - `references/patch-phase.md`
-  - `references/organize-phase.md`
-  - `references/resume-and-artifacts.md`
-  - `references/verify-prompt.md`
-  - `references/patch-prompt.md`
-  - `scripts/*.py`
-
-## Source And Evidence Model
-
-Authoritative sources:
-
-- `skills/warden-sweep/SKILL.md` and bundled references.
-- `skills/warden-sweep/scripts/*.py`.
-- Warden JSONL output schema and renderer code in `packages/warden/src/cli/output/`.
-- GitHub CLI behavior for PRs, issues, labels, and repo metadata.
-
-Useful improvement sources:
-
-- positive examples: completed sweeps with verified findings, clean draft PRs, and accurate final reports
-- negative examples: duplicate PRs, false positive patches, failed worktree cleanup, incorrect artifact state, or patch contamination across findings
-- commit logs/changelogs: changes to Warden output, script behavior, or sweep artifact schema
-- issue or PR feedback: reviewer complaints about generated PR quality, false positives, or sweep noise
-- eval results: dry-run prompts for scan resume, verification, patch triage, and final organization
-
-Data that must not be stored:
-
-- secrets, credentials, or tokens
-- private customer data
-- raw issue/PR content unrelated to the sweep finding
-- unredacted sensitive code excerpts beyond what is needed in local sweep artifacts
-
-## Reference Architecture
-
-- `SKILL.md` contains the phase overview, routing table, universal constraints, and completion contract.
-- `SOURCES.md` contains source inventory, coverage, decisions, gaps, and changelog.
-- `references/` contains focused phase runbooks, prompt templates, script interfaces, and artifact layout.
-- `references/evidence/` is unused until durable examples are needed.
-- `scripts/` contains repeatable automation for scan, extraction, issue creation, PR indexing, reviewer selection, report generation, and organization.
-- `assets/` is unused.
-
-## Evaluation
-
-- Lightweight validation:
-  - Run the skill validator against `skills/warden-sweep`.
-  - Confirm every script mentioned in `SKILL.md` and references exists.
-  - Confirm every phase reference has one clear lookup purpose.
-- Deeper evaluation:
-  - Run a dry sweep in a small fixture repository when script or artifact behavior changes.
-  - Exercise resume paths for scan, verify, issue, patch, and organize phases.
-- Holdout examples:
-  - Store redacted false positive and duplicate-PR examples in `references/evidence/` if these failures recur.
-- Acceptance gates:
-  - Findings are verified before patching.
-  - Patch phase creates isolated branches and draft PRs.
-  - Existing overlapping PRs are detected before creating new PRs.
-  - Final artifacts are resumable and summarize errors separately from successful work.
-
-## Known Limitations
-
-- The workflow depends on external CLIs and repository permissions.
-- Verification and patching quality depends on the host agent's ability to inspect code deeply.
-- The skill uses host-agent delegation when available; hosts without parallel delegation can run the same verification steps serially.
-- Broad scans can be expensive and noisy if repository Warden configuration is too broad.
-
-## Maintenance Notes
-
-- Update `SKILL.md` when phase order, universal constraints, or routing changes.
-- Update `SOURCES.md` when source inventory, decisions, coverage, or known gaps change.
-- Update phase references when script arguments, output shapes, artifact schema, or error handling changes.
-- Update prompt templates when verification or patch quality failures recur.
-- Update `references/evidence/` when preserving redacted examples will improve future iterations.

package/skills/warden-sweep/references/issue-phase.md

@@ -1,24 +0,0 @@
-# Issue Phase
-
-Create a tracking issue that ties all generated PRs together and gives reviewers one overview.
-
-## Run
-
-```bash
-uv run <skill-root>/scripts/create_issue.py ${SWEEP_DIR}
-```
-
-## Process
-
-1. Parse the JSON stdout.
-2. Save `issueUrl` and `issueNumber`.
-3. If the script fails, show the error and continue to the patch phase. PRs can still be created without a tracking issue.
-4. Update the checklist: Phase 3 complete.
-
-## Report Template
-
-```markdown
-## Tracking Issue Created
-
-{issueUrl}
-```

package/skills/warden-sweep/references/organize-phase.md

@@ -1,31 +0,0 @@
-# Organize Phase
-
-Finalize sweep artifacts, security views, PR links, and the summary report.
-
-## Run
-
-```bash
-uv run <skill-root>/scripts/organize.py ${SWEEP_DIR}
-```
-
-## Process
-
-1. Parse the JSON stdout.
-2. Confirm `summary.md` and `data/report.json` were produced.
-3. If the script fails, show the error and note which phases completed.
-4. Update the checklist: Phase 5 complete.
-
-## Report Template
-
-```markdown
-## Sweep Complete
-
-| Metric | Count |
-|--------|-------|
-| Files scanned | {filesScanned} |
-| Findings verified | {verified} |
-| PRs created | {prsCreated} |
-| Security findings | {securityFindings} |
-
-Full report: `{summaryPath}`
-```

package/skills/warden-sweep/references/patch-phase.md

@@ -1,142 +0,0 @@
-# Patch Phase
-
-Create isolated fixes for verified findings and open draft PRs.
-
-## Contents
-
-- Rules
-- Setup
-- Per-Finding Process
-- Dedup Check
-- Worktree, Fix, Reviewers, And PR
-- Report Template
-
-## Rules
-
-- Patch high-severity and above.
-- Patch medium findings only when they come from bug-detection skills such as `code-review` or `security-review`.
-- Skip low and info findings.
-- Process findings sequentially.
-- Create one worktree and one branch per finding.
-- Clean up worktrees after success or failure.
-
-## Setup
-
-Index existing PRs before patching:
-
-```bash
-uv run <skill-root>/scripts/index_prs.py ${SWEEP_DIR}
-```
-
-Parse the JSON stdout and use `fileIndex` for dedup checks.
-
-Determine the default branch and fetch latest:
-
-```bash
-DEFAULT_BRANCH=$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')
-git fetch origin "${DEFAULT_BRANCH}"
-```
-
-## Per-Finding Process
-
-For each finding in `data/verified.jsonl`:
-
-1. If the finding ID already exists in `data/patches.jsonl`, skip it.
-2. Run the dedup check.
-3. Create a worktree.
-4. Apply the fix using `references/patch-prompt.md`.
-5. If the patch task returns `"status": "skipped"`, record an error, clean up the worktree, and continue.
-6. Find reviewers.
-7. Push the branch.
-8. Create a draft PR.
-9. Record the result in `data/patches.jsonl`.
-10. Clean up the worktree.
-
-## Dedup Check
-
-Use the file index from `index_prs.py`:
-
-1. File match: if no open Warden PR touches the finding file, proceed.
-2. Chunk overlap: if a PR touches the same file, read `data/pr-diffs/<number>.diff` and check whether changed hunks overlap or sit within roughly 10 lines of the finding range.
-3. Same concern: compare PR title and finding title/description.
-
-Skip the finding only when there is both chunk overlap and the PR addresses the same concern. Record it with `"status": "existing"` and the matching `prUrl`.
-
-## Worktree, Fix, Reviewers, And PR
-
-```bash
-BRANCH="warden-sweep/${RUN_ID}/${FINDING_ID}"
-WORKTREE="${SWEEP_DIR}/worktrees/${FINDING_ID}"
-git worktree add "${WORKTREE}" -b "${BRANCH}" "origin/${DEFAULT_BRANCH}"
-```
-
-Each finding branches from the default branch so PRs contain only the fix commit.
-
-Run patch work using the host agent's task/delegation mechanism when available. Read `references/patch-prompt.md` and substitute the finding values and worktree path into the `${...}` placeholders.
-
-If delegated tasks are not available, apply the prompt instructions yourself in the worktree.
-
-```bash
-uv run <skill-root>/scripts/find_reviewers.py "${FILE_PATH}"
-```
-
-```bash
-cd "${WORKTREE}" && git push -u origin HEAD:"${BRANCH}"
-```
-
-Create the PR with a short "what" summary followed by the finding description and verification reasoning:
-
-```bash
-gh pr create --draft \
-  --label "warden" \
-  --title "fix: ${TITLE}" \
-  --body "$(cat <<'EOF'
-${FIX_WHAT_DESCRIPTION}
-
-${DESCRIPTION}
-
-${REASONING}
-
-Automated fix for Warden finding ${FINDING_ID} (${SEVERITY}, detected by ${SKILL}).
-
-<!-- Only include the next line if Phase 3 succeeded and ISSUE_NUMBER is available -->
-Ref #${ISSUE_NUMBER}
-
-> This PR was auto-generated by a Warden Sweep (run ${RUN_ID}).
-> The finding has been validated through automated deep tracing,
-> but human confirmation is requested as this is batch work.
-EOF
-)" ${REVIEWERS}
-```
-
-## Record Result
-
-Append to `data/patches.jsonl`. Use `"created"` for successful PRs, not the patch task's `"applied"` status.
-
-```json
-{"findingId": "...", "prUrl": "https://...", "branch": "...", "reviewers": ["user1", "user2"], "filesChanged": ["..."], "status": "created|existing|error"}
-```
-
-Clean up:
-
-```bash
-cd "$(git rev-parse --show-toplevel)"
-git worktree remove "${WORKTREE}" --force
-```
-
-On failure at any step, write `"status": "error"` with an `"error"` message, clean up the worktree, and continue.
-
-Update the manifest: set `phases.patch` to `"complete"`.
-
-## Report Template
-
-```markdown
-## PRs Created
-
-**{created}** created, **{skipped}** skipped (existing), **{failed}** failed.
-
-| # | Finding | PR | Status |
-|---|---------|----|--------|
-| 1 | `security-review-a1b2c3d4` SQL injection in query builder | #142 | created |
-| 2 | `code-review-e5f6g7h8` Null pointer in handler | - | existing (#138) |
-```

package/skills/warden-sweep/references/patch-prompt.md

@@ -1,72 +0,0 @@
-Fix a verified code issue. You are working in a git worktree at: ${WORKTREE}
-
-## Finding
-- Title: ${TITLE}
-- File: ${FILE_PATH}:${START_LINE}
-- Description: ${DESCRIPTION}
-- Verification: ${REASONING}
-- Suggested Fix: ${FIX_DESCRIPTION}
-```diff
-${FIX_DIFF}
-```
-
-## Instructions
-
-### Step 1: Understand the code
-Read the file at ${WORKTREE}/${FILE_PATH}. Read at least 50 lines above and below the reported location. Trace callers and callees of the affected code using Grep/Glob to understand how it is used. Do NOT skip this step.
-
-### Step 2: Apply a minimal fix
-Apply the smallest change that addresses the finding. If the suggested diff doesn't apply cleanly, adapt it while preserving intent. Do NOT refactor surrounding code, rename variables, add comments, or make any change beyond what the finding requires.
-
-### Step 3: Write tests
-Write or update tests that verify the fix:
-- Follow existing test patterns (co-located files, same framework)
-- At minimum, write a test that would have caught the original bug
-- Test the specific edge case, not just the happy path
-
-Only modify the fix target and its test file.
-
-### Step 4: Self-review
-Before staging, run `git diff` in the worktree and review every changed line. Verify:
-1. The change addresses the specific finding described, not something else
-2. No unrelated code was modified (no drive-by cleanups, no formatting changes)
-3. Trace through changed code paths: does the fix introduce any new bug, null reference, type error, or broken import?
-4. Tests exercise the fix (the failure case), not just that the code runs
-
-If ANY check fails, fix the problem before proceeding. If the suggested fix is wrong or would introduce a regression you cannot resolve, do NOT commit. Instead, skip to the output step and report why.
-
-### Step 5: Commit
-Do NOT run tests locally. CI will validate the changes.
-
-Stage and commit with this exact message:
-
-fix: ${TITLE}
-
-Warden finding ${FINDING_ID}
-Severity: ${SEVERITY}
-
-Co-Authored-By: Warden <noreply@getsentry.com>
-
-### Step 6: Output
-Return ONLY valid JSON (no surrounding text). Use `"status": "applied"` if you committed a fix, or `"status": "skipped"` if you did not.
-
-```json
-{
-  "status": "applied",
-  "filesChanged": ["src/example.ts"],
-  "testFilesChanged": ["src/example.test.ts"],
-  "selfReview": "Verified the fix addresses the null check and test covers the failure case",
-  "skipReason": null
-}
-```
-
-When skipping:
-```json
-{
-  "status": "skipped",
-  "filesChanged": [],
-  "testFilesChanged": [],
-  "selfReview": null,
-  "skipReason": "The suggested fix would introduce a regression in the error handling path"
-}
-```

package/skills/warden-sweep/references/resume-and-artifacts.md

@@ -1,51 +0,0 @@
-# Resume And Artifacts
-
-Use this reference when resuming a partial sweep or inspecting generated files.
-
-## Resume Rules
-
-Each phase is incremental:
-
-1. Check `data/manifest.json` for phase state.
-2. For scan, pass `--sweep-dir` to `scan.py`.
-3. For verify, skip existing `data/verify/<id>.json` files.
-4. For issue, `create_issue.py` skips if `issueUrl` exists in the manifest.
-5. For patch, skip existing entries in `data/patches.jsonl`.
-6. For organize, rerun safely.
-
-Continue from the first incomplete phase. Do not start a new sweep unless the user asks for a clean run.
-
-## Output Directory Structure
-
-```text
-.warden/sweeps/<run-id>/
-  summary.md                        # Stats, key findings, PR links
-  findings/                         # One markdown per verified finding
-    <finding-id>.md
-  security/                         # Security-specific view
-    index.jsonl                     # Security findings index
-    <finding-id>.md                 # Copies of security findings
-  data/                             # Structured data for tooling
-    manifest.json                   # Run metadata, phase state
-    scan-index.jsonl                # Per-file scan tracking
-    all-findings.jsonl              # Every finding from scan
-    verified.jsonl                  # Findings that passed verification
-    rejected.jsonl                  # Findings that failed verification
-    patches.jsonl                   # Finding -> PR URL -> reviewers
-    existing-prs.json               # Cached open Warden PRs
-    report.json                     # Machine-readable summary
-    verify/                         # Individual verification results
-      <finding-id>.json
-    logs/                           # Warden JSONL logs per file
-      <hash>.jsonl
-    pr-diffs/                       # Cached PR diffs for dedup
-      <number>.diff
-```
-
-## Failure Handling
-
-- Preserve partial artifacts.
-- Record per-finding errors in the relevant JSONL file.
-- Distinguish timed-out files from errored files.
-- Clean up worktrees before retrying patch work.
-- Re-run organize after manual recovery to refresh reports.

package/skills/warden-sweep/references/scan-phase.md

@@ -1,46 +0,0 @@
-# Scan Phase
-
-Run Warden across repository files and collect normalized findings.
-
-## Run
-
-```bash
-uv run <skill-root>/scripts/scan.py
-```
-
-To scan only specific files:
-
-```bash
-uv run <skill-root>/scripts/scan.py src/foo.ts src/bar.ts
-```
-
-To resume a partial scan:
-
-```bash
-uv run <skill-root>/scripts/scan.py --sweep-dir .warden/sweeps/<run-id>
-```
-
-## Process
-
-1. Parse the JSON stdout.
-2. Save `runId` and `sweepDir`.
-3. Treat exit code `1` as fatal and stop.
-4. Treat exit code `2` as partial: report timed-out and errored files separately, then continue only if the user accepts the partial results.
-5. Render every finding from the `findings` array.
-6. Update the checklist: Phase 1 complete.
-
-## Report Template
-
-```markdown
-## Scan Complete
-
-Scanned **{filesScanned}** files, **{filesTimedOut}** timed out, **{filesErrored}** errors.
-
-### Findings ({totalFindings} total)
-
-| # | Severity | Skill | File | Title |
-|---|----------|-------|------|-------|
-| 1 | **HIGH** | security-review | `src/db/query.ts:42` | SQL injection in query builder |
-```
-
-Bold severity for high and above.