@sentry/warden 0.46.0 → 0.46.2

package/dist/reporting/provenance.js

@@ -0,0 +1,139 @@
+import { z } from 'zod';
+import { ConfidenceSchema, LocationSchema, SeveritySchema } from '../types/index.js';
+const FindingSnapshotSchema = z.object({
+    title: z.string(),
+    description: z.string(),
+    severity: SeveritySchema,
+    confidence: ConfidenceSchema.optional(),
+});
+const VerificationStageSchema = z.discriminatedUnion('outcome', [
+    z.object({
+        outcome: z.literal('revised'),
+        model: z.string().optional(),
+        evidence: z.string().optional(),
+        before: FindingSnapshotSchema,
+    }),
+]);
+const MergeStageSchema = z.object({
+    model: z.string().optional(),
+    absorbedFindingIds: z.array(z.string()),
+});
+export const FindingProvenanceSchema = z.object({
+    originSkillExecutionId: z.string().optional(),
+    originModel: z.string().optional(),
+    verification: VerificationStageSchema.optional(),
+    merge: MergeStageSchema.optional(),
+});
+export const DiscardedFindingSchema = z.object({
+    originSkillExecutionId: z.string().optional(),
+    stage: z.enum(['verification_rejected', 'merge_absorbed', 'dedupe_dropped']),
+    severity: SeveritySchema,
+    title: z.string(),
+    location: LocationSchema.optional(),
+    model: z.string().optional(),
+    reason: z.string().optional(),
+    survivorFindingId: z.string().optional(),
+});
+/**
+ * Same-run dedupe can recenter two different skill executions' survivor
+ * findings onto the same id (e.g. both matched against the same pre-existing
+ * comment), so `findingId` alone is not a safe map key: a second execution's
+ * event would silently overwrite or merge into the first's entry, and both
+ * exported skill rows would then read the same (wrong) provenance. Scoping
+ * the key to the owning execution keeps each skill row's provenance
+ * independent.
+ */
+export function provenanceKey(skillExecutionId, findingId) {
+    return `${skillExecutionId ?? ''}:${findingId}`;
+}
+/**
+ * Build per-finding provenance and the list of discarded candidates from
+ * captured `FindingProcessingEvent`s. Handles `verification`/`rejected`,
+ * `verification`/`revised`, `merge`/`merged`, and `dedupe`/`dropped` events —
+ * `fix_gate` events are out of scope here (they don't remove a finding, they
+ * strip a proposed fix from one that's kept).
+ *
+ * `poster.ts`'s `recenterReportFindingIds` keeps this lookup valid across
+ * cross-run dedupe: when it recenters a survivor's `id` onto a pre-existing
+ * comment's id, it remaps this same finding's id inside any already-captured
+ * `FindingProcessingEvent`s so the id this map is keyed by (and the id
+ * `output.ts` looks it up by) stay in sync.
+ */
+export function buildProvenanceAndDiscarded(executions) {
+    const provenanceByFindingId = new Map();
+    const discarded = [];
+    for (const { skillExecutionId, model, verificationModel, mergeModel, events } of executions) {
+        for (const event of events) {
+            if (event.stage === 'dedupe' && event.action === 'dropped') {
+                discarded.push({
+                    originSkillExecutionId: skillExecutionId,
+                    stage: 'dedupe_dropped',
+                    severity: event.finding.severity,
+                    title: event.finding.title,
+                    location: event.finding.location,
+                    model,
+                    reason: event.reason,
+                    survivorFindingId: event.replacement?.id,
+                });
+                continue;
+            }
+            if (event.stage === 'verification' && event.action === 'rejected') {
+                discarded.push({
+                    originSkillExecutionId: skillExecutionId,
+                    stage: 'verification_rejected',
+                    severity: event.finding.severity,
+                    title: event.finding.title,
+                    location: event.finding.location,
+                    model: verificationModel,
+                    reason: event.reason,
+                });
+                continue;
+            }
+            if (event.stage === 'verification' && event.action === 'revised' && event.replacement) {
+                const key = provenanceKey(skillExecutionId, event.replacement.id);
+                provenanceByFindingId.set(key, {
+                    ...provenanceByFindingId.get(key),
+                    originSkillExecutionId: skillExecutionId,
+                    originModel: model,
+                    verification: {
+                        outcome: 'revised',
+                        model: verificationModel,
+                        evidence: event.reason,
+                        before: {
+                            title: event.finding.title,
+                            description: event.finding.description,
+                            severity: event.finding.severity,
+                            confidence: event.finding.confidence,
+                        },
+                    },
+                });
+                continue;
+            }
+            if (event.stage === 'merge' && event.action === 'merged' && event.replacement) {
+                discarded.push({
+                    originSkillExecutionId: skillExecutionId,
+                    stage: 'merge_absorbed',
+                    severity: event.finding.severity,
+                    title: event.finding.title,
+                    location: event.finding.location,
+                    model: mergeModel,
+                    reason: event.reason,
+                    survivorFindingId: event.replacement.id,
+                });
+                const key = provenanceKey(skillExecutionId, event.replacement.id);
+                const existing = provenanceByFindingId.get(key);
+                provenanceByFindingId.set(key, {
+                    ...existing,
+                    originSkillExecutionId: existing?.originSkillExecutionId ?? skillExecutionId,
+                    originModel: existing?.originModel ?? model,
+                    merge: {
+                        model: mergeModel,
+                        absorbedFindingIds: [...(existing?.merge?.absorbedFindingIds ?? []), event.finding.id],
+                    },
+                });
+            }
+        }
+    }
+    return { provenanceByFindingId, discarded };
+}
+//# sourceMappingURL=provenance.js.map

package/dist/reporting/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/reporting/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGrF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,cAAc;IACxB,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC9D,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,MAAM,EAAE,qBAAqB;KAC9B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAC5E,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAqBH;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,gBAAoC,EAAE,SAAiB;IACnF,OAAO,GAAG,gBAAgB,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAoC;IAC9E,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IAEzC,KAAK,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5F,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3D,SAAS,CAAC,IAAI,CAAC;oBACb,sBAAsB,EAAE,gBAAgB;oBACxC,KAAK,EAAE,gBAAgB;oBACvB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;oBAChC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;oBAC1B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;oBAChC,KAAK;oBACL,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,iBAAiB,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE;iBACzC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClE,SAAS,CAAC,IAAI,CAAC;oBACb,sBAAsB,EAAE,gBAAgB;oBACxC,KAAK,EAAE,uBAAuB;oBAC9B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;oBAChC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;oBAC1B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;oBAChC,KAAK,EAAE,iBAAiB;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtF,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAClE,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC7B,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;oBACjC,sBAAsB,EAAE,gBAAgB;oBACxC,WAAW,EAAE,KAAK;oBAClB,YAAY,EAAE;wBACZ,OAAO,EAAE,SAAS;wBAClB,KAAK,EAAE,iBAAiB;wBACxB,QAAQ,EAAE,KAAK,CAAC,MAAM;wBACtB,MAAM,EAAE;4BACN,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;4BAC1B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;4BACtC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;4BAChC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;yBACrC;qBACF;iBACF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC9E,SAAS,CAAC,IAAI,CAAC;oBACb,sBAAsB,EAAE,gBAAgB;oBACxC,KAAK,EAAE,gBAAgB;oBACvB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;oBAChC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;oBAC1B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;oBAChC,KAAK,EAAE,UAAU;oBACjB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;iBACxC,CAAC,CAAC;gBAEH,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAClE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChD,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC7B,GAAG,QAAQ;oBACX,sBAAsB,EAAE,QAAQ,EAAE,sBAAsB,IAAI,gBAAgB;oBAC5E,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,KAAK;oBAC3C,KAAK,EAAE;wBACL,KAAK,EAAE,UAAU;wBACjB,kBAAkB,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,kBAAkB,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;qBACvF;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC"}

package/dist/service/findings.d.ts

@@ -1,4 +1,4 @@
-import type { FindingsOutput } from '../action/reporting/output.js';
+import type { FindingsOutput } from '../reporting/output.js';
 import type { ResolvedServiceOptions } from './options.js';
 /** Convert an in-memory Action findings result into the current service envelope. */
 export declare function buildFindingsServiceRunEnvelope(output: FindingsOutput, service: ResolvedServiceOptions, source: 'action' | 'replay'): {

package/dist/service/findings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/service/findings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAGpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAwI3D,qFAAqF;AACrF,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,QAAQ,GAAG,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsD5B"}
+{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/service/findings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAwI3D,qFAAqF;AACrF,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,QAAQ,GAAG,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsD5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/warden",
-  "version": "0.46.0",
+  "version": "0.46.2",
   "description": "Event-driven agent that reacts to GitHub events and executes code-review skills",
   "type": "module",
   "main": "dist/index.js",
@@ -51,7 +51,7 @@
     "smol-toml": "^1.6.1",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@sentry/warden-service-api": "0.46.0"
+    "@sentry/warden-service-api": "0.46.2"
   },
   "engines": {
     "node": ">=20.0.0"