stacktrace-cli 0.6.0__py3-none-any.whl → 0.7.0__py3-none-any.whl

stacktrace_cli/daemon/webhook.py

@@ -9,6 +9,7 @@ import threading
 from collections.abc import Callable
 from contextlib import suppress
 from dataclasses import dataclass
+from datetime import UTC, datetime
 from pathlib import Path
 
 import httpx
@@ -18,7 +19,7 @@ from stacktrace_cli.detector.secrets import find_secrets
 from stacktrace_cli.telemetry import emit_derived
 from stacktrace_cli.webhook.config import DEFAULT_FORMAT, ConfigError, load_webhook_config
 
-from .store import FINDING, FindingStore, QueuedRecord
+from .store import FindingStore, QueuedRecord
 
 WEBHOOK_SUBSCRIBER = "webhook"
 
@@ -88,7 +89,7 @@ class WebhookSubscriber:
                     if not rows:
                         break
                     row = rows[0]
-                    if row.kind == FINDING and row.notifiable:
+                    if row.deliverable:
                         config, stopped = self._config()
                         if config is None:
                             return WebhookReport(delivered, skipped, stopped)
@@ -111,7 +112,7 @@ class WebhookSubscriber:
                     else:
                         skipped += 1
                     self.store.advance_cursor(partition, row.seq, subscriber=WEBHOOK_SUBSCRIBER)
-                    if row.kind == FINDING and row.notifiable:
+                    if row.deliverable:
                         _report_delivered(partition, row)
         return WebhookReport(delivered=delivered, skipped=skipped)
 
@@ -246,6 +247,7 @@ def _payload(agent_kind: str, row: QueuedRecord) -> dict[str, object]:
         "version": 1,
         "type": "finding",
         "event_id": row.event_id,
+        "detected_at": row.created_at,
         "rule_id": rule_id,
         "severity": severity,
         "confidence": confidence,
@@ -380,6 +382,26 @@ def _severity_colour(severity: str) -> str:
     return _SEVERITY_COLOURS.get(severity.lower(), _DEFAULT_COLOUR)
 
 
+def _slack_date(value: object) -> str | None:
+    """A viewer-local date token made only from a valid offset timestamp.
+
+    The fallback is regenerated from the parsed value rather than copying raw
+    input into Slack's control syntax. A malformed legacy row still delivers;
+    only its date label is omitted.
+    """
+    if not isinstance(value, str):
+        return None
+    try:
+        moment = datetime.fromisoformat(value)
+        if moment.tzinfo is None:
+            return None
+        epoch = int(moment.timestamp())
+        fallback = moment.astimezone(UTC).isoformat()
+    except (OSError, OverflowError, ValueError):
+        return None
+    return f"<!date^{epoch}^{{date_short_pretty}} at {{time_secs}}|{fallback}>"
+
+
 #: Dropped rather than escaped: mrkdwn has no escape these honour reliably,
 #: and no real component type or evidence kind contains one.
 #:
@@ -436,6 +458,10 @@ def _slack_payload(payload: dict[str, object]) -> dict[str, object]:
     assert isinstance(session, dict)
     title = _mrkdwn(payload.get("title") or payload["rule_id"])
     severity = str(payload["severity"])
+    detected = _slack_date(payload.get("detected_at"))
+    identity_parts = [f"finding ID {_mrkdwn(payload['event_id'])}"]
+    if detected is not None:
+        identity_parts.insert(0, f"Detected {detected}")
 
     fields: list[dict[str, str]] = []
     subject = payload.get("subject")
@@ -457,8 +483,9 @@ def _slack_payload(payload: dict[str, object]) -> dict[str, object]:
     if isinstance(kinds, list) and kinds:
         joined = ", ".join(_mrkdwn(kind) for kind in kinds)
         fields.append({"type": "mrkdwn", "text": f"*Evidence*\n{joined}"})
+    # Severity only (ADR-0088). Confidence is nearly always `high`, so in a
+    # channel it is a field that says nothing; the JSON format still carries it.
     fields.append({"type": "mrkdwn", "text": f"*Severity*\n{_mrkdwn(severity)}"})
-    fields.append({"type": "mrkdwn", "text": f"*Confidence*\n{_mrkdwn(payload['confidence'])}"})
 
     blocks: list[dict[str, object]] = [
         {"type": "section", "text": {"type": "mrkdwn", "text": f"*{title}*"}},
@@ -472,7 +499,11 @@ def _slack_payload(payload: dict[str, object]) -> dict[str, object]:
                         f"{_mrkdwn(session['agent_kind'])}"
                         f"  \u00b7  session {_mrkdwn(session['session_id'])}"
                     ),
-                }
+                },
+                {
+                    "type": "mrkdwn",
+                    "text": "  \u00b7  ".join(identity_parts),
+                },
             ],
         },
     ]

stacktrace_cli/detector/blocked.py

@@ -35,6 +35,8 @@ from __future__ import annotations
 import re
 from dataclasses import dataclass
 
+from stacktrace_cli.detector.rules import RELIABILITY_RULES
+
 #: Who can act on a block. Not a severity — the thing severity is derived from.
 #:
 #: `user` is the account owner or whoever drove the session; `upstream` is a
@@ -71,6 +73,10 @@ class Reason:
     """One way work stops, and what a reader should do about it."""
 
     code: str
+    #: The rule a finding for this reason is filed under -- one per reason, so
+    #: anything that reads only the rule id still tells a spend limit from a
+    #: throttle (ADR-0083). `code` stays the evidence `kind`.
+    rule_id: str
     pattern: re.Pattern[str]
     attribution: Attribution
     #: The finding's title. States the cause, never the symptom — a title
@@ -149,6 +155,8 @@ class Reason:
         for word in self.specific_vocabulary:
             if word != word.casefold() or not _SAFE_SPECIFIC.fullmatch(word):
                 raise ValueError(f"{self.code}: {word!r} is not a lowercase, path-free specific")
+        if self.rule_id not in RELIABILITY_RULES:
+            raise ValueError(f"{self.code}: {self.rule_id!r} is not a reliability rule")
 
     def specific(self, text: str | None) -> str | None:
         """Which rule refused, where the client said so and we have a word for it.
@@ -190,6 +198,7 @@ class Reason:
 REASONS: tuple[Reason, ...] = (
     Reason(
         code="quota_exhausted",
+        rule_id="stacktrace-blocked-quota",
         label="Spend limit reached",
         pattern=re.compile(
             r"hit your (individual |team )?(spend|usage) limit"
@@ -227,6 +236,7 @@ REASONS: tuple[Reason, ...] = (
     ),
     Reason(
         code="policy_blocked",
+        rule_id="stacktrace-blocked-policy",
         label="Safety check refused",
         pattern=re.compile(
             r"could not evaluate this action and is blocking it for safety"
@@ -290,6 +300,7 @@ REASONS: tuple[Reason, ...] = (
     ),
     Reason(
         code="provider_throttled",
+        rule_id="stacktrace-blocked-throttled",
         label="Rate limited",
         # Anchored on what a client or a service *writes* when it throttles,
         # never on a bare status code. Measured on 76 real sessions, `429`
@@ -347,6 +358,7 @@ REASONS: tuple[Reason, ...] = (
     ),
     Reason(
         code="upstream_refused",
+        rule_id="stacktrace-blocked-upstream",
         label="Service refused",
         # Service-generic, not GitHub-shaped. The first two literals are how
         # GitHub words it and the rest are the status lines every HTTP service