fix(rees): scan added lines whose content starts with ++ across all diff parsers (#2531)

Every review-enrichment diff parser guarded file headers with an unanchored
`startsWith("+++")`. git renders an added line whose content is `++x` as
`+` + `++x` = `+++x` (and `++ x` as `+++ x`), so that line was mistaken for a
`+++ b/file` header and skipped. In secret-scan.ts a secret on such a line was
never scanned (scanSecrets calls scanPatch directly).

Fixes, by parser input shape:
- Hunk-structured parsers (secret-scan, secret-log, iac-misconfig, redos,
  actions-pin, eol-check, duplication-scan, shared analysis-context) track hunk
  state: headers only precede the first @@, and inside a hunk the first char is
  the +/-/space op, so both `+++x` and `+++ x` are scanned.
- Parsers that also accept header-only/headerless fragments (history,
  heavy-dependency) use a shared isDiffFileHeaderLine helper that matches only a
  real header form (`+++ b/…`/`--- a/…`/`/dev/null`), so `+++ x` content is kept
  while true headers are skipped — and headerless single-line diffs still work.
- Manifest/lockfile parsers (dependency-scan, lockfile-drift) keep an anchored
  `+++ ` guard; their content never begins a line with `++`.

Adds regression tests: scanPatch finds a secret on both `++x`- and `++ x`-content
lines, collectAddedLines recovers the `++x` line, and isDiffFileHeaderLine has a
unit covering headers vs `++`/`--` content and headerless diffs.

No issue because issue creation is restricted on this repo; this consolidates a
duplicated diff-parsing guard, no schema or API change.

Author: glorydavid03023

review-enrichment/src/analysis-context.ts

@@ -309,14 +309,17 @@ export function collectAddedLines(
   for (const file of files) {
     if (!file.patch) continue;
     let newLine = 0;
+    let inHunk = false;
     for (const line of boundedPatchLines(file.patch, options.metrics, "added_lines_patch_bytes")) {
-      if (line.startsWith("+++") || line.startsWith("---")) continue;
-      if (line.startsWith("diff ") || line.startsWith("index ")) continue;
       const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
       if (hunk) {
         newLine = Number(hunk[1]);
+        inHunk = true;
         continue;
       }
+      // Skip the pre-hunk preamble (diff/index + the `+++ `/`--- ` file headers). INSIDE a hunk the first char
+      // is the +/-/space op, so `+++x`/`+++ x` added content is collected, not mistaken for a header.
+      if (!inHunk) continue;
       if (line.startsWith("+")) {
         if (addedLines.length >= MAX_CONTEXT_ADDED_LINES) {
           options.metrics?.recordCappedWork("added_lines", 1);
@@ -365,13 +368,19 @@ export function filesHaveAddedLines(
 ): boolean {
   for (const file of files) {
     if (!file.patch) continue;
+    let inHunk = false;
     for (const line of boundedPatchLines(
       file.patch,
       options.metrics,
       "has_added_lines_patch_bytes",
     )) {
-      if (line.startsWith("+++") || line.startsWith("---")) continue;
-      if (line.startsWith("+")) return true;
+      if (line.startsWith("@@")) {
+        inHunk = true;
+        continue;
+      }
+      // Inside a hunk every added line starts with `+` (including `+++x`/`+++ x` content); the `+++ `/`--- `
+      // headers only appear in the pre-hunk preamble.
+      if (inHunk && line.startsWith("+")) return true;
     }
     if (file.patch.length > MAX_CONTEXT_PATCH_BYTES) return true;
   }

review-enrichment/src/analyzers/actions-pin.ts

@@ -16,13 +16,16 @@ export function scanWorkflowPins(
 ): ActionPinFinding[] {
   const findings: ActionPinFinding[] = [];
   let newLine = 0;
+  let inHunk = false;
   for (const line of patch.split("\n")) {
-    if (line.startsWith("+++") || line.startsWith("---")) continue;
     const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
     if (hunk) {
       newLine = Number(hunk[1]);
+      inHunk = true;
       continue;
     }
+    // Skip pre-hunk preamble; inside a hunk `+++x`/`+++ x` is added content, not a header.
+    if (!inHunk) continue;
     if (line.startsWith("+")) {
       const match = USES_RE.exec(line.slice(1));
       if (match) {

review-enrichment/src/analyzers/dependency-scan.ts

@@ -109,7 +109,7 @@ export function extractDependencyChanges(
       const sign = line[0];
       if (
         (sign !== "+" && sign !== "-") ||
-        line.startsWith("+++") ||
+        line.startsWith("+++ ") ||
         line.startsWith("---")
       )
         continue;

review-enrichment/src/analyzers/diff-lines.ts

@@ -0,0 +1,17 @@
+/**
+ * Shared unified-diff line helpers for analyzers that scan patch fragments which may or may not include hunk
+ * headers (so they cannot rely on hunk state).
+ */
+
+/**
+ * True only for a real unified-diff FILE HEADER — `+++ b/path`, `--- a/path`, or `+++ `/`--- /dev/null`
+ * (marker run + space + an `a/`/`b/` prefix or `/dev/null`).
+ *
+ * This deliberately does NOT match added/removed CONTENT whose text begins with `++`/`--`: git renders an
+ * added line whose content is `++x` as `+` + `++x` = `+++x`, and `++ x` as `+++ x`. An anchored
+ * `startsWith("+++ ")` guard skips `+++ x` as if it were a header and drops the real added line; keying on the
+ * header's path form scans that content while still skipping true headers.
+ */
+export function isDiffFileHeaderLine(line: string): boolean {
+  return /^(?:\+\+\+|---) (?:[ab]\/|\/dev\/null)/.test(line);
+}

review-enrichment/src/analyzers/duplication-scan.ts

@@ -184,7 +184,6 @@ export function extractAddedBlocks(patch: string | undefined): NormBlock[] {
       continue;
     }
     if (!inHunk) continue;
-    if (line.startsWith("+++")) continue; // file header inside the patch, not an added line
     if (line.startsWith("+")) {
       const norm = normalizeLine(line.slice(1));
       if (norm === null) {

review-enrichment/src/analyzers/eol-check.ts

@@ -59,11 +59,17 @@ export function extractVersionPins(
     if (filesScanned >= MAX_EOL_FILES) break;
     filesScanned += 1;
     const base = file.path.split("/").pop() ?? file.path;
+    let inHunk = false;
     for (const raw of file.patch.split("\n")) {
       if (linesScanned >= MAX_EOL_PATCH_LINES || pins.length >= MAX_EOL_PINS)
         return pins;
       linesScanned += 1;
-      if (raw[0] !== "+" || raw.startsWith("+++")) continue;
+      if (raw.startsWith("@@")) {
+        inHunk = true;
+        continue;
+      }
+      // Only added content inside a hunk; the `+++ ` header precedes the first hunk.
+      if (!inHunk || raw[0] !== "+") continue;
       const line = raw.slice(1).trim();
       if (isDockerfile(file.path)) {
         const match =

review-enrichment/src/analyzers/heavy-dependency.ts

@@ -8,6 +8,7 @@ import type {
 } from "../types.js";
 import type { AnalysisContext } from "../analysis-context.js";
 import { extractDependencyChanges } from "./dependency-scan.js";
+import { isDiffFileHeaderLine } from "./diff-lines.js";
 import { boundedFetchJson } from "../external-fetch.js";
 
 const MAX_WEIGHT_LOOKUPS = 20;
@@ -59,7 +60,8 @@ function addedPatchLines(
         continue;
       }
       if (raw.startsWith("\\ No newline")) continue;
-      if (raw.startsWith("+") && !raw.startsWith("+++")) {
+      // Skip real file headers (`+++ b/…`) but scan added CONTENT that begins with `++` (rendered `+++x`/`+++ x`).
+      if (raw.startsWith("+") && !isDiffFileHeaderLine(raw)) {
         lines.push({
           file: file.path,
           line: nextLine || 1,
@@ -68,7 +70,7 @@ function addedPatchLines(
         nextLine += 1;
         continue;
       }
-      if (raw.startsWith("-") && !raw.startsWith("---")) continue;
+      if (raw.startsWith("-") && !isDiffFileHeaderLine(raw)) continue;
       if (nextLine) nextLine += 1;
     }
   }

review-enrichment/src/analyzers/history.ts

@@ -12,6 +12,7 @@
 import type { AnalyzerDiagnostics, EnrichRequest, HistoryFinding } from "../types.js";
 import type { AnalysisContext } from "../analysis-context.js";
 import { boundedFetchJson } from "../external-fetch.js";
+import { isDiffFileHeaderLine } from "./diff-lines.js";
 
 const GITHUB_API = "https://api.github.com";
 const GITHUB_API_VERSION = "2022-11-28";
@@ -225,7 +226,8 @@ function diffAddedText(req: EnrichRequest): string {
   const added: string[] = [];
   for (const src of sources) {
     for (const line of src.split("\n")) {
-      if (line.startsWith("+") && !line.startsWith("+++")) added.push(line.slice(1));
+      // Skip real file headers (`+++ b/…`) but keep added CONTENT that begins with `++` (rendered `+++x`/`+++ x`).
+      if (line.startsWith("+") && !isDiffFileHeaderLine(line)) added.push(line.slice(1));
     }
   }
   return added.join("\n");

review-enrichment/src/analyzers/iac-misconfig.ts

@@ -75,10 +75,10 @@ export function scanPatchForIacMisconfig(
   let secureFalseLine = 0;
   let prodLine = 0;
   let debugLine = 0;
+  let inHunk = false;
 
   for (const line of patchLines(patch)) {
     if (limits.signal?.aborted) throw new Error("analyzer_aborted");
-    if (line.startsWith("+++") || line.startsWith("---")) continue;
     const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
     if (hunk) {
       newLine = Number(hunk[1]);
@@ -88,8 +88,11 @@ export function scanPatchForIacMisconfig(
       secureFalseLine = 0;
       prodLine = 0;
       debugLine = 0;
+      inHunk = true;
       continue;
     }
+    // Skip pre-hunk preamble; inside a hunk `+++x`/`+++ x` is added content, not a header.
+    if (!inHunk) continue;
     if (!line.startsWith("+")) {
       if (!line.startsWith("-")) newLine++;
       continue;

review-enrichment/src/analyzers/lockfile-drift.ts

@@ -120,7 +120,7 @@ function* patchLines(
   for (const raw of patch.split("\n")) {
     seen += 1;
     if (seen > maxLines) break;
-    if (raw.startsWith("+++") || raw.startsWith("---")) continue;
+    if (raw.startsWith("+++ ") || raw.startsWith("---")) continue;
     const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
     if (hunk) {
       newLine = Number(hunk[1]);