opencode-swarm 7.186.5 → 7.186.6

package/dist/tools/pre-check-batch.d.ts

@@ -123,7 +123,14 @@ declare function runLintOnFiles(resolvedLinter: ResolvedLinterCommand, files: st
 /**
  * Run secretscan with timeout
  */
-declare function runSecretscanWrapped(files: string[] | undefined, directory: string, _gates?: GateConfigOverrides, abortSignal?: AbortSignal): Promise<ToolResult<SecretscanResult | SecretscanErrorResult>>;
+declare function runSecretscanWrapped(files: string[] | undefined, directory: string, _gates?: GateConfigOverrides, abortSignal?: AbortSignal, 
+/**
+ * #2918: raw declared file count captured BEFORE the batch's validation
+ * drop loop — the gate's request basis. Plumbed into the scan result's
+ * requested_files so a dropped entry keeps requested > policy counter
+ * (non-vacuous, fail-closed).
+ */
+rawRequestedFiles?: number): Promise<ToolResult<SecretscanResult | SecretscanErrorResult>>;
 /**
  * Run SAST scan with timeout
  */

package/dist/tools/secretscan.d.ts

@@ -18,6 +18,23 @@ export interface SecretscanResult {
     count: number;
     files_scanned: number;
     skipped_files: number;
+    /**
+     * Skips attributable specifically to scan-policy extension exclusion
+     * (#2918). The extension-exclusion site in runSecretscanOnFiles is the
+     * ONLY increment site: binary-content skips, missing files, invalid
+     * entries, and every incomplete route deliberately do NOT count, so
+     * `policy_skipped_files === requested_files` with zero findings and zero
+     * incomplete coverage proves vacuous coverage (nothing the scan policy
+     * allows scanning was requested).
+     */
+    policy_skipped_files: number;
+    /**
+     * Raw declared file count backing the scan, captured BEFORE any caller
+     * validation-drop (#2918). Direct callers default to `files.length`; the
+     * pre_check batch passes its pre-drop declared count so a dropped entry
+     * keeps requested > policy counter (non-vacuous, fail-closed).
+     */
+    requested_files: number;
     /** Files requested or discovered but not completely examined. */
     incomplete_files: number;
     incomplete_paths: IncompletePath[];
@@ -25,7 +42,7 @@ export interface SecretscanResult {
 }
 export interface IncompletePath {
     path: string;
-    reason: 'cleanup_failed' | 'deadline' | 'directory_limit' | 'max_files' | 'non_file' | 'oversized' | 'read_error' | 'scope_escape' | 'symlink' | 'truncated';
+    reason: 'cleanup_failed' | 'deadline' | 'directory_limit' | 'invalid_entry' | 'max_files' | 'missing' | 'non_file' | 'oversized' | 'read_error' | 'scope_escape' | 'symlink' | 'truncated';
 }
 export interface SecretscanErrorResult {
     error: string;
@@ -54,7 +71,14 @@ export declare function runSecretscan(directory: string): Promise<SecretscanResu
  * Used by pre_check_batch so changed-file hard gates share the same detector
  * registry and entropy logic as the standalone scanner.
  */
-export declare function runSecretscanOnFiles(files: string[], directory: string): Promise<SecretscanResult | SecretscanErrorResult>;
+export declare function runSecretscanOnFiles(files: string[], directory: string, 
+/**
+ * Raw declared file count from BEFORE any caller-side validation drop
+ * (#2918). Defaults to `files.length` for direct callers; the pre_check
+ * batch passes its pre-drop capture so a dropped entry keeps
+ * requested_files above the policy-skip counter (non-vacuous).
+ */
+rawRequestedFiles?: number): Promise<SecretscanResult | SecretscanErrorResult>;
 /**
  * DI seam for testability. Contains all test-mocked exports.
  * Internal calls should use _internals.fn() instead of fn() directly.
@@ -71,6 +95,7 @@ export declare const _internals: {
     readFileChunk: typeof fs.readSync;
     closeFile: typeof fs.closeSync;
     lstatFile: (path: fs.PathLike) => fs.BigIntStats;
+    realpathSync: (path: fs.PathLike) => string;
     closeDirectory: (directory: fs.Dir) => void;
 };
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.186.5",
+	"version": "7.186.6",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",