autoComputeFixValidation is the anchor half of onScanFinalized. For a scan marked with BaselineScanID it diffs the baseline scan's findings against th

verifySkillName is shared with server.go: the heavier reproduction-running checker chained after revalidate when a High/Critical finding is judged a t

buildEgressAllow assembles the proxy allowlist: the harness's model-API hosts first, then the harness-neutral base. Hardened mode starts from Hardened

buildSkillPrompt is the activation prompt handed to claude. It's a thin wrapper: the skill's SKILL.md holds the actual instructions, we just tell clau

checkHardenedWorkspace returns an error when a hardening mode is on and the cloned workspace exceeds HardenedWorkspaceCapBytes. It applies under both

classifyScope derives direct-vs-transitive from the SBOM's relationship graph. Roots are nodes that originate DEPENDS_ON edges but are never themselve

copyTree recursively copies src to dst, preserving permissions but not ownership or timestamps. Symlinks are recreated; everything else is copied byte

decodeJSON unmarshals a recorded response body into out, failing the test with the body on error so a non-JSON response (e.g. an error page) shows up

dirSize sums the on-disk size of every regular file under root. Used by hardened mode to refuse a scan whose workspace is large enough to fill the hos

ensureClone returns the path to an up-to-date clone of repo.URL under the given work root. fullClone selects between --depth 1 (false, the default) an

envMap turns a map into a getenv-shaped lookup with "" for misses.

gateRepo creates a git repo under dir with one file pkg/foo.go containing numbered lines 1..20, edits line 12, captures a real `git diff`, then resets

hardenedEgressBlockArgs builds the `run` args for probe (a): a container on the per-scan --internal network, no proxy env, that must fail to reach a r

injectProfileGuide copies the resolved profile's PROFILE.md into the workspace as CLAUDE.md so claude-code auto-loads it as project memory ahead of th

needsKeepID reports whether `run` invocations must add --userns=keep-id to keep bind-mount writes owned by the invoking host user. True only for rootl

osvAffectedKinds splits an OSV record's affected[] into the entries that carry a package and the entries that carry only ranges, so a test can assert

parseHighlight decodes `line=N` or `line=N-M` into an inclusive range. Returns (0, 0) when missing or malformed.

parseRevalidateOutput records the cheap classifier verdict for a finding. The verdict and reason become a FindingNote; an adjusted severity overwrites

postExploitedForm posts a form-encoded request to the exploitation handler, mimicking the browser form on the finding page.

readCappedReport returns the first maxReportBytes bytes of the file at path, or an empty string if the file doesn't exist. Oversize files are truncate

repoBlob reads one file via `git show <commit>:<path>` from the worker's repo-cache, so historical commits resolve even after rescans move HEAD.

resolveListen turns the SidecarListenFirstIface keyword in the listen host into the concrete IPv4 of the sidecar's first interface -- its per-scan --i

runBackup writes a consistent snapshot of data/scrutineer.db to -to (or a timestamped file in the working directory). It relies on VACUUM INTO, which

runRestore replaces data/scrutineer.db with the database at -from. It refuses to run while a server is reachable on the configured address and validat

seedAuditFixture creates a repo with a running scan (for the bearer token) and a Low-severity finding so it lands in the audit queue.

seedFindingForAPI returns a finding plus the bearer token a skill running against the same repo would present. A second repo+scan provides a token tha

seedScanWithSkill creates a repo + skill (with the given schema) + running scan whose APIToken authenticates and whose SkillID points at the skill, so

BaseScoreFromVector computes the CVSS base score for a v3.0 or v3.1 vector. Returns (0, false) when the vector is empty or unparseable; callers should

CacheHitRatio is the share of total input tokens served from the prompt cache. 0 when nothing has been recorded.

DependencyFindings joins an application repository's Dependency rows against every Package row in the database (any repository) and returns the live F

DependencyVisibleByDefault reports whether a dependency should be treated as part of the shipped/runtime graph. Unknown values stay visible so new eco

EnsureCommit deepens the per-URL cache so commit becomes reachable. No-op when the commit is already present (the common case after the scan that reco

GetSetting returns the stored value for key and whether a row exists. It uses Find rather than First so a missing key is a clean (zero rows) result in

HostSELinuxState reports the host's SELinux mode for the startup diagnostic, reading the selinuxfs status node: "enforcing" (enforce==1) or "permissiv

JoinPatterns serialises a slice of patterns into the newline form stored on db.Skill.

ProxyURLForHost builds the http_proxy-style URL for containers reaching the in-process host proxy. Docker/Podman pass HostGatewayAlias; Apple's contai

SetFindingLabels replaces a finding's label set with the given names. Labels not already in the DB are created with a default (no color). Empty slice

ValidateEffort returns an error when s is not a known effort level. Empty is valid (caller keeps the default). Exposed so the CLI flag can use the sam

ValidateRuntime returns an error when s is neither empty, "docker", "podman", nor "apple". Exposed so the CLI flag can use the same rule as the YAML f

VerifySELinuxMount smoke-tests a relabeled bind mount the way real scans use one, so an SELinux denial fails once at startup with an actionable messag

canonicalType reduces a PURL type or ecosystem string to the one PURL type both sources agree on.

containerScriptOutput runs `sh -c script` in a throwaway container with the given extra run args and returns trimmed combined output.

dependentCacheRoot returns the shared on-disk path scrutineer reuses across exposure scans of the same dependent URL. Keyed by sha256 of the URL so di

effectiveEffort resolves the claude --effort level: the per-scan value snapshotted at enqueue wins, then the runner's configured default.

fetchRef updates an existing cache checkout to ref, or to the remote's default branch when ref is empty. It fetches the ref by name and resets to FETC

importFindings mirrors the worker's fingerprint-then-upsert loop so an import behaves like a scan: re-importing the same report bumps SeenCount on exi

initOrigin builds a bare repo whose default branch has two commits with a tag at the first one. Returns (origin URL using file://, sha of first commit

loadWorkbench assembles the workbench tab's data. seedReport is the latest threat-model scan's report.json, used to seed the editor when the operator

lookupFetcher builds a fetcher for the single-response ?param={repoURL} lookup endpoints (repo, packages, commits, issues).

markerPresent reports whether a single marker is satisfied under srcDir, dispatching on the marker's mode (exact path, Glob pattern, or bounded Walk).

stageContext writes the workspace-level context.json that every skill can rely on. Kept small and boring on purpose: skills that need more detail can

parseFindingIDs reads the finding_ids form values, which may arrive as repeated fields and/or comma-separated lists, into a de-duplicated slice. An em

parseHardenedNetworkNames extracts strict-prefix matches from the output of the runtime's network listing. The docker/podman --filter name= is a subst

parseReleaseWatchOutput records whether the upstream has cut a release containing the fix. When released=true, the tag, URL, and timestamp go to the f

parseRepoOverviewOutput reads `brief`'s structured output and writes the detected fields onto the Repository row. Brief wins over ecosyste.ms for the

parseVerifyStatus pulls the verify skill's status enum out of a verify scan's report.json. Empty when the report is absent or unparseable, which the c

profileBuildArgs assembles the `build` argv for a profile image. Pure (no I/O) so the chained-vs-runner branching is unit-testable without a runtime.

proxyPortFromURL extracts the port from a proxy URL of the shape ProxyURL produces (http://user:tok@HOST:PORT).

resolveBaseDigest returns a content fingerprint of runnerImage as it currently resolves in the registry, so a moved tag (notably the default :latest)

resolveProfile picks the runner image for this scan. When requested is non-empty, the operator's choice wins (and "default" forces the default image);

scanEmitter returns the emit callback handed to a job handler. It appends each event to scan.Log in memory and streams it live to subscribers via publ

scanFromRequest pulls the authenticated scan off the request context.

seedCacheFile writes a file of n bytes into the clone cache for url under dataDir, so RepoDiskUsage reports a known non-zero size.