opencode-swarm 7.190.1 → 7.191.0

package/dist/pr-review/render-review-body.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Pure PR-review submission body renderer (issue #3096, Workstream C PR 1/2).
+ *
+ * Renders settled PR-review findings into the GitHub PR Review submission body
+ * plus the inline-comment plan. STRICTLY pure: no filesystem, no network, no
+ * clock — authorization and transport live in `src/tools/pr-review-submission.ts`
+ * so any future preview surface (e.g. #3097 post-abort export) can reuse this
+ * module without submission authority.
+ */
+export declare const PR_REVIEW_INLINE_COMMENT_CAP = 20;
+/** GitHub rejects oversized review bodies (~64 KiB); cap the rendered body below it. */
+export declare const PR_REVIEW_BODY_CHAR_CAP = 60000;
+export interface RendererFinding {
+    finding_id: string;
+    status: string;
+    file_line: string;
+    evidence: string;
+    next_action: string;
+    severity?: string;
+}
+export interface RendererCoverage {
+    kind: string;
+    unresolved_dimensions: string[];
+}
+export interface RenderReviewBodyInput {
+    run_id: string;
+    pr_head_sha: string;
+    verdict?: string;
+    base_verification?: string;
+    coverage: RendererCoverage;
+    findings: RendererFinding[];
+    /** Previously posted comment/review bodies; findings whose rendered marker already appears are skipped (AC4 dedupe). */
+    existingComments?: string[];
+}
+export interface RenderedInlineComment {
+    path: string;
+    line: number;
+    body: string;
+    finding_id: string;
+}
+export interface RenderedReviewBody {
+    body: string;
+    inlineComments: RenderedInlineComment[];
+    /** finding ids skipped because their rendered marker already appears in existingComments. */
+    skippedAsPosted: string[];
+    /** inline comments dropped by the cap (disclosed in the body). */
+    truncatedInlineComments: number;
+    /** findings omitted from the body as dismissed (severity NONE at settlement). */
+    dismissedCount: number;
+    /** true when the body exceeded PR_REVIEW_BODY_CHAR_CAP and was truncated with a disclosure. */
+    bodyTruncated: boolean;
+}
+export declare function renderPrReviewSubmissionBody(input: RenderReviewBodyInput): RenderedReviewBody;

package/dist/tools/index.d.ts

@@ -117,6 +117,7 @@ export { lean_turbo_runner_status } from './lean-turbo-runner-status';
 export { lean_turbo_status } from './lean-turbo-status';
 export { lint_spec } from './lint-spec';
 export { mutation_test } from './mutation-test';
+export { executePrReviewSubmission, pr_review_submission, } from './pr-review-submission';
 export { executePreparePrWorkflowCheckout, prepare_pr_workflow_checkout, } from './prepare-pr-workflow-checkout';
 export { executeRebindPrFeedbackHead, rebind_pr_feedback_head, } from './rebind-pr-feedback-head';
 export { executeRecordBranchFreshness, record_branch_freshness, } from './record-branch-freshness';

package/dist/tools/manifest.d.ts

@@ -72,6 +72,7 @@ export declare const TOOL_MANIFEST: {
     plan_conflict_check: () => ToolDefinition;
     prepare_pr_feedback_scope: () => ToolDefinition;
     write_pr_review_artifact: () => ToolDefinition;
+    pr_review_submission: () => ToolDefinition;
     write_pr_review_trigger_eval: () => ToolDefinition;
     test_runner: () => ToolDefinition;
     test_impact: () => ToolDefinition;

package/dist/tools/pr-review-submission.d.ts

@@ -0,0 +1,10 @@
+import type { ExternalToolRunOptions, ExternalToolRunResult } from '../utils/external-tool-runner.js';
+import { createSwarmTool } from './create-tool.js';
+export declare const _internals: {
+    resolveGhBinary: () => string | null;
+    runExternalTool: (options: ExternalToolRunOptions) => Promise<ExternalToolRunResult>;
+};
+export declare function executePrReviewSubmission(args: unknown, directory: string, context?: {
+    sessionID?: string;
+}): Promise<string>;
+export declare const pr_review_submission: ReturnType<typeof createSwarmTool>;

package/dist/tools/secretscan.d.ts

@@ -18,14 +18,26 @@ export interface SecretscanResult {
     count: number;
     files_scanned: number;
     skipped_files: number;
+    /**
+     * Files suppressed by `.secretscanignore` patterns (#3107, explicit-files
+     * path only; optional for legacy producers, treated as 0). Audit/
+     * diagnosability counter — never part of the #2918 vacuous-coverage
+     * predicate, which keys on policy_skipped_files. The directory path emits
+     * literal 0 (traversal prunes at visitation and does not track
+     * per-suppression counts — see the caution on policy_skipped_files).
+     */
+    ignored_files?: number;
     /**
      * Skips attributable specifically to scan-policy extension exclusion
      * (#2918). The extension-exclusion site in runSecretscanOnFiles is the
      * ONLY increment site: binary-content skips, missing files, invalid
-     * entries, and every incomplete route deliberately do NOT count, so
-     * `policy_skipped_files === requested_files` with zero findings and zero
-     * incomplete coverage proves vacuous coverage (nothing the scan policy
-     * allows scanning was requested).
+     * entries, .secretscanignore suppressions (#3107), and every incomplete
+     * route deliberately do NOT count, so `policy_skipped_files ===
+     * requested_files` with zero findings and zero incomplete coverage proves
+     * vacuous coverage (nothing the scan policy allows scanning was
+     * requested). Ignore-file suppressions count toward skipped_files only —
+     * a repo-writable ignore file can never satisfy the vacuous-coverage
+     * predicate of the changed-file gate.
      */
     policy_skipped_files: number;
     /**
@@ -70,6 +82,16 @@ export declare function runSecretscan(directory: string): Promise<SecretscanResu
  * Run secretscan over an explicit, already-selected file set.
  * Used by pre_check_batch so changed-file hard gates share the same detector
  * registry and entropy logic as the standalone scanner.
+ *
+ * #3107: also reads `.secretscanignore` at the scan root with the same pattern
+ * language and precedence as the directory scan (exact names + globs; comments,
+ * blanks, and unsafe patterns skipped; ancestor directories prune like
+ * traversal). Ignore-matched files that reach the ignore check count toward
+ * `skipped_files` only — never `policy_skipped_files` — so the #2918
+ * vacuous-coverage fail-closed arm keeps biting on all-ignored batches. One
+ * deliberate carve-out: the docs-safe extension-exclusion route is evaluated
+ * FIRST (#2918, pinned by test), so an ignore-matched `.md`/`.markdown`/`.mdx`
+ * file keeps its extension accounting and the ignore file is inert for it.
  */
 export declare function runSecretscanOnFiles(files: string[], directory: string, 
 /**

package/dist/tools/tool-metadata.d.ts

@@ -273,6 +273,10 @@ export declare const TOOL_METADATA: {
         description: string;
         agents: "architect"[];
     };
+    pr_review_submission: {
+        description: string;
+        agents: "architect"[];
+    };
     prepare_pr_feedback_scope: {
         description: string;
         agents: "architect"[];

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.190.1",
+	"version": "7.191.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",