registerScanFlags registers all scan command flags on cmd, binding to opts.

renderMessages substitutes placeholders in the scan template's MainTask for a single scan item. planGuidance is the output of maybeRunPlan and gets su

通过 git rev-parse 解析仓库根，避免等待 VS Code Git 扩展初始化。

requireGitRepo validates that the given directory is part of a git repository.

resolveEnv reads environment variables to override defaults. Environment takes highest priority.

resolveFromFileContent scans the new file content line-by-line for consecutive matches of the normalized existing_code.

resolveFromHunk tries to find startLine/endLine by matching ExistingCode against hunk lines. It tries the new-side first (context + added lines → new-

resolveSystemRule returns the rule text for a given file path, matching against PathRuleMap glob patterns, falling back to DefaultRule.

resolver returns the rules Resolver, asserting DetailResolver if available.

reviewMode returns the string mode identifier.

runeWrapCut returns a rune index suitable for breaking the line at ~maxW display width.

runtimeConfigSHA256 is the deterministic identity of the allowlisted, non-secret runtime settings: protocol, model, sanitized endpoint host, language,

sanitizeEndpointHost extracts the credential-free host[:port] from a full LLM endpoint URL, dropping scheme, any embedded userinfo, path, query and fr

Strip C0/C1 control characters from a metadata value.

savedSecretFingerprint returns a short fingerprint for display, e.g. "sk-a1b2...wxyz" (first 6 + "..." + last 4). Returns "" when the trimmed secret i

* 选出与 workspace 匹配的仓库。嵌套仓库场景下 repositories 顺序不稳定, * 不能直接取 [0],否则会漂移到子仓库。

severityColor maps a finding severity to an ANSI color used for its badge. Unknown or empty severities fall back to dim.

sourceArtifactSHA256 is the deterministic content identity of this run's selected input: for every non-deleted diff (the same set registerCoverage sea

* Strip YAML frontmatter from markdown content

stripMarkdownFences is the package-private workhorse used by the internal compression code paths.

summarizeArgs extracts a concise key=value summary from tool arguments for console display. It picks the most human-readable fields depending on the a

tryCCEnv reads Claude Code environment variables.

tryShellRC parses ~/.zshrc and ~/.bashrc for ANTHROPIC_* exports.

--- Validation functions ---

warningsForOutput removes coverage-level subtask diagnostics once a manifest is present. Their classification and safe summary already live in the fro

wrapByRunes splits text into lines that fit within maxWidth **rune** columns. Respects existing newlines and wraps at word boundaries.

wrapSingleRuneLine breaks one paragraph (no newlines) into rune-width-constrained lines.

Prefix the summary body with both the cross-run marker and the per-run tag. Sticky mode finds the note by SUMMARY_MARKER (cross-run reuse); non-s

ApplyLanguage injects a language directive into all system-role messages of the scan template (MAIN_TASK, PLAN_TASK if set, DEDUP_TASK if set, and MEM

BudgetExceeded always returns false for scan. Scan self-limits via its own token budget gate and MaxToolRequestTimes; the typed budget_exceeded status

CanonicalConfig returns a deterministic, order-stable field list describing this rule set's effective rule-text configuration, for hashing into the ru

CompletionTokenLimit is the scan-template counterpart of Template's method.

ExcludedDirs is the list of directory prefixes that scanners and diff providers should always skip. Exposed so internal/scan and other consumers can r

FilesReviewed returns the number of items included in this scan.

IsAllowedExt returns true when the given file extension is in the supported types list. The check is case-insensitive.

IsCommitMode returns true when analyzing a single commit.

IsExcludedPath returns true when the given file path matches any default exclude pattern. Patterns support ** (recursive directory matching), * (singl