findingNotes fetches the notes rows for a finding. Used by the verify tests to assert the evidence trail lands in FindingNote now that the old Finding

parseExposureOutput reads the one-shot verdict produced by the exposure skill and upserts a finding_dependents row. Unknown status values fall back to

parseTimeField wraps parseTime and emits a transcript line when a non-empty value matches none of the accepted layouts, so a model emitting timestamps

parseUnifiedDiff extracts target file paths from a unified diff, rejecting paths that escape the workspace and malformed hunk headers. It is deliberat

proxySidecarName returns the container name for a single hardened scan's egress proxy sidecar. Uniqueness per scan keeps concurrent scans' sidecars an

readSnippet returns the source lines around the finding's primary location (file:line) read from srcDir, with snippetContextLines of context on either

The read endpoints below expose the structured rows scrutineer already populates from prior skill scans. Skills that need context for a repo (verify/p

stageSkill writes the skill's files into dst so claude-code discovers them at ./.claude/skills/{name}. SKILL.md and schema.json are reconstructed from

AddFindingReference records an external URL related to the finding.

LoadDirectory walks root looking for */SKILL.md files, parses each, and upserts into the DB. Returns the number of skills seen and any hard errors enc

LookupCWE accepts "CWE-79", "cwe-79" or "79" and returns the entry plus the canonical id. Second return is false when unknown.

New builds a queue wired to goqite. concurrency controls how many jobs the runner processes in parallel; pass 0 to use DefaultWorkerConcurrency. The r

OnOverage reports whether the Claude account is currently past its included subscription quota (any tracked window isUsingOverage with an unexpired re

PersistStreamedFinding records one finding emitted mid-scan into the concurrent-finding log so sibling scans in the same ScanGroup can read it before

ShouldDowngradeModel reports whether the max/high-to-mid overage fallback is both enabled and currently active. The web layer calls it at enqueue to r

SplitPatterns parses the newline-separated form stored in db.Skill.Paths / db.Skill.IgnorePaths into a clean slice, trimming whitespace and dropping e

Start runs the job runner until ctx is cancelled, then waits for in-flight jobs to drain. ctx is retained as the parent for every runner instance, so

WriteFindingTimeField is the time.Time twin of WriteFindingField for timestamp columns the analyst (or a skill) can set. The closed set of writable ti

dispatch routes a subcommand when args[0] names one, returning handled=true. Server flags start with "-" and an empty argv both fall through with hand

imageTag returns the content-addressed tag for a profile's Dockerfile. The runner image ref and its resolved registry digest are both folded into the

loadRepoMap batch-loads the repositories referenced by a slice of rows and returns a map keyed by repository ID. The repoID accessor abstracts over Fi

parseProxyConfig resolves the sidecar configuration from flags layered over environment defaults. Env carries the per-scan values the container runner

preferAccountErrText picks which account-error message a run should keep as it streams lines: the first account-error line seen, except that a later a

resumableReset returns a captured reset only for transient account limits.

stubVid writes an executable that prints out and exits with code, recording its argv (one per line) to args.txt next to it.

workRoot returns the per-scan workspace directory under DataDir.

writeTestKey writes PEM bytes to a temp file and returns the path.

EcosystemType returns the canonical PURL-type ecosystem to store on Package and Dependency rows: the parsed PURL type when present, else the declared

Enqueue puts a job on the queue. Higher priority is received first; use 0 for long-running scans and >0 for quick housekeeping that should jump them.

EnsureImage builds the profile's container image if it is not in the local cache and returns the tag to pass to the runtime's `run`. A runner-based pr

HostSELinuxEnabled reports whether the host has SELinux enabled (enforcing or permissive). Best-effort filesystem probe, no libselinux dependency. Per

LatestRevalidateVerdict returns the verdict from the most recent revalidate FindingNote on the finding, or empty when revalidate has not run. The audi

ProfileByName returns the registered profile, or the default profile when name is empty / "default" / unknown. Unknown names fall back rather than err

Reconfigure swaps the runner for one with a new parallelism limit without restarting the process. goqite fixes the limit at construction, so the only

ResolveHostGatewayIPv4 returns the IPv4 address that the runtime's host-gateway maps to on the given network. An empty network probes the default brid

RunnerImageName returns the container image the given runner uses for scans, or "" when the runner is not container-backed (e.g. LocalClaude under --n

SetDefaultModel pins the default model id, overriding "first entry in the pick list". Set at startup from config and mutable via settings/model; in-me

appendFixDescription folds an ingested fix description into the Trace markdown rather than writing Finding.SuggestedFix, which is reserved for diffs t

applyAccountPauseReset moves the trigger and batch to the furthest known reset, returning that effective reset for scheduling.

applyCWECategoryFilter restricts a findings query to the CWE-IDs in the given View-1400 category. UncategorizedCWE matches findings whose cwe is empty

autoEnqueueFindingDedup is wired onto Worker.OnScanFinalized. The worker calls it once after a scan completes and its findings are committed. We enque

bindMount builds a `-v` value "src:dst[:opts]" for a runner bind mount, appending the SELinux relabel option "z" when relabel is true. opts carries an

chainTestSetup creates a repo, a parent scan, a verify skill, and a finding the callback tests can act on. Returns the server, the verify skill, and a

claudeAccountErrorText returns s when it looks like an account-level message from claude-code -- a usage/plan/rate limit, or access being disabled or

loadIdentities reads an age identity file (one or more AGE-SECRET-KEY lines) or an SSH private key (PEM). Both formats are auto-detected. Encrypted SS

parsePatchOutput runs the applicability gate over a patch skill's diff and, on pass, writes Finding.SuggestedFix and Finding.SuggestedFixCommit via Wr

prepareLocalSrc populates workRoot/src by copying the user's local directory. Mirrors prepareDependentSrc's "copy into per-scan src" pattern so the co

securityHeaders enforces T3 mitigations: host header check to prevent DNS rebinding, Sec-Fetch-Site check on POST to prevent cross-origin CSRF, and a

AddFindingCommunication records one external interaction.

AuditQueue returns findings the automation has bucketed as not worth pursuing, which a TOC or VCT auditor should spot-check periodically to keep the h

CWECategories returns the View-1400 category labels in alphabetical order. Used to populate the category filter dropdown.

CWEsInCategory returns the CWE-IDs that belong to a View-1400 category, or nil for an unknown category. The UncategorizedCWE bucket is handled by appl

IsDefault reports whether p falls back to the configured runner image instead of a profile-specific built one.

ModelForTier resolves a tier name to a concrete model id: a per-tier setting in the DB wins, then a built-in heuristic over the pick list, then the ca

ResolveSELinuxRelabel turns the --selinux switch into the concrete decision of whether to add the ":z" relabel option to runner bind mounts. See the m

SQLStringLiteral renders s as a single-quoted SQL string literal, doubling any embedded single quote. It is for splicing a TRUSTED CONSTANT into a que

SeverityAtLeast reports whether got ranks at or above the threshold on the Low/Medium/High/Critical scale. An empty threshold never matches.

Snapshot writes a consistent copy of the SQLite database at src to dest using VACUUM INTO. Unlike Open it neither migrates nor otherwise writes to src

TotalInputTokens is everything billed on the input side: fresh input plus both cache categories.

ValidateGitRef restricts refs to a conservative branch/tag-name charset before they flow into the fetchRef path. The clone code already passes ref aft

ValidateTheme returns an error when s is not a known theme name. Empty is valid (caller keeps the default).