codesage-triage

Triage a codesage review finding

Update the lifecycle state of a finding produced by /codesage-review. No LLM call — this is a pure local state edit on .codesage/findings/<feature_id>.json.

Parse arguments

From $ARGUMENTS:

• First positional argument: absolute project path (required).
• --finding <fnd_id>: required, must look like fnd_<8hex>.
• --status <s>: required, one of:
  • open — the finding is real and not yet acted on (the default state from review).
  • false-positive — the finding doesn't actually apply; subsequent reviews should not re-raise it.
  • wont-fix — the finding is real but won't be acted on. Later reviews suppress it while preserving the human decision.
  • fixed — the finding has been resolved in the source. A revalidation run reopens it only when current evidence shows the same defect is still present.
• --note "<text>": optional. Free-form context — why this is a false positive, link to a ticket, whatever the user wants future-them to read.

Reject invalid combinations early (missing finding_id, unknown status). Don't proceed if any are malformed.

Before touching any .codesage/ path: .codesage/ is repository content, so a cloned repo can ship it — or any directory under it — as a symlink. Refuse to read, write, create, or delete through one. Check with test -L <path> (not test -e, which follows links) on .codesage itself and on each subdirectory you are about to use, and stop with an error if any is a symlink. Apply the same check to every leaf you touch: a *.json findings file, or any temporary file you create beside it, may itself be a planted symlink or a directory. Read or write a leaf only if it is a regular file (or absent, when creating), and give temporary files a freshly generated unique name rather than a predictable one.

Locate the finding

Walk .codesage/findings/*.json and find the file containing a finding with the matching finding_id. If no match, report finding not found in <project>/.codesage/findings/ and stop. Suggest: