feat: findings SoT — persist, auto-resolve, CLI (#397-#400) + v0.8.4

CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.4] - 2026-07-28
+
+### Added
+
+- **Persist review & scan findings to `cora.db`** (#397, #398). `cora review` and `cora scan` now save findings (severity, file, line, title, fingerprint) to the global database. Uses best-effort logging — never blocks the review pipeline on DB errors.
+- **Auto-resolve stale findings** (#399). When a new review/scan completes, findings from prior reviews that no longer appear are automatically marked `resolved` with an `auto_resolved` event. Findings that reappear stay `open`.
+- **`cora findings` CLI command** (#400). New subcommand with four actions:
+  - `cora findings list` — show open findings (use `--all`, `--severity`, `--file`, `--json` for filtering)
+  - `cora findings stats` — summary counts with resolution rate (`--json` supported)
+  - `cora findings dismiss <id>` — mark as won't-fix with optional `--reason`
+  - `cora findings reopen <id>` — reopen a dismissed/resolved finding
+- **Read-only DB access for `cora findings list/stats`** via `open_db_for_read()` — no migrations, no WAL, safe for concurrent reads.
+
+### Changed
+
+- `db_writer` module now exposes `open_db_for_read()`, `open_db_for_write()`, and `compute_fingerprint_pub()` for use by the findings CLI.
+
 ## [0.8.3] - 2026-07-27
 
 ### Added

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cora-code"
-version = "0.8.3"
+version = "0.8.4"
 edition = "2024"
 description = "CLI-first AI code review — BYOK, diff/scan/branch, pre-commit hooks"
 license = "MIT"
@@ -9,6 +9,13 @@ readme = "README.md"
 keywords = ["cli", "code-review", "ai", "git", "pre-commit"]
 categories = ["command-line-utilities", "development-tools"]
 rust-version = "1.85"
+exclude = [
+    "vendored/",
+    "docs/",
+    ".github/",
+    "tests/",
+    "target/",
+]
 
 [dependencies]
 # CLI
@@ -80,6 +87,7 @@ tree-sitter-javascript = { version = "0.25", optional = true }
 
 [features]
 default = []
+pretrained-embed = []
 tree-sitter = [
     "dep:tree-sitter",
     "dep:tree-sitter-rust",

install-bundle.sh

@@ -14,24 +14,34 @@ REPO_NAME="cora-code"
 BINARY_NAME="cora"
 INSTALL_DIR="$HOME/.local/bin"
 
-# Detect platform
+# Detect platform → Rust target triple + archive extension
 detect_platform() {
     OS="$(uname -s)"
     ARCH="$(uname -m)"
 
-    case "$OS" in
-        Linux*)  OS="linux" ;;
-        Darwin*) OS="macos" ;;
-        *)       echo "Unsupported OS: $OS"; exit 1 ;;
-    esac
-
+    # Normalize arch
     case "$ARCH" in
-        x86_64|amd64) ARCH="x86_64" ;;
+        x86_64|amd64)  ARCH="x86_64" ;;
         aarch64|arm64) ARCH="aarch64" ;;
         *)             echo "Unsupported architecture: $ARCH"; exit 1 ;;
     esac
 
-    PLATFORM="${OS}-${ARCH}"
+    # Map OS + arch → Rust target triple
+    case "$OS" in
+        Linux*)   TARGET="${ARCH}-unknown-linux-gnu"; EXT="tar.gz" ;;
+        Darwin*)  TARGET="${ARCH}-apple-darwin";     EXT="tar.gz" ;;
+        *)        echo "Unsupported OS: $OS"; exit 1 ;;
+    esac
+
+    # Windows override (MSYS2 / Git Bash)
+    case "${MSYSTEM:-}${MINGW:-}" in
+        *MSYS*|*MINGW*)
+            TARGET="${ARCH}-pc-windows-msvc"
+            EXT="zip"
+            ;;
+    esac
+
+    PLATFORM="$TARGET"
 }
 
 # Get latest release tag from GitHub
@@ -67,11 +77,24 @@ install_binary() {
     # Create install directory
     mkdir -p "$INSTALL_DIR"
 
-    # Download URL
-    URL="https://github.com/${REPO_OWNER}/${REPO_NAME}/releases/download/${VERSION}/${BINARY_NAME}-${PLATFORM}"
+    # Download URL — matches release asset naming: cora-{target}-v{version}.{ext}
+    ARCHIVE_NAME="${BINARY_NAME}-${PLATFORM}-${VERSION}.${EXT}"
+    URL="https://github.com/${REPO_OWNER}/${REPO_NAME}/releases/download/${VERSION}/${ARCHIVE_NAME}"
+
+    TMPDIR="$(mktemp -d)"
+    trap 'rm -rf "${TMPDIR}"' EXIT
 
     echo "Downloading ${BINARY_NAME} ${VERSION}..."
-    curl -fsSL "$URL" -o "${INSTALL_DIR}/${BINARY_NAME}"
+    curl -fsSL "$URL" -o "${TMPDIR}/${ARCHIVE_NAME}"
+
+    # Extract archive
+    case "$EXT" in
+        tar.gz) tar xzf "${TMPDIR}/${ARCHIVE_NAME}" -C "${TMPDIR}" ;;
+        zip)    unzip -qo "${TMPDIR}/${ARCHIVE_NAME}" -d "${TMPDIR}" ;;
+    esac
+
+    # Install binary
+    mv "${TMPDIR}/${BINARY_NAME}" "${INSTALL_DIR}/${BINARY_NAME}"
 
     # Make executable
     chmod +x "${INSTALL_DIR}/${BINARY_NAME}"