opencode-swarm 7.191.3 → 7.191.4

package/dist/tools/pre-check-batch.d.ts

@@ -14,7 +14,7 @@ import { resolveGatePreamble } from './phase-complete/gates/gate-helpers';
 import type { QualityBudgetResult } from './quality-budget';
 import { qualityBudget } from './quality-budget';
 import type { SastScanFinding, SastScanResult } from './sast-scan';
-import type { SecretscanErrorResult, SecretscanResult } from './secretscan';
+import type { SecretFinding, SecretscanErrorResult, SecretscanResult } from './secretscan';
 export declare const _internals: {
     qualityBudget: typeof qualityBudget;
     runLintWrapped: typeof runLintWrapped;
@@ -23,6 +23,7 @@ export declare const _internals: {
     runQualityBudgetWrapped: typeof runQualityBudgetWrapped;
     runWithTimeout: typeof runWithTimeout;
     getChangedLineRanges: typeof getChangedLineRanges;
+    getChangedLineAmbiguousFiles: typeof getChangedLineAmbiguousFiles;
     saveEvidence: typeof saveEvidence;
     runExternalTool: typeof runExternalTool;
     detectResolvedLinter: typeof detectResolvedLinter;
@@ -76,6 +77,12 @@ export interface ToolResult<T> {
     /** Duration in milliseconds */
     duration_ms: number;
 }
+/** #3092: diff-scoped classification input for evaluateSecretscanGate. */
+export interface SecretscanClassification {
+    newFindings: SecretFinding[];
+    preexistingFindings: SecretFinding[];
+    diffScoped: boolean;
+}
 export interface PreCheckBatchResult {
     /** Structured producer status. Optional only for legacy serialized results. */
     batch_status?: 'completed' | 'skipped' | 'invalid';
@@ -93,6 +100,12 @@ export interface PreCheckBatchResult {
     total_duration_ms: number;
     /** Pre-existing SAST findings on unchanged lines, requiring reviewer triage */
     sast_preexisting_findings?: SastScanFinding[];
+    /**
+     * #3092: pre-existing secret findings on unchanged lines — visible in the
+     * scan result and persisted evidence, never gating; reviewer triage input
+     * and the hook decoder's diff-scope proof.
+     */
+    secretscan_preexisting_findings?: SecretFinding[];
     /** Optional Semgrep exited nonzero with no findings; SAST coverage is incomplete. */
     sast_degraded?: boolean;
     /** SAST was intentionally disabled by the effective QA profile. */
@@ -144,6 +157,23 @@ declare function runQualityBudgetWrapped(changedFiles: string[], directory: stri
  * Returns a Map from normalised file path → Set of changed line numbers.
  */
 export declare function parseDiffLineRanges(diffOutput: string): Map<string, Set<number>>;
+/**
+ * Files whose changed-line evidence mixes more than one Git hop (#3092).
+ *
+ * `getChangedLineRanges` unions three diffs written in different coordinate
+ * systems — `mergeBase..HEAD` in HEAD coordinates, `--cached HEAD` in index
+ * coordinates, and the worktree diff — while secretscan findings carry
+ * WORKTREE line numbers (the file on disk). A file changed in a committed or
+ * staged hop and then edited again (staged and/or unstaged) can have its
+ * committed/staged line numbers shifted in the worktree, so the union's
+ * membership test alone cannot prove a finding pre-existing: a staged secret
+ * with an unstaged insertion above it lands outside the union and would read
+ * as untouched. Every finding in such a multi-hop file classifies as NEW.
+ * The set is keyed by `normalizeRepoPathKey`, matching the changed-line map.
+ * Returns null when a Git source is unavailable — callers must then treat
+ * every finding as NEW (fail-closed).
+ */
+export declare function getChangedLineAmbiguousFiles(directory: string, abortSignal?: AbortSignal, requestedFiles?: string[]): Promise<Set<string> | null>;
 /**
  * Get the union of committed, staged, unstaged, and untracked changed lines.
  * A known empty union is authoritative; null means a required Git source was
@@ -159,6 +189,39 @@ export declare function classifySastFindings(findings: SastScanFinding[], change
     newFindings: SastScanFinding[];
     preexistingFindings: SastScanFinding[];
 };
+/**
+ * Classify secret findings as "new" (on coder-changed lines) or "pre-existing"
+ * (unchanged lines) for the diff-scoped secretscan gate (#3092).
+ *
+ * Strictly fail-closed — unlike `classifySastFindings`, whose missing-key and
+ * empty-set arms deliberately read as pre-existing (pinned by
+ * tests/unit/tools/pre-check-batch-sast-preexisting.test.ts), a secret
+ * finding is PRE-EXISTING only when EVERY condition holds:
+ *
+ *   - the changed-line map is non-null,
+ *   - the finding's normalized repo-relative key is present in the map,
+ *   - the file's changed-line set is non-empty,
+ *   - the set does not carry the ALL_LINES_CHANGED sentinel (a fully-changed
+ *     file makes every finding new), and
+ *   - the finding's line is a safe positive integer and NOT a member of the
+ *     changed set — the secret sits on a line the coder did not touch.
+ *
+ * Everything else is NEW: null map, missing key, empty set, ALL-set, a line
+ * that IS a changed line, unresolvable / zero / negative / non-integer lines,
+ * malformed or root-escaping paths, and any resolution error. Never throws —
+ * a failure to resolve classifies the finding as NEW.
+ */
+export declare function classifySecretFindings(findings: SecretFinding[], changedLineRanges: Map<string, Set<number>> | null, directory: string, 
+/**
+ * #3092: files whose changed-line evidence mixes more than one Git hop
+ * (`getChangedLineAmbiguousFiles`). Findings in these files classify as
+ * NEW — the unioned map's line numbers for them are not in worktree
+ * coordinates, so non-membership cannot prove a line untouched.
+ */
+ambiguousFiles?: Set<string>): {
+    newFindings: SecretFinding[];
+    preexistingFindings: SecretFinding[];
+};
 /**
  * Run all 4 pre-check tools in parallel with concurrency limit
  * @param input - The pre-check batch input

package/dist/tools/secretscan.d.ts

@@ -1,5 +1,10 @@
 import * as fs from 'node:fs';
 import { createSwarmTool } from './create-tool';
+/**
+ * Findings cap shared by both scan paths. Exported for gate-side summary
+ * wording (#3092) — the value is a frozen contract, not a tunable.
+ */
+export declare const SECRETSCAN_MAX_FINDINGS = 100;
 type SecretType = 'api_key' | 'aws_access_key' | 'aws_secret_key' | 'private_key' | 'password' | 'secret_token' | 'bearer_token' | 'basic_auth' | 'database_url' | 'jwt' | 'github_token' | 'slack_token' | 'stripe_key' | 'sendgrid_key' | 'twilio_key' | 'generic_token' | 'high_entropy';
 type Confidence = 'high' | 'medium' | 'low';
 type Severity = 'critical' | 'high' | 'medium' | 'low';
@@ -50,6 +55,16 @@ export interface SecretscanResult {
     /** Files requested or discovered but not completely examined. */
     incomplete_files: number;
     incomplete_paths: IncompletePath[];
+    /**
+     * Findings were capped at MAX_FINDINGS and some results were discarded
+     * (#3092). Both paths set this alongside their truncation disclosure; the
+     * explicit-files path also pushes the `Results limited to ... findings`
+     * sentence into `message` exactly like the directory path. Enforcing sites
+     * treat `truncated === true` as fail-closed: findings beyond the cap were
+     * never classified, so a gate decision over the visible set cannot prove
+     * absence of new secrets.
+     */
+    truncated?: boolean;
     message?: string;
 }
 export interface IncompletePath {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.191.3",
+	"version": "7.191.4",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",