[WEB-5054] observability: index no_tools_found discriminators as Sentry tags

[anonpran]

Summary

• Promotes four discriminator fields — is_root, used_fallback_user, homes_enumerated, users_scanned — from the no_tools_found event's unindexed extra into _SENTRY_TAG_KEYS, so they become queryable/aggregatable Sentry tags.
• Observability only. No scan-behavior change, no new events, no change to report_to_sentry logic or Sentry grouping/fingerprint. One file, +8 lines.

Why

Sentry issue DISCOVERY-TOOL-SCRIPT-17 (RuntimeError: Discovery found no tools, level=warning — telemetry, not a crash) currently fuses several populations into one issue, and we cannot tell them apart because the disambiguating fields aren't indexed:

• root vs non-root scans — is_root matters because under root the which-on-PATH backstop for CLI tools is disabled, a known narrow false-negative class.
• enumeration-miss (a real bug: homes_enumerated==0 / used_fallback_user==true) vs genuinely-empty device — the WEB-4956 discriminator that's meant to separate a scanner failure from a legitimately empty laptop.

These fields are already collected in the event context; they just sit in extra where Sentry can't aggregate them (verified live — they return empty in Sentry aggregate queries). This one-tuple change makes the population sliceable so we can quantify the real size of the root-mode blind spot before deciding whether the detection fix is worth building.

Changes

• scripts/coding_discovery_tools/utils.py: add the four keys to _SENTRY_TAG_KEYS + a comment documenting the low-cardinality invariant and why duration_ms is deliberately excluded (high cardinality → stays in extra).

Notes / scope

• Forward-only: tags attach at emission time, so the ~85 existing macOS events stay untagged; only events emitted after the fleet upgrades become queryable. No backfill possible/in scope.
• Base = main (the fleet runs main via install.sh; the no_tools_found emission from [WEB-4956] Add no_tools_found Sentry event to diagnose empty discovery scans #215/Drop CI/local-run noise from production Sentry (DISCOVERY-TOOL-SCRIPT-17/-13/-12/-D) #216 lives on main, not staging).
• Out of scope: the phase/fingerprint split that would give the enumeration-miss case its own Sentry issue/alert, and the root-mode CLI detection fix. Both are follow-ups this PR unblocks by giving us the numbers.

Test plan

• _SENTRY_TAG_KEYS change is a 1:1 match to the keys the no_tools_found emission puts in ctx (ai_tools_discovery.py); if k in ctx guard keeps is_root safe on Windows (absent → skipped).
• Existing report_to_sentry + TestNoToolsSentryEvent suites pass (no test asserts on _SENTRY_TAG_KEYS, so nothing breaks).
• elite-pr-review: APPROVE (5/5). security-review: no findings (booleans + counts, no PII, no new sink).

🤖 Generated with Claude Code

---

Note

Low Risk
Metadata-only tuple change; no runtime behavior or data-path changes beyond Sentry tag indexing.

Overview
Extends _SENTRY_TAG_KEYS so four fields already on the no_tools_found Sentry context—is_root, used_fallback_user, homes_enumerated, users_scanned—are copied into indexed tags by report_to_sentry, not only left in extra.

A short comment documents the low-cardinality rule and that duration_ms stays unindexed. No change to scan logic, event emission, or Sentry transport; the existing if k in ctx guard still limits these tags to events that supply those keys.

^{Reviewed by Cursor Bugbot for commit aba07c2. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

This PR promotes four fields — is_root, used_fallback_user, homes_enumerated, and users_scanned — from Sentry's unindexed extra into _SENTRY_TAG_KEYS so they become queryable/aggregatable Sentry tags on the no_tools_found warning event. The change is observability-only: no scan logic, event emission, or grouping behavior is modified.

• Adds four keys to the _SENTRY_TAG_KEYS tuple in utils.py; the existing if k in ctx guard in report_to_sentry safely handles the Windows case where is_root is absent from context.
• Adds a comment documenting the low-cardinality invariant and the deliberate exclusion of duration_ms (high cardinality) from tags.

Confidence Score: 5/5

Safe to merge — a single tuple addition with no scan logic, emission, or grouping changes.

The change is a one-line tuple extension plus a comment. The existing if k in ctx guard in report_to_sentry correctly handles the Windows case where is_root is absent, and all four new keys are already present on the no_tools_found context at emission time. No new data paths, no new curl calls, no dedup or circuit-breaker interaction.

No files require special attention.

Important Files Changed

Filename	Overview
scripts/coding_discovery_tools/utils.py	Adds four low-cardinality discriminator keys to _SENTRY_TAG_KEYS and a comment explaining the cardinality invariant; no logic change.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[no_tools_found block\nai_tools_discovery.py:3257] --> B[Build no_tools_ctx\nphase / homes_enumerated /\nusers_scanned / used_fallback_user]
    B --> C{hasattr os getuid?}
    C -- Yes\nLinux/macOS --> D[Add is_root to ctx]
    C -- No\nWindows --> E[Skip is_root]
    D & E --> F[report_to_sentry\npriority=True]
    F --> G[Build tags dict\nk in _SENTRY_TAG_KEYS AND k in ctx]
    G --> H[Sentry tags PROMOTED by this PR:\nis_root / used_fallback_user /\nhomes_enumerated / users_scanned]
    G --> I[Sentry extra\nall ctx keys incl. duration_ms]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[no_tools_found block\nai_tools_discovery.py:3257] --> B[Build no_tools_ctx\nphase / homes_enumerated /\nusers_scanned / used_fallback_user]
    B --> C{hasattr os getuid?}
    C -- Yes\nLinux/macOS --> D[Add is_root to ctx]
    C -- No\nWindows --> E[Skip is_root]
    D & E --> F[report_to_sentry\npriority=True]
    F --> G[Build tags dict\nk in _SENTRY_TAG_KEYS AND k in ctx]
    G --> H[Sentry tags PROMOTED by this PR:\nis_root / used_fallback_user /\nhomes_enumerated / users_scanned]
    G --> I[Sentry extra\nall ctx keys incl. duration_ms]

Loading

_{Reviews (2): Last reviewed commit: "observability: index no_tools_found disc..." | Re-trigger Greptile}

[vigneshsubbiah16]

🛡️ Automated Security Review (consensus)

0 findings — 0 high-confidence, 0 to triage. Reviewers: Cursor, Claude, Semgrep, Gitleaks.

✅ Security consensus: no issues found. (reviewers: Cursor, Claude, Semgrep, Gitleaks)

---

🤖 consensus review · reviewers: Cursor,Claude,Semgrep,Gitleaks · head 64be64c7 · 2026-07-03T11:10Z

[vigneshsubbiah16]

🛡️ Automated Security Review (consensus)

0 findings — 0 high-confidence, 0 to triage. Reviewers: Lead, Claude, Semgrep, Gitleaks.

✅ Security consensus: no issues found. (reviewers: Lead, Claude, Semgrep, Gitleaks)

---

🤖 consensus review · reviewers: Cursor,Claude,Semgrep,Gitleaks · head aba07c2a · 2026-07-03T13:30Z