version = 1

# Warden gates clearance on blocking findings from two skills:
# diff-security-review (all findings block) and desktop-den-sync-review (only
# high findings block; medium findings are advisory). The clearance itself is
# granted by .github/workflows/warden-clearance.yml.

[defaults]
reportOn = "low"
ignorePaths = [
  "**/node_modules/**",
  "**/pnpm-lock.yaml",
  "**/dist/**",
  "**/*.min.js",
]

[defaults.agent]
model = "openai/gpt-5.6-luna"

# Auxiliary verifies/merges findings and gates what survives to the report;
# keep it on the same strong model so weak verification can't cause a false
# clearance.
[defaults.auxiliary]
model = "openai/gpt-5.6-luna"

[[skills]]
name = "diff-security-review"

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened"]
draft = false

# Lets developers run `warden` locally on uncommitted changes before pushing.
[[skills.triggers]]
type = "local"

[[skills]]
name = "desktop-den-sync-review"
paths = [
  "apps/app/**",
  "apps/desktop/**",
  "ee/apps/den-api/**",
  "packages/types/**",
]

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened"]
draft = false

[[skills.triggers]]
type = "local"