bin returns the executable name, defaulting to docker so the zero value stays valid. Mirrors ContainerRunner.image()'s empty-default pattern.

redirect sends a 303 for plain form posts and HX-Redirect for htmx requests, so every POST handler works with or without javascript.

parseFindingsOutput feeds the existing spec-deep parser so skill-driven audits surface in the Findings tab alongside the legacy claude job. Findings a

ParseFile reads a single SKILL.md (with its sibling schema.json if any) and returns a Parsed. Errors here are hard failures: unparseable YAML, missing

hasAdjacent reports whether args contains flag immediately followed by val, matching how a container `run` takes `-v host:container` / `-e KEY=VAL` pa

WriteFindingField updates a Finding column and records the change in FindingHistory. Callers pass the JSON-style field name (severity, cvss_vector, st

loadByID loads the row whose primary key matches the request's {id} path parameter, writing a 404 and returning ok=false when it does not exist. It co

enqueueSkillWith creates a skill scan using the given ScanOpts. Empty fields default cleanly: unset FindingID means not-finding-scoped, empty SubPath

seedRunningScan creates a repo + running scan with an API token so API calls made with that token are authorised.

wrap turns a handler into a goqite jobs.Func: decode payload, load the scan row, run the handler, persist status/log/report. Errors from the handler m

IsLocal reports whether this Repository points at a directory on disk (file://<abs-path>) rather than a remote git URL. Used by the worker to skip the

FingerprintFinding returns a stable hash for deduplicating the same vulnerability reported across repeated scans of one repository. The inputs are th

buildRunArgs assembles the container run flags for a skill invocation. Returns the args up to and including the image name; the caller appends the in-

Concurrency reports the parallelism limit the runner is currently using.

writeFileAt writes contents to a slash-separated path relative to dir, creating intermediate directories. Used for the ruby-ext markers, which live un

scanWorkRoot is workRoot resolved through the resume lineage.

AddFindingReview records one structured human verdict on a finding. verdict must be one of the values in ValidReviewVerdicts; the helper rejects free-

Load reads a YAML config from path. Returns (nil, nil) when the file does not exist and the caller passed "" or DefaultPath — making config fully opt-

AddFindingNote appends a timestamped note.

SettingInt returns the stored value parsed as an int, or 0 when the key is absent or unparseable. Callers treat 0 as "not configured".

ValidateReportSchema compiles schemaJSON and validates report against it. Returns "" when valid, otherwise a one-line-per-failure summary capped at ma

RepoCacheRoot returns the persistent per-URL clone directory under dataDir. The cache survives scan cleanup so subsequent scans only fetch the delta;

findingsScanIDs returns a GORM subquery selecting scan IDs that belong to the curated LLM audits (security-deep-dive, vuln-scan), to legacy/empty skil

recordRateLimit stores the latest rate-limit status for its window type and, when the overage fallback is enabled, logs the transition into or out of

runSkillWithReport wires a fakeRunner that returns the given report, runs one skill scan against a fresh DB, and returns the scanned Repository and th

Parse sniffs data, picks a parser, and returns one Result per repository-scoped batch.

SetSetting upserts key to value. SQLite has no UPDATE-or-INSERT in GORM's Save for a string primary key, so it goes through an ON CONFLICT clause.

SkillDir is the directory under workRoot where stageSkill writes SKILL.md, schema.json, and the skill's auxiliary files so this harness's own discover

buildClaudeArgs assembles the `claude -p` argv shared by the local and container runners. When the skill declares an allowed-tools list the agent is h

ExtraLocationCount is the number of grouped match positions beyond the primary one shown in Location. Used by table views to render a "+N" badge witho

dialTarget resolves a request's host:port to the address the proxy actually dials. A request to an API host (HostGatewayAlias by default) is rewritten

preflightSkill checks the skill's declared prereqs and decides what to do with the scan. Returns (deferred, err): deferred=true means the caller shoul

scanOwnsRepo enforces the rule that a scan's API token only grants access to the repository it was issued against.

PathIncluded reports whether a file at rel (forward-slash, relative to workRoot/src) is visible to a skill with the given filters. When paths is non-e

ResetTime converts the epoch-seconds resetsAt into a UTC time, or nil when the event carried no usable reset (nil receiver or non-positive timestamp).

containsEnvFlag reports whether the docker/podman argv s carries the pair `-e entry`. Adjacency matters: `-e A -e B` must not match `-e B A`.

ecosystemKey derives the (type, namespace, name) join key for a row. The PURL is authoritative; when absent the key is rebuilt by constructing the PUR

findingScoped parses the path id, resolves its repository, and enforces the scan-owns-repo auth rule. Returns false when the response has already been

harness returns the agent CLI to exec inside the container, defaulting to claude-code when none is set so the zero ContainerRunner{} keeps its histori

merge layers cfg underneath f: a config value applies only when the matching CLI flag was not set explicitly. Also pushes the model pick list and them

validateFixSetup builds a repo with an active deep-dive and verify skill, a done baseline deep-dive scan, and two findings under it — the starting sta

DefaultModel is the model id a tier falls back to when no tier-specific setting is configured. The runtime override wins; otherwise the first entry in

SetDefaultEffort pins the effort applied to new scans. No-op for an empty or unknown value so a bad config or form post leaves the current default. Se

ToModel converts a Parsed to a Skill DB row with Source pre-filled. Version is left at zero; the caller bumps it relative to any existing row.

applyPathFilters prunes workRoot/src down to the files visible to the skill given its scrutineer.paths / scrutineer.ignore_paths. This is a scoping me

createOrTriageRepo is the shared path for both single-add and bulk-add. It FirstOrCreates the Repository row and, when the row is new and triage is tr

gatePatch returns "" when the diff is acceptable, otherwise a one-line reason. Checks: diff parses; every target file exists under srcDir; the diff to

runArgs starts a runtime `run` command, adding runtime-specific flags that must precede the common options. Apple's container CLI writes lifecycle pro

DefaultEffort is the effort a new scan inherits when the caller pins none. The runtime override wins; otherwise the built-in default.

HostAllowed reports whether host matches any entry in allow. Matching is case-insensitive on the bare hostname (port already stripped). An entry "*.ex

LocationList splits the Locations column into its file:line entries. Returns nil for single-location findings (Locations empty), so templates can rang

ParseRepoInput accepts the three user-facing shapes: https://github.com/owner/repo[.git] https://github.com/owner/repo/tree/<branch>/<path...> htt

ParseStream reads claude --output-format stream-json lines from r and calls emit for each event. Lines that fail to decode are passed through as text

autoChainVerifyAfterRevalidate is wired onto Worker.OnRevalidateVerdict. The cheap revalidate pass acts as the gate for the expensive verify step: a f

computeVID shells out to the vid CLI (github.com/andrew/VID) to hash the code at the finding's sink locations into a portable identifier. Returns "" w