CredentialDetectionRunner.java

package org.egothor.methodatlas.command;

import java.io.IOException;

import java.io.PrintWriter;

import java.nio.charset.StandardCharsets;

import java.nio.file.Files;

import java.nio.file.Path;

import java.util.ArrayList;

import java.util.LinkedHashMap;

import java.util.List;

import java.util.Map;

import java.util.Objects;

import java.util.Optional;

import java.util.logging.Level;

import java.util.logging.Logger;

import java.util.stream.Collectors;

import java.util.stream.IntStream;

import org.egothor.methodatlas.CliConfig;

import org.egothor.methodatlas.ai.AiSuggestionEngine;

import org.egothor.methodatlas.ai.AiSuggestionException;

import org.egothor.methodatlas.ai.PromptBuilder;

import org.egothor.methodatlas.ai.CredentialTriageVerdict;

import org.egothor.methodatlas.api.DiscoveredMethod;

import org.egothor.methodatlas.api.CredentialCandidate;

import org.egothor.methodatlas.api.CredentialDetector;

import org.egothor.methodatlas.api.CredentialDetectorConfig;

import org.egothor.methodatlas.api.CredentialScanUnit;

import org.egothor.methodatlas.api.TestDiscovery;

import org.egothor.methodatlas.api.TestDiscoveryConfig;

import org.egothor.methodatlas.emit.SarifEmitter;

import org.egothor.methodatlas.emit.CredentialCsvEmitter;

import org.egothor.methodatlas.emit.CredentialFinding;

import org.egothor.methodatlas.emit.CredentialMasker;

/**

 * Shared orchestration for the {@code -detect-secrets} feature.

 *

 * <p>

 * Two triage strategies are supported, both producing the same outputs (log,

 * secrets CSV, and — in SARIF mode — secret results embedded in the document):

 * </p>

 * <ul>

 *   <li><b>Folded</b> (default scope with AI enabled): the command runs detection

 *       up-front via {@link #detect(List)}, hands the resulting

 *       {@link CredentialTriageContext} to the scan so each per-class classification

 *       call <em>also</em> triages that class's candidates — the class source is

 *       sent to the provider once. The command then calls

 *       {@link #applyFoldedVerdicts(List, Map)} and {@link #emitFindings}.</li>

 *   <li><b>Separate</b> ({@link #run(List, SarifEmitter)}): used with no AI, or

 *       with a {@code -secrets-include} glob (which scans files outside the

 *       discovered classes). Detection is followed by an optional dedicated triage

 *       call per file.</li>

 * </ul>

 *

 * <p>

 * The deterministic detection itself never calls AI; a failed triage degrades to

 * unverified candidates.

 * </p>

 *

 * @since 4.1.0

 */

final class CredentialDetectionRunner {

    /** Default Shannon-entropy floor handed to the detectors. */

    private static final double DEFAULT_ENTROPY = 4.0;

    /** Extension appended when deriving a SARIF artifact URI from an FQCN. */

    private static final String JAVA_EXTENSION = ".java";

    /** Grouping key used for findings that carry no fully qualified class name. */

    private static final String NO_FQCN = "";

    private final CliConfig cfg;

    private final TestDiscoveryConfig discoveryConfig;

    private final PluginLoader pluginLoader;

    private final ScanOrchestrator orchestrator;

    private final AiSuggestionEngine aiEngine;

    /** Redaction service applied to every source before triage when {@code -redact-comments} is set. */

    private final CommentRedaction redaction;

    /** Whether triage is folded into the scan's classification call (set by {@link #prepare}). */

    private boolean folded;

    /** Up-front detection result captured by {@link #prepare} for the folded path. */

    private DetectionResult preparedDetection;

    /** Triage context handed to the scan in the folded path. */

    private CredentialTriageContext preparedContext;

    /**

     * Creates a runner.

     *

     * @param cfg             parsed CLI configuration; never {@code null}

     * @param discoveryConfig discovery configuration used to enumerate test classes

     *                        and build the attribution index; never {@code null}

     * @param pluginLoader    loader used to resolve discovery providers and secret

     *                        detectors; never {@code null}

     * @param orchestrator    orchestrator used to group discovered methods by file;

     *                        never {@code null}

     * @param aiEngine        AI engine used for triage, or {@code null} when AI is

     *                        disabled (deterministic candidates are still emitted)

     */

    /* default */ CredentialDetectionRunner(CliConfig cfg, TestDiscoveryConfig discoveryConfig,

    /**

     * Deterministic detection result, plus the per-class candidate spans needed to

     * fold triage into the scan and the per-file source used for separate triage.

     *

     * <p>

     * When {@code -redact-comments} is active, {@code sourceByFile} holds the

     * <em>redacted</em> text and {@code candidatesByFqcn} omits candidates located

     * inside comments; {@code findings} always lists every candidate, because the

     * local report never leaves the machine.

     * </p>

     *

     * @param findings         all deterministic findings (triage fields {@code null})

     * @param candidatesByFqcn AI-triage candidate spans per class, in finding order;

     *                         indices refer to the position within the class's findings

     * @param refsByFile       AI-triage candidate refs per file for the separate-call path,

     *                         indices being positions within the file's findings

     * @param sourceByFile     file source text sent for separate-call triage

     *                         (redacted when {@code -redact-comments} is on)

     * @since 4.1.0

     */

            Map<String, List<PromptBuilder.CredentialCandidateRef>> candidatesByFqcn,

            Map<Path, List<PromptBuilder.CredentialCandidateRef>> refsByFile,

            Map<Path, String> sourceByFile) {

    }

    // ---------------------------------------------------------------------

    // Command-facing lifecycle (folded or separate, decided here)

    // ---------------------------------------------------------------------

    /**

     * Prepares credential detection before the scan. When triage can be folded

     * into the per-class classification call (AI enabled, default test-class scope,

     * and {@code -secrets-separate-llm} not set), this runs deterministic detection

     * up-front and returns the {@link CredentialTriageContext} the scan must thread

     * through so the class source is sent to the provider once. Otherwise returns

     * {@code null} and {@link #finish} performs detection (and any separate triage)

     * after the scan.

     *

     * @param roots scan roots; never {@code null}

     * @return the triage context to pass to the scan, or {@code null} when not folding

     * @throws IOException if up-front detection fails

     */

    /* default */ CredentialTriageContext prepare(List<Path> roots) throws IOException {

        }

    }

    /**

     * Completes credential detection after the scan: in the folded path it merges

     * the verdicts the scan collected and emits; otherwise it runs detection plus

     * optional separate-call triage and emits.

     *

     * @param roots        scan roots; never {@code null}

     * @param sarifEmitter SARIF emitter to record findings into, or {@code null}

     * @throws IOException if collecting files or writing the CSV fails

     */

    /* default */ void finish(List<Path> roots, SarifEmitter sarifEmitter) throws IOException {

        } else {

        }

    // ---------------------------------------------------------------------

    // Separate-call path

    // ---------------------------------------------------------------------

    /**

     * Runs detection, optional separate-call triage, and emission. Used when AI is

     * disabled or a {@code -secrets-include} glob is active.

     *

     * @param roots        scan roots; never {@code null}

     * @param sarifEmitter SARIF emitter to record findings into, or {@code null}

     * @throws IOException if collecting files or writing the CSV fails

     */

    /* default */ void run(List<Path> roots, SarifEmitter sarifEmitter) throws IOException {

    // ---------------------------------------------------------------------

    // Folded path (used by the command together with the scan)

    // ---------------------------------------------------------------------

    /**

     * Runs deterministic detection only, returning the findings plus the data the

     * folded path needs to triage during the scan.

     *

     * @param roots scan roots; never {@code null}

     * @return the detection result; never {@code null}

     * @throws IOException if collecting files fails

     */

    /* default */ DetectionResult detect(List<Path> roots) throws IOException {

        // Fail-closed pre-flight: redact every unit before anything is sent to the provider,

        // so a single unredactable file aborts the whole run with zero provider calls.

    }

    /**

     * Reports whether source must be redacted before reaching the AI provider.

     *

     * @return {@code true} when an AI engine is active and {@code -redact-comments} is set

     */

    private boolean redactActive() {

    }

    private Map<Path, String> redactAll(Map<Path, String> originalByFile) {

    }

    /**

     * Decides whether a candidate lies in text that redaction blanked (a comment).

     *

     * <p>

     * The redacted text shares offsets with the original, so the candidate's

     * line/column span is mapped to offsets and the two texts are compared over it.

     * Any differing character puts the candidate in a comment. The check fails

     * closed: a span that cannot be mapped inside the text is treated as blanked.

     * </p>

     *

     * @param original  the original source; never {@code null}

     * @param redacted  the redacted source, same length as {@code original}; never {@code null}

     * @param candidate the candidate to test; never {@code null}

     * @return {@code true} when the candidate must not be sent to the AI

     */

    /* default */ static boolean overlapsBlankedText(String original, String redacted,

            CredentialCandidate candidate) {

        }

        int end;

            // The detector reports the column of the offset after the match; column 1 means

            // the match ended exactly at a line break, i.e. at the start of the next line.

        } else {

        }

        }

            }

        }

    }

    /**

     * Maps a one-based line and column to a character offset, lines being split on

     * {@code '\n'} exactly as the detector splits them.

     *

     * @return the offset, or {@code -1} when the line does not exist

     */

    private static int offsetOf(String text, int line, int column) {

            }

        }

    }

    /**

     * Wraps a detection result in a triage context for the scan to fill.

     *

     * @param detection the detection result; never {@code null}

     * @return a context carrying the per-class candidates

     */

    /* default */ CredentialTriageContext toContext(DetectionResult detection) {

    }

    /**

     * Merges the verdicts the scan collected (keyed by class) back into the

     * findings, by class and candidate index.

     *

     * @param findings         the deterministic findings; never {@code null}

     * @param verdictsByFqcn   verdicts collected during the folded scan; never {@code null}

     * @return findings with triage fields populated where a verdict exists

     */

    /* default */ List<CredentialFinding> applyFoldedVerdicts(List<CredentialFinding> findings,

            Map<String, List<CredentialTriageVerdict>> verdictsByFqcn) {

    }

    /**

     * Applies the min-score filter and emits all outputs.

     *

     * @param findings     findings to emit; never {@code null}

     * @param sarifEmitter SARIF emitter to record findings into, or {@code null}

     * @throws IOException if writing the CSV fails

     */

    /* default */ void emitFindings(List<CredentialFinding> findings, SarifEmitter sarifEmitter) throws IOException {

    // ---------------------------------------------------------------------

    // Internals

    // ---------------------------------------------------------------------

    private Map<Path, List<DiscoveredMethod>> discoverByFile(List<Path> roots) throws IOException {

        try {

        } finally {

    }

    private static Map<Path, List<DetectCredentialsStage.MethodRange>> toAttribution(

            Map<Path, List<DiscoveredMethod>> byFile) {

    }

    private List<CredentialScanUnit> selectUnits(List<Path> roots,

            Map<Path, List<DiscoveredMethod>> byFile) {

        }

    }

    private static CredentialScanUnit toUnit(Path file, List<DiscoveredMethod> methods) {

        }

        try {

        }

    }

    private List<CredentialFinding> runDetectors(List<CredentialScanUnit> units,

            Map<Path, List<DetectCredentialsStage.MethodRange>> attribution) {

        try {

        } finally {

    }

    private static Map<String, List<CredentialFinding>> groupByFqcn(List<CredentialFinding> findings) {

    }

    /**

     * Builds the AI-triage candidate refs of one finding group. Candidate indices are

     * positions within the group, so verdicts still merge by index even when

     * comment-resident candidates (omitted here) leave gaps.

     *

     * @param group       findings of one class or file; never {@code null}

     * @param original    original source by absolute file path; never {@code null}

     * @param redacted    redacted source by path, or {@code null} when redaction is off

     * @return refs for the candidates that may be sent to the AI; never {@code null}

     */

    private static List<PromptBuilder.CredentialCandidateRef> refsFor(List<CredentialFinding> group,

            Map<Path, String> original, Map<Path, String> redacted) {

    }

    private static boolean inComment(CredentialFinding finding, Map<Path, String> original,

            Map<Path, String> redacted) {

    }

    private static Map<Path, List<PromptBuilder.CredentialCandidateRef>> refsByFile(

            List<CredentialFinding> findings, Map<Path, String> original, Map<Path, String> redacted) {

    }

    private static Map<String, List<PromptBuilder.CredentialCandidateRef>> candidatesByFqcn(

            List<CredentialFinding> findings, Map<Path, String> original, Map<Path, String> redacted) {

            }

    }

    private List<CredentialFinding> triageSeparately(List<CredentialFinding> findings,

            Map<Path, List<PromptBuilder.CredentialCandidateRef>> refsByFile, Map<Path, String> sourceByFile) {

        }

    }

    private List<CredentialFinding> triageGroup(Path file, List<CredentialFinding> group,

            List<PromptBuilder.CredentialCandidateRef> refs, String source) {

        }

        try {

        }

    }

    private List<CredentialFinding> filterByMinScore(List<CredentialFinding> findings) {

            }

    }

    private static void logSummary(List<CredentialFinding> kept) {

        }

    private void logFindings(List<CredentialFinding> kept) {

            // Supplier form is lazy: the message is only assembled when INFO is loggable.

    private void recordIntoSarif(List<CredentialFinding> kept, SarifEmitter sarifEmitter) {

        }

    private static String fileUri(CredentialFinding f) {

        }

    }

    private void writeCsv(List<CredentialFinding> kept) throws IOException {

}

Mutations

1.1
Location : prepare
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : prepare
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:foldedPath_redactsClassSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced equality check with false → KILLED

3.3
Location : prepare
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:foldedPath_redactsClassSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced equality check with false → KILLED

4.4
Location : prepare
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

5.5
Location : prepare
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

6.6
Location : prepare
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:foldedPath_redactsClassSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced equality check with false → KILLED

1.1
Location : prepare
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : prepare
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:foldedPath_redactsClassSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced equality check with false → KILLED

1.1
Location : finish
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : finish
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:foldedPath_redactsClassSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced equality check with false → KILLED

1.1
Location : run
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

2.2
Location : run
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:separatePath_withoutRedaction_sendsEverythingAsBefore()] removed conditional - replaced equality check with true → KILLED

4.4
Location : redactActive
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

5.5
Location : redactActive
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:separatePath_unredactableFileAbortsBeforeAnyProviderCall()] removed conditional - replaced equality check with false → KILLED

6.6
Location : redactActive
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

7.7
Location : redactActive
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:separatePath_unredactableFileAbortsBeforeAnyProviderCall()] removed conditional - replaced equality check with false → KILLED

1.1
Location : redactAll
Killed by : none Replaced integer multiplication with division → SURVIVED Covering tests

1.1
Location : overlapsBlankedText
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : overlapsBlankedText
Killed by : none removed conditional - replaced comparison check with true → SURVIVED Covering tests

3.3
Location : overlapsBlankedText
Killed by : none removed conditional - replaced comparison check with false → SURVIVED Covering tests

4.4
Location : overlapsBlankedText
Killed by : none changed conditional boundary → SURVIVED Covering tests

5.5
Location : overlapsBlankedText
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

1.1
Location : overlapsBlankedText
Killed by : none Replaced integer addition with subtraction → SURVIVED Covering tests

2.2
Location : overlapsBlankedText
Killed by : none changed conditional boundary → SURVIVED Covering tests

3.3
Location : overlapsBlankedText
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:overlapsBlankedText_handlesMultiLineSpansAndLineEndBoundary()] removed conditional - replaced comparison check with true → KILLED

4.4
Location : overlapsBlankedText
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:overlapsBlankedText_handlesMultiLineSpansAndLineEndBoundary()] changed conditional boundary → KILLED

5.5
Location : overlapsBlankedText
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:overlapsBlankedText_failsClosedOnUnmappableSpanOrLengthMismatch()] removed conditional - replaced comparison check with true → KILLED

6.6
Location : overlapsBlankedText
Killed by : none removed conditional - replaced comparison check with false → SURVIVED Covering tests

7.7
Location : overlapsBlankedText
Killed by : none changed conditional boundary → SURVIVED Covering tests

8.8
Location : overlapsBlankedText
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:overlapsBlankedText_handlesMultiLineSpansAndLineEndBoundary()] removed conditional - replaced comparison check with false → KILLED

9.9
Location : overlapsBlankedText
Killed by : none removed conditional - replaced comparison check with true → SURVIVED Covering tests

3.3
Location : overlapsBlankedText
Killed by : none removed conditional - replaced comparison check with true → SURVIVED Covering tests

4.4
Location : overlapsBlankedText
Killed by : none Replaced integer addition with subtraction → SURVIVED Covering tests

5.5
Location : overlapsBlankedText
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:overlapsBlankedText_handlesMultiLineSpansAndLineEndBoundary()] removed conditional - replaced comparison check with false → KILLED

6.6
Location : overlapsBlankedText
Killed by : none changed conditional boundary → SURVIVED Covering tests

7.7
Location : overlapsBlankedText
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:overlapsBlankedText_handlesMultiLineSpansAndLineEndBoundary()] removed conditional - replaced comparison check with true → KILLED

2.2
Location : offsetOf
Killed by : none changed conditional boundary → SURVIVED Covering tests

3.3
Location : offsetOf
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:overlapsBlankedText_handlesMultiLineSpansAndLineEndBoundary()] removed conditional - replaced comparison check with true → KILLED

2.2
Location : offsetOf
Killed by : none Replaced integer addition with subtraction → SURVIVED Covering tests

3.3
Location : offsetOf
Killed by : none removed conditional - replaced equality check with true → NO_COVERAGE

4.4
Location : offsetOf
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:overlapsBlankedText_failsClosedOnUnmappableSpanOrLengthMismatch()] replaced int return with 0 for org/egothor/methodatlas/command/CredentialDetectionRunner::offsetOf → KILLED

5.5
Location : offsetOf
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

6.6
Location : offsetOf
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

1.1
Location : toAttribution
Killed by : none replaced return value with Collections.emptyMap for org/egothor/methodatlas/command/CredentialDetectionRunner::toAttribution → SURVIVED Covering tests

1.1
Location : toUnit
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

2.2
Location : toUnit
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:separatePath_withoutRedaction_sendsEverythingAsBefore()] removed conditional - replaced equality check with true → KILLED

2.2
Location : lambda$groupByFqcn$8
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

3.3
Location : lambda$groupByFqcn$8
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:foldedPath_redactsClassSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced equality check with true → KILLED

3.3
Location : inComment
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

4.4
Location : inComment
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:separatePath_redactsSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced equality check with false → KILLED

5.5
Location : inComment
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:separatePath_redactsSourceAndWithholdsCommentSecretFromAi()] replaced boolean return with true for org/egothor/methodatlas/command/CredentialDetectionRunner::inComment → KILLED

6.6
Location : inComment
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

7.7
Location : inComment
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:separatePath_redactsSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced equality check with false → KILLED

1.1
Location : lambda$candidatesByFqcn$12
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : lambda$candidatesByFqcn$12
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:foldedPath_redactsClassSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced equality check with false → KILLED

2.2
Location : triageSeparately
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

1.1
Location : triageGroup
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : triageGroup
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

1.1
Location : filterByMinScore
Killed by : none removed conditional - replaced comparison check with true → SURVIVED Covering tests

2.2
Location : filterByMinScore
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

3.3
Location : filterByMinScore
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:separatePath_redactsSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced comparison check with false → KILLED

4.4
Location : filterByMinScore
Killed by : none changed conditional boundary → SURVIVED Covering tests

5.5
Location : filterByMinScore
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:separatePath_redactsSourceAndWithholdsCommentSecretFromAi()] removed conditional - replaced equality check with true → KILLED

1.1
Location : logFindings
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

2.2
Location : logFindings
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

1.1
Location : recordIntoSarif
Killed by : none removed conditional - replaced equality check with true → SURVIVED Covering tests

2.2
Location : recordIntoSarif
Killed by : org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.command.CredentialDetectionRunnerRedactionTest]/[method:separatePath_withoutRedaction_sendsEverythingAsBefore()] removed conditional - replaced equality check with false → KILLED