@vypdev/copilot 3.9.3 → 3.10.0

package/action.yml

@@ -53,6 +53,9 @@ inputs:
   pre-branch-sdd:
     description: "Require a validated SDD first commit for started feature and contract-change issues. Requires issue-managed-branches."
     default: "false"
+  verification-setup:
+    description: "Run the trusted repository composite action before repository verification in generated workflows. Disabled by default."
+    default: "false"
   issue-workflow-profile:
     description: "JSON profile of enabled issue workflows."
     default: ""
@@ -558,6 +561,8 @@ outputs:
 runs:
   using: "node24"
   main: "build/github_action/index.js"
+  post: "build/github_action/index.js"
+  post-if: "always() && env.COPILOT_NATIVE_PHASE != ''"
 branding:
   icon: "cpu"
   color: "blue"

package/build/api/index.js

@@ -68,6 +68,45 @@ function runAtApplicationErrorBoundary(operation) {
 }
 
 
+/***/ }),
+
+/***/ 2937:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.BugbotMutationError = void 0;
+exports.bugbotMutationError = bugbotMutationError;
+const application_error_1 = __nccwpck_require__(5999);
+const pull_request_review_errors_1 = __nccwpck_require__(6445);
+class BugbotMutationError extends application_error_1.ApplicationError {
+    constructor(diagnostic) {
+        super(diagnostic.errorCode, `Bugbot ${diagnostic.stage} failed: operation=${diagnostic.operation}; finding=${diagnostic.findingId}; affected=${diagnostic.affectedCount}; ${diagnostic.providerStatus}; provider-reference=${diagnostic.providerReference}. Completed effects are retained; correct the named cause and recheck the same target.`);
+        this.diagnostic = diagnostic;
+    }
+}
+exports.BugbotMutationError = BugbotMutationError;
+function bugbotMutationError(cause, stage, findingIds, fallback, affectedCount = findingIds.length) {
+    if (cause instanceof BugbotMutationError)
+        return cause;
+    const provider = cause instanceof pull_request_review_errors_1.PullRequestReviewOperationError ? cause : undefined;
+    const status = provider?.providerStatus;
+    const errorCode = status === 401 ? 'authorization.credential-invalid' : status === 403 ? 'authorization.denied'
+        : status === 404 ? 'provider.not-found' : status === 409 ? 'provider.conflict'
+            : status === 429 ? 'provider.rate-limited'
+                : status === 408 || status === 425 ? 'provider.unavailable'
+                    : status && status < 500 ? 'provider.contract-invalid' : 'provider.unavailable';
+    const first = findingIds[0];
+    return new BugbotMutationError(Object.freeze({
+        stage, operation: provider?.operation ?? fallback,
+        findingId: typeof first === 'string' && /^[A-Za-z0-9_./:-]{1,200}$/.test(first) ? first : 'unavailable',
+        affectedCount: Math.min(affectedCount, 10000),
+        providerStatus: status ? `http-${status}` : 'http-unavailable',
+        providerReference: provider?.providerReference ?? 'unavailable', errorCode,
+    }));
+}
+
+
 /***/ }),
 
 /***/ 601:
@@ -796,6 +835,7 @@ exports.BUGBOT_MESSAGE_IDS = Object.freeze([
     'bugbot.overflow.body',
     'bugbot.common.more',
     'bugbot.diagnostic.operationFailed',
+    'bugbot.diagnostic.findingMutationFailed',
     'bugbot.diagnostic.identityUnavailable',
     'bugbot.diagnostic.pullRequestCommentsFailed',
     'bugbot.diagnostic.reviewThreadsFailed',
@@ -881,6 +921,7 @@ const ENGLISH_MESSAGES = Object.freeze({
     'bugbot.overflow.heading': 'More findings (comment limit)',
     'bugbot.overflow.body': Object.freeze({ one: 'There is {count} more finding that was not published as an individual comment. Review locally or in the full diff to see the list.', other: 'There are {count} more findings that were not published as individual comments. Review locally or in the full diff to see the list.' }),
     'bugbot.common.more': Object.freeze({ one: 'and {count} more.', other: 'and {count} more.' }),
+    'bugbot.diagnostic.findingMutationFailed': 'Finding mutation failed: stage={stage}; operation={operation}; finding={findingId}; affected={affectedCount}; {providerStatus}; provider reference={providerReference}. Completed effects are retained. Correct access/contract errors before retrying; for transient failures restore provider availability, then recheck the same PR. Recheck reconciles existing reviews and threads.',
     'bugbot.diagnostic.operationFailed': 'Bugbot could not complete one or more finding mutations.',
     'bugbot.diagnostic.identityUnavailable': 'The authenticated Bugbot identity is unavailable.',
     'bugbot.diagnostic.pullRequestCommentsFailed': 'Unable to re-read pull request review comments.',
@@ -970,6 +1011,7 @@ const SPANISH_MESSAGES = Object.freeze({
     'bugbot.overflow.heading': 'Más hallazgos (límite de comentarios)',
     'bugbot.overflow.body': Object.freeze({ one: 'Hay {count} hallazgo más que no se publicó como comentario individual. Revísalo localmente o en el diff completo para consultar la lista.', many: 'Hay {count} hallazgos más que no se publicaron como comentarios individuales. Revísalos localmente o en el diff completo para consultar la lista.', other: 'Hay {count} hallazgos más que no se publicaron como comentarios individuales. Revísalos localmente o en el diff completo para consultar la lista.' }),
     'bugbot.common.more': Object.freeze({ one: 'y {count} más.', many: 'y {count} más.', other: 'y {count} más.' }),
+    'bugbot.diagnostic.findingMutationFailed': 'Falló una mutación: fase={stage}; operación={operation}; hallazgo={findingId}; afectados={affectedCount}; {providerStatus}; referencia del proveedor={providerReference}. Se conservan los efectos completados. Corrige acceso/contrato antes de reintentar; para fallos transitorios restaura el proveedor y revisa la misma PR. La revisión reconcilia comentarios e hilos existentes.',
     'bugbot.diagnostic.operationFailed': 'Bugbot no pudo completar una o más mutaciones de hallazgos.',
     'bugbot.diagnostic.identityUnavailable': 'La identidad autenticada de Bugbot no está disponible.',
     'bugbot.diagnostic.pullRequestCommentsFailed': 'No se pudieron volver a leer los comentarios del review del pull request.',
@@ -1009,6 +1051,7 @@ async function resolveBugbotCatalog(locale, configuration, resolver) {
 }
 function renderBugbotDiagnostic(diagnostic, catalog) {
     switch (diagnostic.code) {
+        case 'finding-mutation-failed': return catalog.message('bugbot.diagnostic.findingMutationFailed', { ...diagnostic.mutation });
         case 'operation-failed': return catalog.message('bugbot.diagnostic.operationFailed');
         case 'identity-unavailable': return catalog.message('bugbot.diagnostic.identityUnavailable');
         case 'snapshot-pull-request-comments-failed': return catalog.message('bugbot.diagnostic.pullRequestCommentsFailed');
@@ -1558,6 +1601,10 @@ function renderBugbotStatusCard(projection, catalogOrLocale, links) {
             facts.push(catalog.message('bugbot.coverage.omitted', { count: source.omittedItems }));
         if (source.truncatedItems > 0)
             facts.push(catalog.message('bugbot.coverage.truncated', { count: source.truncatedItems }));
+        const truncatedIds = source.truncatedItemIds?.slice(0, 50)
+            .filter(id => /^(?:issue:[0-9]+|review:[A-Za-z0-9_=-]+)$/.test(id) && id.length <= 160);
+        if (truncatedIds?.length)
+            facts.push(`truncated-source-ids=${truncatedIds.join(', ')}`);
         if (source.providerLimitReached)
             facts.push(catalog.message('bugbot.coverage.providerLimit'));
         return `- ${source.source}: ${source.status}; ${facts.join(', ')}`;
@@ -1647,9 +1694,21 @@ function normalizeHistoricalSnapshot(originalBody, analyzedHeadSha, catalog) {
 function renderFindingRow(finding) {
     const label = (0, github_comment_publication_policy_1.sanitizeAgentMarkdown)(finding.title || finding.id, 500).replace(/[\r\n]+/gu, ' ');
     const state = stateLabel(finding.state);
+    const identity = finding.state === 'unknown'
+        ? ` — ${renderFindingId(finding.id)}`
+        : '';
     return finding.url
-        ? `- ${state} — [${label}](${finding.url})`
-        : `- ${state} — ${label}`;
+        ? `- ${state} — [${label}](${finding.url})${identity}`
+        : `- ${state} — ${label}${identity}`;
+}
+function renderFindingId(value) {
+    const id = (0, github_comment_publication_policy_1.sanitizeAgentMarkdown)(value, 200).replace(/[\r\n]+/gu, ' ');
+    // A delimiter longer than every embedded backtick run keeps links, images
+    // and HTML inert even when the marker permits arbitrary Markdown punctuation.
+    let delimiter = '`';
+    while (id.includes(delimiter))
+        delimiter += '`';
+    return `${delimiter} ${id} ${delimiter}`;
 }
 function stateLabel(state) {
     return `[ ] ${state}`;
@@ -2136,6 +2195,13 @@ class PullRequestReviewOperationError extends Error {
         super(buildMessage(operation, context));
         this.name = "PullRequestReviewOperationError";
         this.operation = operation;
+        const status = context?.providerStatus;
+        if (typeof status === 'number' && Number.isInteger(status) && status >= 400 && status <= 599) {
+            this.providerStatus = status;
+        }
+        if (typeof context?.providerReference === 'string' && /^[A-Za-z0-9:-]{1,64}$/.test(context.providerReference)) {
+            this.providerReference = context.providerReference;
+        }
     }
 }
 exports.PullRequestReviewOperationError = PullRequestReviewOperationError;
@@ -2235,7 +2301,7 @@ function partitionFailureCategory(error) {
     return error instanceof Error ? error.name : 'unknown';
 }
 function suppressDismissedFindings(execution, context, prepared) {
-    const activeFindings = (prepared.activeFindings ?? prepared.toPublish).filter((finding) => {
+    const activeFindings = (0, finding_1.retainExistingFindingIds)(prepared.activeFindings ?? prepared.toPublish, context.existingByFindingId).filter((finding) => {
         const existing = (0, finding_1.findExistingFindingInfo)(context.existingByFindingId, finding);
         return existing?.issue?.resolution !== 'dismissed' && existing?.pullRequest?.resolution !== 'dismissed';
     });
@@ -2254,6 +2320,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.applyDetectedFindings = applyDetectedFindings;
 const mark_findings_resolved_use_case_1 = __nccwpck_require__(6963);
 const publish_findings_use_case_1 = __nccwpck_require__(8442);
+const bugbot_mutation_error_1 = __nccwpck_require__(2937);
 const pull_request_review_errors_1 = __nccwpck_require__(6445);
 async function applyDetectedFindings(operation, context, prepared, publicationPorts, resolutionPorts, catalog) {
     try {
@@ -2269,7 +2336,7 @@ async function applyDetectedFindings(operation, context, prepared, publicationPo
         });
     }
     catch (error) {
-        const publicationError = error instanceof pull_request_review_errors_1.PullRequestReviewOperationError
+        const publicationError = error instanceof bugbot_mutation_error_1.BugbotMutationError || error instanceof pull_request_review_errors_1.PullRequestReviewOperationError
             ? error
             : new Error("Unable to publish findings.");
         return [publicationError];
@@ -2540,6 +2607,7 @@ function buildPreviousFindingsContext(previousFindings) {
 `;
     const suffix = `
 **Your task 2:** For each finding above, analyze the current code and decide:
+- Trace the original failure precondition through current callers, validation helpers and effective configuration, including modules outside the original anchor. A retained finding is not proof that its old explanation is still true. Reuse its exact id if reporting the same defect again; do not create a second report for it.
 - If the problem **still exists** (same code or same issue present): do **not** include it in \`resolved_findings\`.
 - If the problem **no longer applies** (e.g. that code was removed or refactored away): include \`{ "id": "<exact id>", "resolution": "obsolete" }\` in \`resolved_findings\`.
 - If the problem **has been fixed** (code was changed and the issue is resolved): include \`{ "id": "<exact id>", "resolution": "fixed" }\` in \`resolved_findings\`.
@@ -2658,6 +2726,10 @@ function buildReviewConversationContext(issueComments, commentsByPullRequest, bo
         omitted,
         truncated: chronological.filter((entry) => entry.truncated).length,
         retained: chronological.length,
+        ...(chronological.some(entry => entry.truncated) ? {
+            truncatedItemIds: chronological.filter(entry => entry.truncated)
+                .map(entry => entry.providerId).filter(id => /^(?:issue:[0-9]+|review:[A-Za-z0-9_=-]+)$/.test(id) && id.length <= 160),
+        } : {}),
     };
 }
 function appendConversationEntry(entries, author, kind, body, createdAt, providerId) {
@@ -3339,6 +3411,7 @@ async function loadBugbotContext(request, ports, resolvedPreflight) {
             itemsFetched: conversationContext.retained + conversationContext.omitted,
             omittedItems: conversationContext.omitted,
             truncatedItems: conversationContext.truncated,
+            ...(conversationContext.truncatedItemIds ? { truncatedItemIds: conversationContext.truncatedItemIds } : {}),
             limitReached: conversationContext.omitted > 0 || conversationContext.truncated > 0,
         },
         {
@@ -3537,11 +3610,11 @@ Object.defineProperty(exports, "markFindingsResolved", ({ enumerable: true, get:
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.markFindingsResolved = markFindingsResolved;
-const pull_request_review_errors_1 = __nccwpck_require__(6445);
 const logging_ports_1 = __nccwpck_require__(6152);
 const resolve_issue_finding_1 = __nccwpck_require__(5300);
 const resolve_pull_request_finding_1 = __nccwpck_require__(4567);
 const review_state_1 = __nccwpck_require__(9200);
+const bugbot_mutation_error_1 = __nccwpck_require__(2937);
 const application_error_1 = __nccwpck_require__(5999);
 async function markFindingsResolved(param) {
     const errors = [];
@@ -3569,8 +3642,8 @@ async function repairExistingPullRequestFinding(ports, operation, findingId, des
         try {
             await ports.pullRequestComments.unresolvePullRequestReviewThread(destination.pullRequestNumber, destination.commentIdentity);
         }
-        catch {
-            addResolutionError(errors, 'pull request');
+        catch (cause) {
+            addResolutionError(errors, 'pull request', findingId, cause);
         }
     }
 }
@@ -3584,7 +3657,7 @@ async function resolveIssueIfNeeded(param, findingId, destination, errors) {
         return;
     const comment = param.context.issueComments.find(item => item.id === destination.commentId);
     if (comment?.body == null) {
-        addResolutionError(errors, 'issue');
+        addResolutionError(errors, 'issue', findingId);
         return;
     }
     try {
@@ -3595,8 +3668,8 @@ async function resolveIssueIfNeeded(param, findingId, destination, errors) {
             resolution: param.resolvedFindingResolutions?.get(findingId),
         }, param.catalog);
     }
-    catch {
-        addResolutionError(errors, 'issue');
+    catch (cause) {
+        addResolutionError(errors, 'issue', findingId, cause);
     }
 }
 async function tryResolvePullRequestFinding(ports, findingId, destination, errors, resolution, catalog) {
@@ -3608,17 +3681,14 @@ async function tryResolvePullRequestFinding(ports, findingId, destination, error
             resolution,
         }, catalog);
     }
-    catch {
-        addResolutionError(errors, 'pull request');
+    catch (cause) {
+        addResolutionError(errors, 'pull request', findingId, cause);
     }
 }
-function addResolutionError(errors, destination) {
-    const cause = destination === 'pull request'
-        ? new pull_request_review_errors_1.PullRequestReviewOperationError('mark-resolved')
-        : new Error('Unable to mark an issue finding as resolved.');
-    const semanticError = new application_error_1.ApplicationError('provider.unavailable', destination === 'pull request'
-        ? 'Unable to mark a pull request finding as resolved.'
-        : 'Unable to mark an issue finding as resolved.', { cause });
+function addResolutionError(errors, destination, findingId, cause) {
+    const semanticError = destination === 'pull request'
+        ? (0, bugbot_mutation_error_1.bugbotMutationError)(cause, 'resolution', [findingId], 'mark-resolved')
+        : new application_error_1.ApplicationError('provider.unavailable', 'Unable to mark an issue finding as resolved.');
     (0, logging_ports_1.logError)(semanticError);
     errors.push(semanticError);
 }
@@ -3867,6 +3937,7 @@ function isRecord(value) {
  */
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.publishFindings = publishFindings;
+const bugbot_mutation_error_1 = __nccwpck_require__(2937);
 const finding_1 = __nccwpck_require__(1011);
 const publish_issue_finding_comment_1 = __nccwpck_require__(4950);
 const publish_pr_review_comments_1 = __nccwpck_require__(352);
@@ -3885,12 +3956,17 @@ async function publishFindings(param) {
             catalog,
         })
         : undefined;
-    for (const finding of findings) {
+    for (const finding of (0, finding_1.retainExistingFindingIds)(findings, existingByFindingId)) {
         if (operation.target.issueNumber > 0 && !reviewPublisher) {
             await (0, publish_issue_finding_comment_1.publishIssueFindingComment)(ports.issueComments, operation.target.issueNumber, finding, (0, finding_1.findExistingFindingInfo)(existingByFindingId, finding), commitSha, catalog);
         }
         if (reviewPublisher) {
-            await reviewPublisher.publish(finding, (0, finding_1.findExistingFindingInfo)(existingByFindingId, finding));
+            try {
+                await reviewPublisher.publish(finding, (0, finding_1.findExistingFindingInfo)(existingByFindingId, finding));
+            }
+            catch (cause) {
+                throw (0, bugbot_mutation_error_1.bugbotMutationError)(cause, 'publication', [finding.id], 'publish-comments');
+            }
         }
     }
     await reviewPublisher?.flush(overflowCount, overflowTitles);
@@ -3959,6 +4035,7 @@ ${catalog.message('bugbot.overflow.body', { count: `**${overflowCount}**` }, ove
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PullRequestReviewCommentPublisher = void 0;
+const bugbot_mutation_error_1 = __nccwpck_require__(2937);
 const bugbot_finding_marker_policy_1 = __nccwpck_require__(8024);
 const path_validation_1 = __nccwpck_require__(124);
 const logging_ports_1 = __nccwpck_require__(6152);
@@ -4030,11 +4107,16 @@ class PullRequestReviewCommentPublisher {
         if (this.findingsToCreate.length === 0 && overflowCount === 0)
             return;
         const { repository, operation, openPrNumber, prContext } = this.options;
-        await repository.createReviewWithComments(openPrNumber, prContext.prHeadSha, buildReviewSummary(this.findingsToCreate, this.commentsToCreate.length, this.unanchoredBodies, overflowCount, overflowTitles, operation.analysis.reviewConfiguration.traceRules
-            ? this.options.ruleSources ?? []
-            : [], operation.analysis.reviewConfiguration.traceRules
-            ? this.options.omittedRuleCount ?? 0
-            : 0, prContext.prHeadSha, this.catalog), this.commentsToCreate);
+        try {
+            await repository.createReviewWithComments(openPrNumber, prContext.prHeadSha, buildReviewSummary(this.findingsToCreate, this.commentsToCreate.length, this.unanchoredBodies, overflowCount, overflowTitles, operation.analysis.reviewConfiguration.traceRules
+                ? this.options.ruleSources ?? []
+                : [], operation.analysis.reviewConfiguration.traceRules
+                ? this.options.omittedRuleCount ?? 0
+                : 0, prContext.prHeadSha, this.catalog), this.commentsToCreate);
+        }
+        catch (cause) {
+            throw (0, bugbot_mutation_error_1.bugbotMutationError)(cause, 'publication', this.findingsToCreate.map(finding => finding.id), 'publish-comments', this.findingsToCreate.length + overflowCount);
+        }
     }
     get catalog() {
         return this.options.catalog ?? (0, bugbot_message_catalog_1.resolveStaticBugbotCatalog)(this.options.operation.locale.pullRequest);
@@ -4188,6 +4270,8 @@ async function queryBugbotPartitionFindings(repository, configuration, prompt, t
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.reconcileBugbotReviewState = reconcileBugbotReviewState;
+const bugbot_mutation_error_1 = __nccwpck_require__(2937);
+const finding_1 = __nccwpck_require__(1011);
 const review_projection_1 = __nccwpck_require__(859);
 const bugbot_reconciliation_policy_1 = __nccwpck_require__(8128);
 const bugbot_provider_projection_policy_1 = __nccwpck_require__(5821);
@@ -4218,11 +4302,12 @@ async function reconcileBugbotReviewState(input) {
         };
     }
     const snapshot = snapshotResult.snapshot;
+    const activeFindings = (0, finding_1.retainExistingFindingIds)(input.activeFindings, input.loadedContext.existingByFindingId);
+    const expectedPublishedFindings = (0, finding_1.retainExistingFindingIds)(input.expectedPublishedFindings ?? input.activeFindings, input.loadedContext.existingByFindingId);
     const diagnostics = [
-        ...(input.mutationErrors ?? []).map((error) => ({
-            code: 'operation-failed',
-            operatorMessage: toSafeOperationMessage(error),
-        })),
+        ...(input.mutationErrors ?? []).map((error) => error instanceof bugbot_mutation_error_1.BugbotMutationError
+            ? { code: 'finding-mutation-failed', mutation: error.diagnostic }
+            : { code: 'operation-failed', operatorMessage: toSafeOperationMessage(error) }),
         ...(!input.target.trustedAuthorLogin?.trim()
             ? [{ code: 'identity-unavailable' }]
             : []),
@@ -4231,7 +4316,7 @@ async function reconcileBugbotReviewState(input) {
     const providerProjection = (0, bugbot_provider_projection_policy_1.projectBugbotProviderEvidence)({
         snapshot,
         trustedAuthorLogin: input.target.trustedAuthorLogin,
-        activeFindings: input.activeFindings,
+        activeFindings,
         existingByFindingId: input.loadedContext.existingByFindingId,
     });
     const plan = (0, bugbot_reconciliation_policy_1.buildBugbotReconciliationPlan)({
@@ -4241,8 +4326,8 @@ async function reconcileBugbotReviewState(input) {
             id,
             (0, bugbot_finding_marker_policy_1.extractTitleFromBody)(fullBody) || id,
         ])),
-        activeFindings: input.activeFindings,
-        expectedPublishedFindings: input.expectedPublishedFindings ?? input.activeFindings,
+        activeFindings,
+        expectedPublishedFindings,
         diagnostics,
         coverage: input.loadedContext.coverage,
     });
@@ -4697,14 +4782,16 @@ function toPresentationFailure(diagnostic) {
     const message = (0, bugbot_message_catalog_1.bugbotDiagnosticOperatorMessage)(diagnostic);
     return {
         diagnostic,
-        error: diagnostic.code === 'review-updates-pending'
-            ? new application_error_1.ApplicationError('workflow.presentation-pending', message, {
-                recovery: {
-                    id: 'bugbot-review-blocks-pending',
-                    variables: { pendingCount: diagnostic.count },
-                },
-            })
-            : new Error(message),
+        error: diagnostic.code === 'finding-mutation-failed'
+            ? new application_error_1.ApplicationError(diagnostic.mutation.errorCode, message)
+            : diagnostic.code === 'review-updates-pending'
+                ? new application_error_1.ApplicationError('workflow.presentation-pending', message, {
+                    recovery: {
+                        id: 'bugbot-review-blocks-pending',
+                        variables: { pendingCount: diagnostic.count },
+                    },
+                })
+                : new Error(message),
     };
 }
 function report(projection, reviewUpdates, pendingReviewUpdates, statusCardOperation, errors) {
@@ -5168,9 +5255,16 @@ exports.APPLICATION_ERROR_RECOVERY_IDS = Object.freeze([
     'branch-sync-resolution-invalid',
     'sdd-draft-size-exceeded',
     'sdd-draft-format-invalid',
+    'sdd-draft-case-identity-invalid',
+    'sdd-draft-case-budget-invalid',
+    'sdd-draft-requirement-mapping-invalid',
+    'sdd-draft-repository-path-invalid',
     'workspace-changes-rejected',
     'closed-issue-reconciliation-failed',
     'approval-evidence-read-failed',
+    'stored-configuration-schema-missing',
+    'stored-configuration-schema-unsupported',
+    'stored-configuration-invalid',
 ]);
 const PRESERVED_STATE = 'Existing persisted state and completed external effects were preserved.';
 const UNCHANGED_STATE = 'No new state or external effect was created.';
@@ -5362,6 +5456,9 @@ class ApplicationError extends Error {
 exports.ApplicationError = ApplicationError;
 _ApplicationError_cause = new WeakMap();
 const RECOVERY_VARIABLE_KEYS = Object.freeze({
+    'stored-configuration-schema-missing': Object.freeze(['issueNumber', 'expectedVersion']),
+    'stored-configuration-schema-unsupported': Object.freeze(['issueNumber', 'expectedVersion', 'actualVersion']),
+    'stored-configuration-invalid': Object.freeze(['issueNumber', 'expectedVersion']),
     'closed-issue-reconciliation-failed': Object.freeze(['resultId', 'phase', 'state', 'reason', 'changed', 'remaining']),
     'approval-evidence-read-failed': Object.freeze(['operation', 'reason', 'permission']),
     'pull-request-link-restored': Object.freeze([]),
@@ -5376,6 +5473,10 @@ const RECOVERY_VARIABLE_KEYS = Object.freeze({
     'branch-sync-resolution-invalid': Object.freeze(['validationCode', 'command']),
     'sdd-draft-size-exceeded': Object.freeze([]),
     'sdd-draft-format-invalid': Object.freeze([]),
+    'sdd-draft-case-identity-invalid': Object.freeze([]),
+    'sdd-draft-case-budget-invalid': Object.freeze([]),
+    'sdd-draft-requirement-mapping-invalid': Object.freeze([]),
+    'sdd-draft-repository-path-invalid': Object.freeze([]),
     'workspace-changes-rejected': Object.freeze([]),
 });
 function normalizeApplicationErrorRecovery(recovery) {
@@ -5391,6 +5492,13 @@ function normalizeApplicationErrorRecovery(recovery) {
         || actualKeys.some((key, index) => key !== expectedKeys[index])) {
         throw new TypeError(`Application error recovery variables are invalid for ${recovery.id}.`);
     }
+    if (recovery.id.startsWith('stored-configuration-')
+        && (![variables.issueNumber, variables.expectedVersion].every(value => typeof value === 'number' && Number.isSafeInteger(value) && value > 0)
+            || (recovery.id === 'stored-configuration-schema-unsupported'
+                && !(typeof variables.actualVersion === 'number'
+                    && Number.isSafeInteger(variables.actualVersion) && variables.actualVersion >= 0)))) {
+        throw new TypeError('Stored configuration diagnostic is invalid.');
+    }
     if (recovery.id === 'managed-branch-enrichment-failed'
         && (typeof variables.branchName !== 'string'
             || !/^[A-Za-z0-9][A-Za-z0-9._/-]{0,254}$/u.test(variables.branchName))) {
@@ -5642,9 +5750,14 @@ function matchesConstrainedHead(target, candidate) {
 /***/ }),
 
 /***/ 1011:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.isExistingFindingFullyResolved = isExistingFindingFullyResolved;
+exports.findExistingFindingInfo = findExistingFindingInfo;
+exports.findExistingFindingMatch = findExistingFindingMatch;
+exports.retainExistingFindingIds = retainExistingFindingIds;
 /**
  * Provider-neutral Bugbot finding and durable identity contracts.
  *
@@ -5652,9 +5765,7 @@ function matchesConstrainedHead(target, candidate) {
  * them in the domain prevents policies from depending on a particular use-case
  * folder and gives every adapter one stable semantic vocabulary.
  */
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.isExistingFindingFullyResolved = isExistingFindingFullyResolved;
-exports.findExistingFindingInfo = findExistingFindingInfo;
+const finding_identity_1 = __nccwpck_require__(1853);
 function isExistingFindingFullyResolved(finding) {
     const destinations = [finding.issue, finding.pullRequest].filter((destination) => destination != null);
     return (destinations.length > 0 &&
@@ -5662,21 +5773,62 @@ function isExistingFindingFullyResolved(finding) {
         finding.pullRequest?.verificationRequired !== true);
 }
 function findExistingFindingInfo(existingByFindingId, finding) {
+    return findExistingFindingMatch(existingByFindingId, finding)?.info;
+}
+/** A match carries its durable key so updating a comment cannot re-key it. */
+function findExistingFindingMatch(existingByFindingId, finding) {
     const direct = existingByFindingId[finding.id];
     if (direct && identitiesAreCompatible(direct, finding))
-        return direct;
-    const candidates = Object.values(existingByFindingId);
+        return { id: finding.id, info: direct };
+    const candidates = Object.entries(existingByFindingId);
     if (finding.fingerprint) {
-        const locationMatch = candidates.find((candidate) => candidate.issue?.fingerprint === finding.fingerprint
+        const locationMatches = candidates.filter(([, candidate]) => candidate.issue?.fingerprint === finding.fingerprint
             || candidate.pullRequest?.fingerprint === finding.fingerprint);
-        if (locationMatch)
-            return locationMatch;
+        if (locationMatches.length > 0)
+            return uniqueFindingMatch(locationMatches);
     }
     if (!finding.semanticFingerprint)
         return undefined;
-    const semanticMatches = candidates.filter((candidate) => candidate.issue?.semanticFingerprint === finding.semanticFingerprint
+    const semanticMatches = candidates.filter(([, candidate]) => candidate.issue?.semanticFingerprint === finding.semanticFingerprint
         || candidate.pullRequest?.semanticFingerprint === finding.semanticFingerprint);
-    return semanticMatches.length === 1 ? semanticMatches[0] : undefined;
+    return uniqueFindingMatch(semanticMatches);
+}
+/**
+ * Preserve trusted IDs across title/location changes, before limits, publication
+ * and final projection. Multiple reports of one uniquely matched durable finding
+ * share one record; unmatched or ambiguous reports remain independent evidence.
+ */
+function retainExistingFindingIds(findings, existingByFindingId) {
+    const retained = new Set();
+    const durableIds = new Set(Object.keys(existingByFindingId));
+    // Reserve the whole input up front so a generated ID cannot take another
+    // report's ID, including one that occurs later in the response.
+    const reservedIds = new Set([...durableIds, ...findings.map((finding) => finding.id)]);
+    const emittedIds = new Set();
+    return findings.flatMap((finding) => {
+        const match = findExistingFindingMatch(existingByFindingId, finding);
+        if (!match) {
+            let id = finding.id;
+            if (durableIds.has(id) || emittedIds.has(id)) {
+                const base = `candidate-${(0, finding_identity_1.buildFindingFingerprint)(finding)}`;
+                id = base;
+                let suffix = 0;
+                while (reservedIds.has(id))
+                    id = `${base}-${++suffix}`;
+                reservedIds.add(id);
+            }
+            emittedIds.add(id);
+            return [id === finding.id ? finding : { ...finding, id }];
+        }
+        if (retained.has(match.id))
+            return [];
+        retained.add(match.id);
+        emittedIds.add(match.id);
+        return [finding.id === match.id ? finding : { ...finding, id: match.id }];
+    });
+}
+function uniqueFindingMatch(matches) {
+    return matches.length === 1 ? { id: matches[0][0], info: matches[0][1] } : undefined;
 }
 function identitiesAreCompatible(existing, finding) {
     const existingFingerprints = [
@@ -6539,11 +6691,13 @@ function getAnswerIssueHelpPrompt(params) {
 
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.BUGBOT_FINDING_GROUNDING_INSTRUCTION = void 0;
 exports.getBugbotPrompt = getBugbotPrompt;
 /**
  * Prompt for Bugbot detection (detect potential problems on push).
  */
 const fill_1 = __nccwpck_require__(2559);
+exports.BUGBOT_FINDING_GROUNDING_INSTRUCTION = 'Before returning a finding, try to disprove it against the exact reviewed source. Read effective repository configuration and inherited library/protocol defaults before inferring behavior from a missing command flag. Trace short-circuit guards, validation helpers and the actual caller/render path before claiming that an unsafe branch is reachable or that separate call sites coexist. Recompute arithmetic and check cited line numbers against the current file/diff. If your evidence refutes the alleged defect, withdraw the finding entirely; do not publish a contradictory or self-refuting report. These checks apply equally to low/info severity. Report a confirmed failure when those protections are absent; do not assume they exist.';
 const TEMPLATE = `You are analyzing the latest code changes for potential bugs and issues.
 
 Write every human-readable finding title, description, evidence, and suggestion in {{targetLocale}}. Preserve identifiers, code, symbols, paths, refs, commands, and URLs verbatim. Echo \`outputLocale\` exactly as \`{{targetLocale}}\`.
@@ -6579,6 +6733,8 @@ For every finding:
 - include the nearest stable \`symbol\` and a minimal exact \`codeSnippet\` when available so the finding can survive rebases, line movement, and file renames.
 - when a fix is a safe replacement of exactly the reported line range, include only the replacement text in \`suggestedCode\`; otherwise omit it.
 
+${exports.BUGBOT_FINDING_GROUNDING_INSTRUCTION}
+
 Return every finding field required by the response schema. Use null for file, line, endLine, severity, confidence, category, evidence, suggestion, symbol, codeSnippet, or suggestedCode when that value does not safely apply. Only include files outside the ignore list.
 {{previousBlock}}
 

package/build/api/src/data/model/application_error.d.ts

@@ -3,9 +3,22 @@ import { type ApprovalEvidenceDiagnostic } from '../../domain/approval_evidence_
 import { type BranchSyncValidationCode } from '../../domain/branch_sync_validation';
 export type ApplicationErrorKind = 'configuration' | 'authorization' | 'provider' | 'agent' | 'validation' | 'workflow' | 'unknown';
 export type ApplicationErrorCode = 'configuration.invalid' | 'configuration.unsupported' | 'authorization.denied' | 'authorization.credential-invalid' | 'provider.not-found' | 'provider.conflict' | 'provider.rate-limited' | 'provider.unavailable' | 'provider.contract-invalid' | 'agent.policy-rejected' | 'agent.failed' | 'locale.output-invalid' | 'locale.translation-failed' | 'validation.invalid-input' | 'validation.evidence-too-large' | 'validation.evidence-unavailable' | 'workflow.invalid-event' | 'workflow.stale' | 'workflow.cancelled' | 'workflow.failed' | 'workflow.presentation-pending' | 'timeout' | 'unexpected';
-export declare const APPLICATION_ERROR_RECOVERY_IDS: readonly ["pull-request-link-restored", "pull-request-link-base-retained", "pull-request-link-reference-retained", "pull-request-link-base-and-reference-retained", "managed-branch-enrichment-failed", "inactivity-explanation-failed", "bugbot-review-blocks-pending", "branch-sync-agent-disabled", "branch-sync-fixer-unavailable", "branch-sync-resolution-invalid", "sdd-draft-size-exceeded", "sdd-draft-format-invalid", "workspace-changes-rejected", "closed-issue-reconciliation-failed", "approval-evidence-read-failed"];
+export declare const APPLICATION_ERROR_RECOVERY_IDS: readonly ["pull-request-link-restored", "pull-request-link-base-retained", "pull-request-link-reference-retained", "pull-request-link-base-and-reference-retained", "managed-branch-enrichment-failed", "inactivity-explanation-failed", "bugbot-review-blocks-pending", "branch-sync-agent-disabled", "branch-sync-fixer-unavailable", "branch-sync-resolution-invalid", "sdd-draft-size-exceeded", "sdd-draft-format-invalid", "sdd-draft-case-identity-invalid", "sdd-draft-case-budget-invalid", "sdd-draft-requirement-mapping-invalid", "sdd-draft-repository-path-invalid", "workspace-changes-rejected", "closed-issue-reconciliation-failed", "approval-evidence-read-failed", "stored-configuration-schema-missing", "stored-configuration-schema-unsupported", "stored-configuration-invalid"];
 export type ApplicationErrorRecoveryId = typeof APPLICATION_ERROR_RECOVERY_IDS[number];
 interface ApplicationErrorRecoveryVariables {
+    readonly 'stored-configuration-schema-missing': Readonly<{
+        issueNumber: number;
+        expectedVersion: number;
+    }>;
+    readonly 'stored-configuration-schema-unsupported': Readonly<{
+        issueNumber: number;
+        expectedVersion: number;
+        actualVersion: number;
+    }>;
+    readonly 'stored-configuration-invalid': Readonly<{
+        issueNumber: number;
+        expectedVersion: number;
+    }>;
     readonly 'closed-issue-reconciliation-failed': ClosedIssueReconciliationFacts;
     readonly 'approval-evidence-read-failed': ApprovalEvidenceDiagnostic;
     readonly 'pull-request-link-restored': Readonly<Record<string, never>>;
@@ -33,6 +46,10 @@ interface ApplicationErrorRecoveryVariables {
     }>;
     readonly 'sdd-draft-size-exceeded': Readonly<Record<string, never>>;
     readonly 'sdd-draft-format-invalid': Readonly<Record<string, never>>;
+    readonly 'sdd-draft-case-identity-invalid': Readonly<Record<string, never>>;
+    readonly 'sdd-draft-case-budget-invalid': Readonly<Record<string, never>>;
+    readonly 'sdd-draft-requirement-mapping-invalid': Readonly<Record<string, never>>;
+    readonly 'sdd-draft-repository-path-invalid': Readonly<Record<string, never>>;
     readonly 'workspace-changes-rejected': Readonly<Record<string, never>>;
 }
 export type ApplicationErrorRecovery = {

package/build/api/src/domain/bugbot/context.d.ts

@@ -8,6 +8,8 @@ export interface BugbotSourceCoverage {
     readonly itemsRetained: number;
     readonly omittedItems: number;
     readonly truncatedItems: number;
+    /** Exact bounded provider identities of retained conversation items truncated by the prompt. */
+    readonly truncatedItemIds?: readonly string[];
     readonly limitReached: boolean;
     /** True when a provider page cap hides an unknown number of older records. */
     readonly providerLimitReached?: boolean;

package/build/api/src/domain/bugbot/finding.d.ts

@@ -1,10 +1,3 @@
-/**
- * Provider-neutral Bugbot finding and durable identity contracts.
- *
- * These types are shared by analysis, reconciliation, and publication. Keeping
- * them in the domain prevents policies from depending on a particular use-case
- * folder and gives every adapter one stable semantic vocabulary.
- */
 export interface BugbotFinding {
     id: string;
     title: string;
@@ -59,3 +52,14 @@ export interface ExistingFindingInfo {
 export type ExistingByFindingId = Record<string, ExistingFindingInfo>;
 export declare function isExistingFindingFullyResolved(finding: ExistingFindingInfo): boolean;
 export declare function findExistingFindingInfo(existingByFindingId: ExistingByFindingId, finding: Pick<BugbotFinding, 'id' | 'fingerprint' | 'semanticFingerprint'>): ExistingFindingInfo | undefined;
+/** A match carries its durable key so updating a comment cannot re-key it. */
+export declare function findExistingFindingMatch(existingByFindingId: ExistingByFindingId, finding: Pick<BugbotFinding, 'id' | 'fingerprint' | 'semanticFingerprint'>): {
+    id: string;
+    info: ExistingFindingInfo;
+} | undefined;
+/**
+ * Preserve trusted IDs across title/location changes, before limits, publication
+ * and final projection. Multiple reports of one uniquely matched durable finding
+ * share one record; unmatched or ambiguous reports remain independent evidence.
+ */
+export declare function retainExistingFindingIds(findings: readonly BugbotFinding[], existingByFindingId: ExistingByFindingId): BugbotFinding[];