Add --filtered-integrity flag to logs command

[Copilot]

Summary

Adds support in the logs command to filter sessions that have DIFC-filtered items in the gateway logs, via the new --filtered-integrity flag.

Changes

• pkg/cli/logs_command.go: Register the --filtered-integrity bool flag, read its value, pass it to the orchestrator, and add a usage example.
• pkg/cli/logs_orchestrator.go:
  • Add filteredIntegrity bool parameter to DownloadWorkflowLogs.
  • Add filtering block: when --filtered-integrity is set, call runHasDifcFilteredItems and skip runs with no DIFC-filtered events. Errors from the check produce an unconditional warning (not silently skipped).
  • Add runHasDifcFilteredItems helper that calls parseGatewayLogs (with automatic fallback to rpc-messages.jsonl) and returns true when TotalFiltered > 0.
• pkg/cli/logs_filtering_test.go:
  • Add filtered-integrity to the flag-presence test.
  • Add TestRunHasDifcFilteredItems (table-driven, covers gateway.jsonl, mcp-logs/gateway.jsonl, no-file, and no-DIFC cases).
  • Add TestFilteredIntegrityFlag to assert default value and usage text.
• Fix all existing DownloadWorkflowLogs call sites in test files to include the new parameter.

Usage

gh aw logs --filtered-integrity          # Only sessions with DIFC integrity-filtered items
gh aw logs --filtered-integrity -c 20   # Same, limit to 20 runs

[pelikhan]

@copilot refactor DownloadWorkflowLogs to take an options type rather than a gazillion parameters

[Copilot]

Pull request overview

Adds a new gh aw logs --filtered-integrity flag to filter workflow runs to those that contain DIFC-filtered items in MCP gateway logs, wiring the flag from the CLI command into the logs download orchestrator and extending tests/call sites accordingly.

Changes:

• Register and plumb a new --filtered-integrity boolean flag through logs → DownloadWorkflowLogs.
• Add DIFC filtered-item gating in the orchestrator via a new runHasDifcFilteredItems helper (uses gateway log parsing with rpc-messages fallback).
• Update/extend unit tests and fix DownloadWorkflowLogs call sites to pass the new parameter.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/cli/logs_command.go	Adds the --filtered-integrity flag, reads it, passes it to the orchestrator, and updates examples/help text.
pkg/cli/logs_orchestrator.go	Extends DownloadWorkflowLogs signature, adds DIFC-based run filtering, and introduces runHasDifcFilteredItems.
pkg/cli/logs_filtering_test.go	Extends flag-presence assertions and adds tests for the new helper/flag registration.
pkg/cli/logs_json_stderr_order_test.go	Updates orchestrator call sites to include the new parameter.
pkg/cli/logs_download_test.go	Updates orchestrator call sites to include the new parameter.
pkg/cli/logs_ci_scenario_test.go	Updates orchestrator call sites to include the new parameter.
pkg/cli/context_cancellation_test.go	Updates orchestrator call sites to include the new parameter.

Comments suppressed due to low confidence (1)

pkg/cli/logs_orchestrator.go:906

• The --filtered-integrity flag text implies integrity-only filtering, but runHasDifcFilteredItems returns gatewayMetrics.TotalFiltered > 0, which counts all DIFC_FILTERED events (integrity and secrecy). Either (a) filter specifically on FilteredEvents[i].Reason == "integrity", or (b) rename/update the flag + help text to reflect that it matches any DIFC-filtered event.

	if gatewayMetrics == nil {
		return false, nil
	}

	return gatewayMetrics.TotalFiltered > 0, nil

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.