feat(cli): appmap sanitize — equality-preserving value tokenization

.claude/skills/appmap-gold-traces

@@ -0,0 +1 @@
+../appland-skills/appmap-gold-traces

.claude/skills/appmap-review

@@ -0,0 +1 @@
+../appland-skills/appmap-review

.github/workflows/appmap-review.yml

@@ -8,13 +8,33 @@ name: AppMap Behavioral Review
 #
 # Baselines live in packages/<pkg>/gold_traces/ (manifest.yaml + baseline/), and
 # are auto-trimmed by the gold-traces engine via `appmap trim`.
+#
+# User-triggered: add the `appmap-review` label to a PR to run one review
+# (a run costs a few dollars of agent time, so it doesn't run on every push).
+# To review again after new pushes, remove and re-add the label; "Re-run jobs"
+# re-reviews the same revision. The label does nothing on a PR that touches
+# neither package: no run is created at all.
+#
+# "Run workflow" reviews any two refs: head (default: the branch you pick)
+# against base (default: main). Picking main with the defaults is a baseline
+# maintenance run (main vs main), not a review.
 
 on:
   pull_request:
+    types: [labeled]
     paths:
       - 'packages/cli/**'
       - 'packages/sequence-diagram/**'
   workflow_dispatch:
+    inputs:
+      head:
+        description: 'Ref to review (branch, tag, or SHA). Empty: the branch picked under "Use workflow from". Baseline updates are only pushed back when this is a branch.'
+        required: false
+        default: ''
+      base:
+        description: 'Ref to review against (branch, tag, or SHA).'
+        required: false
+        default: 'main'
 
 # The action commits blessed gold-trace updates to the PR branch and posts the
 # review comment.
@@ -32,10 +52,12 @@ concurrency:
 
 jobs:
   review:
-    # Secrets (ANTHROPIC_API_KEY) and a write token are not available to fork PRs.
+    # Only the appmap-review label starts a PR review; secrets (ANTHROPIC_API_KEY)
+    # and a write token are not available to fork PRs.
     if: >-
       ${{ github.event_name == 'workflow_dispatch' ||
-          github.event.pull_request.head.repo.full_name == github.repository }}
+          (github.event.label.name == 'appmap-review' &&
+           github.event.pull_request.head.repo.full_name == github.repository) }}
     runs-on: ubuntu-latest
     timeout-minutes: 45
     strategy:
@@ -52,15 +74,21 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0 # the review reads gold traces from both revisions' history
-          ref: ${{ github.head_ref || github.ref }} # push blessed baselines back to the PR branch
+          ref: ${{ inputs.head || github.head_ref || github.ref }} # push blessed baselines back to the PR branch
 
       # Skip the (expensive) agent run for a package this PR didn't touch.
       - name: Did ${{ matrix.package }} change?
         id: changed
         run: |
-          base="${{ github.event.pull_request.base.sha }}"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            ref="${{ inputs.base }}"
+            base="$(git rev-parse --verify --quiet "$ref^{commit}" \
+                 || git rev-parse --verify --quiet "origin/$ref^{commit}" || true)"
+          else
+            base="${{ github.event.pull_request.base.sha }}"
+          fi
           if [ -z "$base" ]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"   # workflow_dispatch: review both
+            echo "changed=true" >> "$GITHUB_OUTPUT"   # unknown base: review both
           elif git diff --quiet "$base"...HEAD -- "${{ matrix.package }}"; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
           else
@@ -84,11 +112,10 @@ jobs:
         if: steps.changed.outputs.changed == 'true'
         run: yarn build
 
-      # The review action installs @appland/appmap globally, which builds the
-      # non-optional fsevents@1 (via chokidar@2) and fails node-gyp on Linux —
-      # neither --omit=optional nor npm@9 avoids it. Since this repo builds the
-      # CLI, expose the local build as `appmap` on PATH; the action skips its own
-      # install when `appmap` is present (and it's the in-tree CLI, with `trim`).
+      # This repo IS the AppMap CLI, so expose the in-tree build as `appmap` on
+      # PATH: without an explicit version pin, the action prefers a PATH-provided
+      # appmap over installing a release binary — and the in-tree CLI carries
+      # commands a released binary may not have yet (e.g. trim/sanitize).
       - name: Expose locally-built appmap on PATH
         if: steps.changed.outputs.changed == 'true'
         run: |
@@ -103,17 +130,14 @@ jobs:
 
       - name: Review ${{ matrix.package }}
         if: steps.changed.outputs.changed == 'true'
-        # In-development action — track its default branch until it ships a
-        # taggable release; pin to a SHA/tag once published.
-        uses: getappmap/review-action@main
+        # v1 also gives each matrix package its own sticky PR comment
+        # (comment-tag defaults to working-directory).
+        uses: getappmap/review-action@v1
         with:
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
           working-directory: ${{ matrix.package }}
           gold-traces-dir: gold_traces
-          # On pull_request this is the PR base; on workflow_dispatch base_ref is
-          # empty, so fall back to main to keep the review's compare well-defined.
-          base-revision: ${{ github.base_ref || 'main' }}
-          # The in-repo gold_traces use the single-file manifest.yaml + auto-trim
-          # engine, which currently lives on this skills branch (merge to main
-          # will let this default).
-          skills-ref: feat/gold-traces-label-aware-compare
+          # Pull requests compare head against the PR base; "Run workflow"
+          # compares any two refs (defaults: the checked-out branch vs main).
+          base-revision: ${{ inputs.base || github.base_ref || 'main' }}
+          head-revision: ${{ inputs.head || github.sha }}

.gitmodules

@@ -0,0 +1,3 @@
+[submodule ".claude/appland-skills"]
+	path = .claude/appland-skills
+	url = https://github.com/getappmap/skills.git