opencode-swarm 7.159.1 → 7.159.2

package/dist/tools/sast-baseline.d.ts

@@ -16,17 +16,44 @@
  *   `${relFile}|${rule_id}|L${line}|UNSTABLE|#${occurrenceIndex}`
  *   Unstable fingerprints are ALWAYS treated as NEW findings (fail-closed).
  *
+ * Reflow identity (schema 1.1.0, issue #2302):
+ *   The 3-line window hash is sensitive to adjacent-line edits and the
+ *   occurrence index shifts when an identical same-rule line is inserted
+ *   above a baselined one — both reclassify an unchanged pre-existing
+ *   finding as NEW. Every stable entry therefore also records a
+ *   position-independent reflow key
+ *   `${relFile}|${rule_id}|${sha256(trimmed flagged line).slice(0,16)}`
+ *   (aligned 1:1 with fingerprints[] in reflow_keys[]). Diff scans match
+ *   current findings against the baseline as a multiset of reflow keys
+ *   BEFORE classifying NEW; matches are reported as `moved` (never gating).
+ *   A 1.0.0 baseline has no reflow keys (they cannot be reconstructed after
+ *   the fact — findings_snapshot stores no line content) and degrades to
+ *   exact matching only until its next capture rewrites it as 1.1.0.
+ *
+ * Absorption triage (schema 1.1.0, issue #2302):
+ *   Merging a finding that matches neither the exact fingerprints nor the
+ *   reflow multiset of the prior baseline is a NOVEL ABSORPTION. EVERY novel
+ *   absorption — in already-indexed OR first-time-indexed files — requires an
+ *   explicit refreshRationale; without it the capture is BLOCKED and the
+ *   baseline is left untouched (fail-closed: a bare failure-response
+ *   recapture can never silently accept a coder-introduced vulnerability).
+ *   With a rationale, every absorbed finding records who/when/rationale in
+ *   triage_log[]. First writes (`status:'written'`) are snapshots, not
+ *   absorptions, and stay free.
+ *
  * Merge semantics:
  *   On every capture for a set of files, ALL prior fingerprints for those files
  *   are removed (full prune, engine-agnostic) before inserting current findings.
  *   This prevents stale cross-engine fingerprints from causing false-pass verdicts.
  */
 import type { SastScanFinding } from './sast-scan';
-export declare const BASELINE_SCHEMA_VERSION: "1.0.0";
+export declare const BASELINE_SCHEMA_VERSION: "1.1.0";
+/** Baselines written before issue #2302 — loaded read-only, exact matching only. */
+export declare const LEGACY_BASELINE_SCHEMA_VERSION: "1.0.0";
 /** Maximum findings to store in baseline (heuristic — open for tuning). */
 export declare const MAX_BASELINE_FINDINGS = 2000;
 export interface SastBaselineFile {
-    schema_version: '1.0.0';
+    schema_version: '1.0.0' | '1.1.0';
     phase: number;
     created_at: string;
     updated_at: string;
@@ -35,14 +62,42 @@ export interface SastBaselineFile {
     files_indexed: string[];
     /** Fingerprint strings for all indexed findings. */
     fingerprints: string[];
+    /**
+     * Position-independent reflow identities aligned 1:1 with fingerprints[]
+     * (`${relFile}|${rule_id}|${sha256(trimmed flagged line).slice(0,16)}`,
+     * '' for unstable entries). Absent in 1.0.0 files — exact matching only.
+     */
+    reflow_keys?: string[];
     /** Full findings snapshot (for auditing / debugging). */
     findings_snapshot: SastScanFinding[];
+    /**
+     * Audit trail for every novel absorption into an existing baseline
+     * (issue #2302). First writes record no entries — a snapshot is not an
+     * acceptance. Entries are dropped when their fingerprint no longer
+     * survives in fingerprints[].
+     */
+    triage_log?: BaselineTriageEntry[];
     /** True if the snapshot was truncated at MAX_BASELINE_FINDINGS. */
     truncated: boolean;
 }
+export interface BaselineTriageEntry {
+    /** Fingerprint of the absorbed finding (post-capture form). */
+    fingerprint: string;
+    /** Canonical relative path of the file containing the absorbed finding. */
+    rel_file: string;
+    rule_id: string;
+    /** Caller-supplied refresh rationale, or the first-time-index auto-rationale. */
+    rationale: string;
+    /** Session id of the capturing caller, or 'unknown-session'. */
+    actor: string;
+    /** ISO timestamp of the absorption. */
+    absorbed_at: string;
+}
 export type LoadBaselineResult = {
     status: 'found';
     fingerprints: Set<string>;
+    /** Reflow keys aligned with the loaded fingerprints (empty for 1.0.0 files). */
+    reflowKeys: string[];
     bundle: SastBaselineFile;
 } | {
     status: 'not_found';
@@ -60,6 +115,18 @@ export interface IndexedFinding {
     index: number;
     stable: boolean;
     fingerprint: string;
+    /** Position-independent reflow identity ('' when unstable — never reflow-matched). */
+    reflowKey: string;
+}
+export interface BaselinePartition {
+    preExisting: SastScanFinding[];
+    moved: SastScanFinding[];
+    newFindings: SastScanFinding[];
+}
+export interface BlockedAbsorptionFinding {
+    fingerprint: string;
+    rel_file: string;
+    rule_id: string;
 }
 export type CaptureResult = {
     status: 'written';
@@ -69,6 +136,14 @@ export type CaptureResult = {
     status: 'merged';
     path: string;
     fingerprint_count: number;
+    /** Novel absorptions recorded in triage_log by this capture. */
+    absorbed_finding_count: number;
+} | {
+    status: 'absorption_blocked';
+    path: string;
+    /** Novel findings in already-indexed files (bounded to MAX_BLOCKED_LIST). */
+    blocked: BlockedAbsorptionFinding[];
+    message: string;
 } | {
     status: 'error';
     message: string;
@@ -89,13 +164,34 @@ export declare function normalizeFindingPath(directory: string, file: string): s
  */
 export declare function fingerprintFinding(finding: SastScanFinding, directory: string, occurrenceIndex: number): FingerprintResult;
 /**
- * Assign occurrence indices to a batch of findings.
+ * Assign occurrence indices and reflow identities to a batch of findings.
  *
  * Two findings that produce the same (relFile, rule_id, contentHash) tuple
  * — e.g., copy-pasted vulnerable lines — receive different indices so they
  * get distinct fingerprints and can be individually classified.
+ *
+ * The reflow key hashes only the flagged line's own (trimmed) content, so it
+ * survives adjacent-line edits, pure line moves, and occurrence-index shifts
+ * — the three fingerprint instabilities fixed by issue #2302. It is '' when
+ * the fingerprint is unstable; unstable findings never reflow-match.
  */
 export declare function assignOccurrenceIndices(findings: SastScanFinding[], directory: string): IndexedFinding[];
+/**
+ * Partition current findings against a loaded baseline (issue #2302).
+ *
+ * 1. Exact: stable fingerprint present in baselineFingerprints → pre-existing.
+ *    Each exact match consumes one count of its reflow key — an exact
+ *    fingerprint match implies the same flagged-line content, so a baseline
+ *    entry can never absorb both an exact and a reflow match.
+ * 2. Reflow: stable finding whose reflow key still has unconsumed baseline
+ *    counts → moved (same finding, new position/window; never gating).
+ * 3. Anything else — including every unstable finding — is NEW (fail-closed).
+ *
+ * Multiset counting keeps duplicate content honest: a baseline with one
+ * `exec(cmd)` line absorbs exactly one current `exec(cmd)` line; a second
+ * identical line stays NEW.
+ */
+export declare function partitionAgainstBaseline(indexed: IndexedFinding[], baselineFingerprints: Set<string>, baselineReflowKeys: readonly string[]): BaselinePartition;
 /**
  * Capture or merge SAST findings into the phase-scoped baseline.
  *
@@ -105,6 +201,15 @@ export declare function assignOccurrenceIndices(findings: SastScanFinding[], dir
  *   This full-prune (engine-agnostic) prevents stale cross-engine entries from
  *   causing false-pass verdicts on later full-engine diff scans.
  *
+ * Absorption triage (issue #2302):
+ *   Current findings that match the prior baseline (exact fingerprint or
+ *   reflow key) are re-fingerprinted mechanically. A finding that matches
+ *   neither is a NOVEL ABSORPTION: the capture is BLOCKED unless
+ *   `refreshRationale` is supplied (the baseline is left untouched —
+ *   fail-closed), for already-indexed AND first-time-indexed files alike.
+ *   With a rationale, every absorbed finding records who (`actor`)/when/
+ *   rationale in `triage_log`.
+ *
  * Severity threshold:
  *   Callers MUST pass ALL findings regardless of severity threshold so the
  *   baseline captures the full pre-existing surface. Threshold filtering is
@@ -117,12 +222,23 @@ export declare function assignOccurrenceIndices(findings: SastScanFinding[], dir
 export declare function captureOrMergeBaseline(directory: string, phase: number, findings: SastScanFinding[], engine: 'tier_a' | 'tier_a+tier_b', scannedFiles: string[], opts?: {
     force?: boolean;
     abortSignal?: AbortSignal;
+    /** Audited rationale required to absorb novel findings in already-indexed files. */
+    refreshRationale?: string;
+    /** Identity recorded in triage_log entries (session id of the caller). */
+    actor?: string;
 }): Promise<CaptureResult>;
 /**
  * Load the SAST baseline for a given phase.
  *
  * Returns 'not_found' when no baseline file exists (first run for phase).
  * Returns 'invalid_schema' when the file is present but unparseable.
+ *
+ * Schema versions: 1.1.0 files carry reflow_keys (reflow matching active);
+ * legacy 1.0.0 files load read-only with an empty reflowKeys array — exact
+ * matching only until the next capture rewrites them as 1.1.0 (reflow keys
+ * cannot be reconstructed retroactively; findings_snapshot stores no line
+ * content). A present-but-misaligned reflow_keys array is corruption and
+ * fails closed to invalid_schema (legacy gating; recoverable by recapture).
  */
 export declare function loadBaseline(directory: string, phase: number): LoadBaselineResult;
 /**
@@ -132,6 +248,7 @@ export declare function loadBaseline(directory: string, phase: number): LoadBase
 export declare const _internals: {
     fingerprintFinding: typeof fingerprintFinding;
     assignOccurrenceIndices: typeof assignOccurrenceIndices;
+    partitionAgainstBaseline: typeof partitionAgainstBaseline;
     captureOrMergeBaseline: typeof captureOrMergeBaseline;
     loadBaseline: typeof loadBaseline;
 };

package/dist/tools/sast-scan.d.ts

@@ -32,6 +32,16 @@ export interface SastScanInput {
      * baseline diff mode: only findings absent from the phase baseline fail.
      */
     phase?: number;
+    /**
+     * Audited refresh rationale (issue #2302). Required when a capture would
+     * absorb findings that match neither the exact fingerprints nor the
+     * reflow identities of the prior baseline for already-indexed files —
+     * without it that capture is BLOCKED and the baseline is left untouched.
+     * Only meaningful together with capture_baseline: true.
+     */
+    baseline_refresh_rationale?: string;
+    /** Session id of the calling agent, recorded as the triage actor. */
+    session_id?: string;
     /** Host/tool cancellation propagated to optional external scanners. */
     abort_signal?: AbortSignal;
 }
@@ -67,17 +77,31 @@ export interface SastScanResult {
         files_skipped_non_code?: number;
     };
     /** 'baseline_captured' when capture_baseline:true succeeded */
-    status?: 'baseline_captured' | 'baseline_merged';
+    status?: 'baseline_captured' | 'baseline_merged' | 'baseline_absorption_blocked';
     /** Number of findings recorded in the baseline (capture mode only) */
     finding_count?: number;
+    /** Novel findings absorbed into the baseline under a refresh rationale (capture mode only) */
+    absorbed_finding_count?: number;
     /** Findings NOT present in the baseline (diff mode only) */
     new_findings?: SastScanFinding[];
     /** Findings that match the baseline (diff mode only) */
     pre_existing_findings?: SastScanFinding[];
+    /**
+     * Findings that match the baseline via reflow identity — same finding,
+     * new position/window (diff mode only, issue #2302). Reported separately;
+     * never gate the verdict.
+     */
+    moved_findings?: SastScanFinding[];
     /** True when a baseline was loaded and diff mode was active */
     baseline_used?: boolean;
     /** True when pre_existing_findings were truncated to fit result limits */
     truncated_pre_existing?: boolean;
+    /**
+     * True when moved_findings were truncated to fit result limits. Advisory
+     * telemetry only (no in-tree consumer) — kept for parity with
+     * truncated_pre_existing and for future audit consumers.
+     */
+    truncated_moved_findings?: boolean;
 }
 export type SastFailureKind = 'semgrep_process_exit' | 'semgrep_timeout' | 'semgrep_cancelled' | 'semgrep_output_limit' | 'semgrep_spawn_error' | 'semgrep_invalid_output' | 'semgrep_scan_error' | 'semgrep_unexpected' | 'semgrep_unclassified' | 'coverage' | 'cancelled' | 'invalid_input';
 export interface SastScanFinding {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.159.1",
+	"version": "7.159.2",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",