@sentry/warden 0.45.0 → 0.46.1

package/dist/cli/main.js

@@ -1,16 +1,18 @@
 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
-import { join, relative, resolve } from 'node:path';
+import { extname, join, relative, resolve } from 'node:path';
 import { config as dotenvConfig } from 'dotenv';
 import { Sentry, flushSentry, setRepositoryScope, emitRunMetric, getTraceId, initSentry } from '../sentry.js';
 import { emptyToUndefined, loadWardenConfigFile, resolveSkillConfigs } from '../config/loader.js';
 import { verifyAuth } from '../sdk/runner.js';
 import { findInvalidPiModelSelector as findInvalidPiModelSelectorTarget, invalidPiModelSelectorMessage, } from '../sdk/runtimes/model-selectors.js';
+import { configureWardenOffline, isWardenOffline } from '../sdk/offline.js';
 import { mapExtractionErrorCode } from '../sdk/errors.js';
 import { aggregateAuxiliaryUsageAttribution, mergeAuxiliaryUsage } from '../sdk/usage.js';
 import { resolveSkillAsync, SkillLoaderError } from '../skills/loader.js';
 import { matchTrigger, filterContextByPaths, shouldFail, countFindingsAtOrAbove } from '../triggers/matcher.js';
 import { filterFindings } from '../types/index.js';
-import { DEFAULT_CONCURRENCY, getAnthropicApiKey } from '../utils/index.js';
+import { DEFAULT_CONCURRENCY, getAnthropicApiKey, getVersion } from '../utils/index.js';
+import { buildServiceRunEnvelope, publishRunFailOpen, recallMemoryFailOpen, renderHistoricalMemory, resolveServiceOptions, } from '../service/index.js';
 import { isRepoRelativePath, normalizePath, resolveConfigInput } from '../utils/path.js';
 import { parseCliArgs, showVersion, classifyTargets, expandTargetFileReferences } from './args.js';
 import { showHelp } from './help.js';
@@ -26,6 +28,7 @@ import { runSetupApp } from './commands/setup-app.js';
 import { runSync } from './commands/sync.js';
 import { runRuns } from './commands/runs.js';
 import { runBuild, runImprove } from './commands/build.js';
+import { runServiceCommand } from './commands/service.js';
 import { generatedSkillDefinitionRootExists, resolveGeneratedSkillTarget, } from '../skill-builder/definition.js';
 /**
  * Global abort controller for graceful shutdown on SIGINT.
@@ -95,6 +98,7 @@ function resolveLocalReviewBase(configDefaultBranch, repoPath) {
 function emitEmptyRunLog(repoPath, options, error) {
     const runId = generateRunId();
     const timestamp = new Date();
+    const traceId = getTraceId();
     let headSha;
     try {
         headSha = getHeadSha(repoPath);
@@ -104,7 +108,7 @@ function emitEmptyRunLog(repoPath, options, error) {
     }
     const content = renderJsonlString([], 0, {
         runId,
-        traceId: getTraceId(),
+        traceId,
         timestamp,
         headSha,
         error,
@@ -129,6 +133,7 @@ function emitEmptyRunLog(repoPath, options, error) {
     if (options.json) {
         process.stdout.write(content);
     }
+    return { runId, timestamp, traceId, headSha };
 }
 function initializeRunLog(args) {
     const { repoPath, runId, timestamp, traceId, headSha, model, outputPath, reporter, startTime } = args;
@@ -560,9 +565,15 @@ function loadOptionalConfig(options, repoPath) {
         : repoPath
             ? resolve(repoPath, 'warden.toml')
             : null;
-    return configPath && existsSync(configPath)
+    const config = configPath && existsSync(configPath)
         ? loadWardenConfigFile(configPath)
         : null;
+    applyWardenOfflinePolicy(options, config);
+    return config;
+}
+/** Apply durable config and CLI offline intent for Warden network access. */
+function applyWardenOfflinePolicy(options, config) {
+    configureWardenOffline(Boolean(options.offline || config?.defaults?.offline));
 }
 /**
  * Find the first Pi runner option using a model ID that is not provider/model.
@@ -578,11 +589,12 @@ function reportInvalidPiModelSelector(reporter, invalid) {
     reporter.tip('Set a Pi model selector such as anthropic/claude-sonnet-4-6.');
 }
 function emitInvalidPiModelSelectorRunLog(repoPath, options, invalid) {
-    emitEmptyRunLog(repoPath, options, {
+    const error = {
         code: 'invalid_model_selector',
         message: invalidPiModelSelectorMessage(invalid),
         timestamp: new Date().toISOString(),
-    });
+    };
+    return { run: emitEmptyRunLog(repoPath, options, error), error };
 }
 function verifyClaudeAuthForRun(args) {
     const { apiKey, pathToClaudeCodeExecutable, reporter, repoPath, options } = args;
@@ -591,17 +603,17 @@ function verifyClaudeAuthForRun(args) {
     }
     try {
         verifyAuth({ apiKey, pathToClaudeCodeExecutable });
-        return true;
+        return undefined;
     }
     catch (error) {
         const message = error.message;
         reporter.error(message);
-        emitEmptyRunLog(repoPath, options, {
+        const skillError = {
             code: 'auth_failed',
             message,
             timestamp: new Date().toISOString(),
-        });
-        return false;
+        };
+        return { run: emitEmptyRunLog(repoPath, options, skillError), error: skillError };
     }
 }
 function renderSkillRunHeader(args) {
@@ -621,7 +633,7 @@ async function createDirectSkillTask(args) {
     try {
         skill = await resolveSkillAsync(spec.skill, repoPath, {
             remote: spec.remote,
-            offline: options.offline,
+            offline: isWardenOffline(),
         });
     }
     catch (error) {
@@ -794,6 +806,146 @@ async function outputResultsAndHandleFixes(processed, options, reporter, runLog,
     }
     return 0;
 }
+function resolveCliService(options, config, reporter) {
+    return resolveServiceOptions({
+        explicit: {
+            url: options.serviceUrl,
+            data: options.serviceData,
+            memory: options.serviceMemory,
+            timeoutMs: options.serviceTimeoutMs,
+            disabled: options.noService,
+        },
+        config: config?.service,
+        onWarning: (message) => reporter.warning(message),
+    });
+}
+/** Convert the finalized CLI exit status into its service run outcome. */
+export function cliRunOutcome(exitCode) {
+    if (exitCode === 130)
+        return 'cancelled';
+    if (exitCode === 0)
+        return 'success';
+    return 'failure';
+}
+async function publishCliRun(args) {
+    if (!args.service)
+        return;
+    const service = args.service;
+    const repository = args.context.repository;
+    await publishRunFailOpen(service, {
+        clientRunId: args.runLog.baseRun.runId,
+        build: () => buildServiceRunEnvelope({
+            service,
+            clientRunId: args.runLog.baseRun.runId,
+            source: 'cli',
+            wardenVersion: getVersion(),
+            startedAt: new Date(args.runLog.baseRun.timestamp),
+            completedAt: new Date(new Date(args.runLog.baseRun.timestamp).getTime() + args.totalDuration),
+            outcome: cliRunOutcome(args.exitCode),
+            repository: {
+                provider: 'local',
+                owner: repository.owner,
+                name: repository.name,
+                fullName: repository.fullName,
+            },
+            reports: args.processed.reports.map((report, index) => ({
+                executionId: `${index + 1}:${report.skill}`,
+                report,
+            })),
+            ...(args.recalledMemories?.length ? { recalledMemories: [...args.recalledMemories] } : {}),
+            ...(args.memoryRecallId ? { memoryRecallId: args.memoryRecallId } : {}),
+            ...(args.runLog.baseRun.traceId ? { traceId: args.runLog.baseRun.traceId } : {}),
+            ...(args.runLog.baseRun.headSha ? { headSha: args.runLog.baseRun.headSha } : {}),
+            event: args.context.eventType,
+        }),
+    }, (message) => args.reporter.warning(message));
+}
+async function publishCliEarlyFailure(args) {
+    if (!args.service)
+        return;
+    const service = args.service;
+    const completedAt = new Date();
+    const repository = args.context.repository;
+    await publishRunFailOpen(service, {
+        clientRunId: args.run.runId,
+        build: () => buildServiceRunEnvelope({
+            service: { ...service, data: 'metrics', memory: false },
+            clientRunId: args.run.runId,
+            source: 'cli',
+            wardenVersion: getVersion(),
+            startedAt: args.run.timestamp,
+            completedAt,
+            outcome: 'failure',
+            repository: {
+                provider: 'local',
+                owner: repository.owner,
+                name: repository.name,
+                fullName: repository.fullName,
+            },
+            reports: args.skills.map((skill, index) => ({
+                executionId: `${index + 1}:${skill.skill}`,
+                report: {
+                    skill: skill.skill,
+                    summary: 'Skill did not start',
+                    findings: [],
+                    ...(skill.model ? { model: skill.model } : {}),
+                    ...(skill.runtime ? { runtime: skill.runtime } : {}),
+                    durationMs: Math.max(0, completedAt.getTime() - args.run.timestamp.getTime()),
+                    error: args.error,
+                },
+            })),
+            ...(args.run.traceId ? { traceId: args.run.traceId } : {}),
+            ...(args.run.headSha ? { headSha: args.run.headSha } : {}),
+            event: args.context.eventType,
+        }),
+    }, (message) => args.reporter.warning(message));
+}
+async function publishCliEmptyRun(args) {
+    if (!args.service)
+        return;
+    const service = args.service;
+    const repository = args.context.repository;
+    await publishRunFailOpen(service, {
+        clientRunId: args.run.runId,
+        build: () => buildServiceRunEnvelope({
+            service,
+            clientRunId: args.run.runId,
+            source: 'cli',
+            wardenVersion: getVersion(),
+            startedAt: args.run.timestamp,
+            completedAt: new Date(),
+            outcome: 'skipped',
+            repository: {
+                provider: 'local',
+                owner: repository.owner,
+                name: repository.name,
+                fullName: repository.fullName,
+            },
+            reports: [],
+            ...(args.run.traceId ? { traceId: args.run.traceId } : {}),
+            ...(args.run.headSha ? { headSha: args.run.headSha } : {}),
+            event: args.context.eventType,
+        }),
+    }, (message) => args.reporter.warning(message));
+}
+async function recallCliMemory(args) {
+    if (!args.service?.memory)
+        return undefined;
+    const paths = args.context.pullRequest?.files.map((file) => file.filename) ?? [];
+    return recallMemoryFailOpen(args.service, {
+        protocolVersion: 1,
+        clientRecallId: generateRunId(),
+        repository: {
+            provider: 'local',
+            owner: args.context.repository.owner,
+            name: args.context.repository.name,
+            fullName: args.context.repository.fullName,
+        },
+        skills: [...args.skills],
+        languages: [...new Set(paths.map((path) => extname(path).slice(1)).filter(Boolean))],
+        paths,
+    });
+}
 /** Run one or more skills against an already constructed review context. */
 export async function runSkills(context, options, reporter) {
     const cwd = process.cwd();
@@ -802,6 +954,7 @@ export async function runSkills(context, options, reporter) {
     const apiKey = getAnthropicApiKey();
     const repoPath = findRepoPath(cwd);
     const config = loadOptionalConfig(options, repoPath);
+    const service = resolveCliService(options, config, reporter);
     const defaultModel = resolveCliDefaultModel(config, options.model);
     const defaultAuxiliaryModel = resolveCliDefaultAuxiliaryModel(config);
     const defaultSynthesisModel = resolveCliDefaultSynthesisModel(config);
@@ -873,22 +1026,39 @@ export async function runSkills(context, options, reporter) {
     emitRunMetric();
     // Handle case where no skills to run
     if (skillsToRun.length === 0) {
-        emitEmptyRunLog(repoPath ?? cwd, options);
+        const run = emitEmptyRunLog(repoPath ?? cwd, options);
+        await publishCliEmptyRun({ service, context, run, reporter });
         if (!options.json) {
             reporter.warning('No triggers matched for the changed files');
             reporter.tip('Specify a skill explicitly: warden <target> --skill <name>');
         }
         return 0;
     }
-    if (needsClaudeAuth(skillsToRun) && !verifyClaudeAuthForRun({
-        apiKey,
-        pathToClaudeCodeExecutable,
-        reporter,
-        repoPath: repoPath ?? cwd,
-        options,
-    })) {
+    const authFailure = needsClaudeAuth(skillsToRun)
+        ? verifyClaudeAuthForRun({
+            apiKey,
+            pathToClaudeCodeExecutable,
+            reporter,
+            repoPath: repoPath ?? cwd,
+            options,
+        })
+        : undefined;
+    if (authFailure) {
+        await publishCliEarlyFailure({
+            service,
+            context,
+            ...authFailure,
+            skills: skillsToRun,
+            reporter,
+        });
         return 1;
     }
+    const recall = await recallCliMemory({
+        service,
+        context,
+        skills: skillsToRun.map((skill) => skill.skill),
+    });
+    const recalledMemories = recall?.memories ?? [];
     // Build skill tasks
     // Model precedence: defaults.agent.model > defaults.model > CLI flag > WARDEN_MODEL env var > SDK default
     // sdkModel is undefined when no model is explicitly configured (lets SDK use its default).
@@ -915,6 +1085,7 @@ export async function runSkills(context, options, reporter) {
             config?.defaults?.auxiliaryMaxRetries,
         verifyFindings: config?.defaults?.verification?.enabled !== false,
         captureTraces: options.traces,
+        historicalEvidence: renderHistoricalMemory(recalledMemories),
     };
     const specs = skillsToRun.map(({ skill, remote, filters, ...skillOptions }) => ({
         name: skill,
@@ -927,7 +1098,8 @@ export async function runSkills(context, options, reporter) {
     const invalidModelSelector = findInvalidPiModelSelector(specs);
     if (invalidModelSelector) {
         reportInvalidPiModelSelector(reporter, invalidModelSelector);
-        emitInvalidPiModelSelectorRunLog(repoPath ?? cwd, options, invalidModelSelector);
+        const failure = emitInvalidPiModelSelectorRunLog(repoPath ?? cwd, options, invalidModelSelector);
+        await publishCliEarlyFailure({ service, context, ...failure, skills: skillsToRun, reporter });
         return 1;
     }
     let tasks;
@@ -944,11 +1116,13 @@ export async function runSkills(context, options, reporter) {
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         reporter.error(message);
-        emitEmptyRunLog(repoPath ?? cwd, options, {
+        const skillError = {
             code: 'unknown',
             message,
             timestamp: new Date().toISOString(),
-        });
+        };
+        const run = emitEmptyRunLog(repoPath ?? cwd, options, skillError);
+        await publishCliEarlyFailure({ service, context, run, error: skillError, skills: skillsToRun, reporter });
         return 1;
     }
     // Open the run's JSONL log before launching skills so `warden runs
@@ -991,7 +1165,19 @@ export async function runSkills(context, options, reporter) {
     const totalDuration = Date.now() - startTime;
     const effectiveMinConfidence = options.minConfidence ?? config?.defaults?.minConfidence ?? 'medium';
     const processed = processTaskResults(results, options.reportOn, effectiveMinConfidence);
-    return outputResultsAndHandleFixes(processed, options, reporter, runLog, totalDuration, failFastController?.signal.aborted);
+    const exitCode = await outputResultsAndHandleFixes(processed, options, reporter, runLog, totalDuration, failFastController?.signal.aborted);
+    await publishCliRun({
+        service,
+        context,
+        processed,
+        runLog,
+        totalDuration,
+        exitCode,
+        reporter,
+        recalledMemories,
+        memoryRecallId: recall?.clientRecallId,
+    });
+    return exitCode;
 }
 async function runFileMode(filePatterns, options, reporter) {
     const cwd = process.cwd();
@@ -1063,6 +1249,7 @@ async function runGitRefMode(gitRef, options, reporter) {
     // Load config to get defaultBranch if available
     const configPath = resolveConfigPath(options, repoPath);
     const config = existsSync(configPath) ? loadWardenConfigFile(configPath) : null;
+    applyWardenOfflinePolicy(options, config);
     // Build context from local git
     reporter.startContext(`Analyzing changes from ${gitRef}...`);
     const context = buildLocalEventContext({
@@ -1108,6 +1295,8 @@ async function runConfigMode(options, reporter) {
     }
     // Load config
     const config = loadWardenConfigFile(configPath);
+    applyWardenOfflinePolicy(options, config);
+    const service = resolveCliService(options, config, reporter);
     // Build context from local git. By default, mirror PR-style analysis:
     // compare the configured/default branch merge base to HEAD.
     const localReviewBase = resolveLocalReviewBase(config.defaults?.defaultBranch, repoPath);
@@ -1128,7 +1317,8 @@ async function runConfigMode(options, reporter) {
         return 1;
     }
     if (pullRequest.files.length === 0) {
-        emitEmptyRunLog(repoPath, options);
+        const run = emitEmptyRunLog(repoPath, options);
+        await publishCliEmptyRun({ service, context, run, reporter });
         if (!options.json) {
             if (options.staged) {
                 reporter.renderEmptyState('No staged changes found');
@@ -1161,7 +1351,8 @@ async function runConfigMode(options, reporter) {
     }
     const triggersToRun = [...seen.values()];
     if (triggersToRun.length === 0) {
-        emitEmptyRunLog(repoPath, options);
+        const run = emitEmptyRunLog(repoPath, options);
+        await publishCliEmptyRun({ service, context, run, reporter });
         if (!options.json) {
             reporter.blank();
             if (options.skill) {
@@ -1181,15 +1372,35 @@ async function runConfigMode(options, reporter) {
     const triggerRuntimes = triggersToRun.map((trigger) => ({
         runtime: options.runtime ?? trigger.runtime,
     }));
-    if (needsClaudeAuth(triggerRuntimes) && !verifyClaudeAuthForRun({
-        apiKey,
-        pathToClaudeCodeExecutable,
-        reporter,
-        repoPath,
-        options,
-    })) {
+    const authFailure = needsClaudeAuth(triggerRuntimes)
+        ? verifyClaudeAuthForRun({
+            apiKey,
+            pathToClaudeCodeExecutable,
+            reporter,
+            repoPath,
+            options,
+        })
+        : undefined;
+    if (authFailure) {
+        await publishCliEarlyFailure({
+            service,
+            context,
+            ...authFailure,
+            skills: triggersToRun.map((trigger) => ({
+                skill: trigger.skill,
+                model: trigger.model,
+                runtime: options.runtime ?? trigger.runtime,
+            })),
+            reporter,
+        });
         return 1;
     }
+    const recall = await recallCliMemory({
+        service,
+        context,
+        skills: triggersToRun.map((trigger) => trigger.skill),
+    });
+    const recalledMemories = recall?.memories ?? [];
     // Build trigger tasks
     const effectiveMinConfidence = options.minConfidence ?? config.defaults?.minConfidence ?? 'medium';
     const specs = triggersToRun.map((trigger) => ({
@@ -1219,12 +1430,24 @@ async function runConfigMode(options, reporter) {
             auxiliaryMaxRetries: trigger.auxiliaryMaxRetries,
             verifyFindings: trigger.verifyFindings,
             captureTraces: options.traces,
+            historicalEvidence: renderHistoricalMemory(recalledMemories),
         },
     }));
     const invalidModelSelector = findInvalidPiModelSelector(specs);
     if (invalidModelSelector) {
         reportInvalidPiModelSelector(reporter, invalidModelSelector);
-        emitInvalidPiModelSelectorRunLog(repoPath, options, invalidModelSelector);
+        const failure = emitInvalidPiModelSelectorRunLog(repoPath, options, invalidModelSelector);
+        await publishCliEarlyFailure({
+            service,
+            context,
+            ...failure,
+            skills: triggersToRun.map((trigger) => ({
+                skill: trigger.skill,
+                model: trigger.model,
+                runtime: options.runtime ?? trigger.runtime,
+            })),
+            reporter,
+        });
         return 1;
     }
     let tasks;
@@ -1241,10 +1464,23 @@ async function runConfigMode(options, reporter) {
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         reporter.error(message);
-        emitEmptyRunLog(repoPath, options, {
+        const skillError = {
             code: 'unknown',
             message,
             timestamp: new Date().toISOString(),
+        };
+        const run = emitEmptyRunLog(repoPath, options, skillError);
+        await publishCliEarlyFailure({
+            service,
+            context,
+            run,
+            error: skillError,
+            skills: triggersToRun.map((trigger) => ({
+                skill: trigger.skill,
+                model: trigger.model,
+                runtime: options.runtime ?? trigger.runtime,
+            })),
+            reporter,
         });
         return 1;
     }
@@ -1291,7 +1527,19 @@ async function runConfigMode(options, reporter) {
     // Process results and output
     const totalDuration = Date.now() - startTime;
     const processed = processTaskResults(results, options.reportOn, effectiveMinConfidence);
-    return outputResultsAndHandleFixes(processed, options, reporter, runLog, totalDuration, failFastController?.signal.aborted);
+    const exitCode = await outputResultsAndHandleFixes(processed, options, reporter, runLog, totalDuration, failFastController?.signal.aborted);
+    await publishCliRun({
+        service,
+        context,
+        processed,
+        runLog,
+        totalDuration,
+        exitCode,
+        reporter,
+        recalledMemories,
+        memoryRecallId: recall?.clientRecallId,
+    });
+    return exitCode;
 }
 async function runDirectSkillMode(options, reporter) {
     const cwd = process.cwd();
@@ -1307,6 +1555,7 @@ async function runDirectSkillMode(options, reporter) {
     // Load config to get defaultBranch if available
     const configPath = resolveConfigPath(options, repoPath);
     const config = existsSync(configPath) ? loadWardenConfigFile(configPath) : null;
+    applyWardenOfflinePolicy(options, config);
     // Build context from local git. By default, mirror PR-style analysis:
     // compare the configured/default branch merge base to HEAD.
     const localReviewBase = resolveLocalReviewBase(config?.defaults?.defaultBranch, repoPath);
@@ -1391,7 +1640,7 @@ async function runCommand(options, reporter) {
 }
 /** Parse CLI input, dispatch the selected command, and perform shutdown cleanup. */
 export async function main() {
-    const { command, options, helpTarget, setupAppOptions, runsOptions } = parseCliArgs();
+    const { command, options, helpTarget, setupAppOptions, runsOptions, serviceOptions } = parseCliArgs();
     if (command === 'help') {
         showHelp(helpTarget);
         process.exit(0);
@@ -1455,6 +1704,12 @@ export async function main() {
                     process.exit(1);
                 }
                 return runRuns(runsOptions, options, reporter);
+            case 'service':
+                if (!serviceOptions) {
+                    reporter.error('Missing service command options');
+                    return 1;
+                }
+                return runServiceCommand(serviceOptions, options, reporter);
             case 'build':
                 return runBuild(options, reporter, { abortController, interrupted });
             case 'improve':