normaliseThreatModel checks the input parses as JSON and re-emits it indented so the editor round-trips cleanly. Empty input is allowed (it clears the

onOverageLocked reports whether any tracked window is currently on overage (past the included quota) with an unexpired reset, or with no reset timesta

parseAppleStatus extracts the apiserver version from `container system status` output. The runtime identity is "apple"; this parses the Apple CLI outp

parseBreakingChangeOutput records the breaking-change verdict on a finding from a static analysis of the suggested-fix diff. The verdict goes into Fin

parseDependenciesOutput replaces Dependency rows for the scan's repository. Dependencies come from a git-pkgs-style manifest scan: one row per (name,

parseMajorMinor pulls the leading major and minor integers out of a dotted version string ("4.9.4" -> 4, 9). ok is false when either is absent or non-

parseMitigationOutput stores the operational mitigation guidance and the optional semgrep rule the mitigate skill emits. Both go to the finding throug

parsePostureOutput writes the disclosure-readiness tier and summary onto the Repository row. The full check list stays in scan.Report; only the tier a

parseProxySidecarNames extracts strict-prefix matches from the runtime's `ps --format {{.Names}}`. Its --filter name= is a substring match, so we re-c

parseRemoteHeads extracts branch names from `git ls-remote --heads` output (lines of "<sha>\trefs/heads/<name>"), sorted and de-duplicated.

parseSkillModel keeps the form value only if it's a configured model ID or model tier. Anything else is silently dropped so the scan falls back to the

parseSubprojectsOutput replaces Subproject rows for the scan's repository. Subprojects are a projection of the repo layout produced by the subprojects

percentile returns the p-th percentile (0..1) of a sorted slice using linear interpolation between the two nearest ranks (the same method numpy uses b

prettyJSON re-indents raw if it parses as JSON, otherwise returns it unchanged so non-JSON reports (markdown, plain text) pass through.

readArchive uncompresses a tar.gz response body and returns a map of filename -> content.

registerFlags binds every CLI flag onto fs. Split out of parseFlags so a test can parse a synthetic argv against a throwaway FlagSet -- in particular

repoFormError renders an inline error for a failed add-repo-style submission. For htmx requests it swaps the named OOB alert template (each dialog has

resolveSBOMPackages walks every unresolved package in the upload, looks up its source repository via packages.ecosyste.ms, FirstOrCreates the repo, en

resumeOpts decides whether a retry of scan should resume its claude session. Failed scans and soft-success scans that hit max turns are resumable when

safeURL returns u trimmed when it carries an http or https scheme, else empty. Applied to model-emitted URLs (html_url, icon_url) before they reach th

sanitizeBlobPath rejects absolute paths, traversal segments and NUL bytes, and returns the slash-form path safe to feed `git show <commit>:<path>`.

seedRepoWithReport creates a repo with a completed security-deep-dive scan, a finding carrying six-step prose, snippet, disclosure draft, suggested fi

splitFileLine splits a "path:line" location string. LastIndex handles Windows-style paths that contain colons; an unparseable line number degrades to

stageImportPayload writes the raw report bytes from an import-fallback run into the workspace at import/report, where the ingest skill expects to find

supportsHostGatewayAddHost reports whether the runtime accepts Docker's `--add-host name:host-gateway` marker. Apple's container CLI does not expose t

supportsPullNever reports whether `run --pull never` is supported. Apple's container CLI does not expose a pull policy flag, so callers that need a no

toValidationFindings projects findings onto the report shape and sorts them deterministically (severity high to low, then fingerprint) so the emitted

usesEgressSidecar reports whether this scan routes egress through a proxy sidecar container instead of the in-process host proxy. True only for rootle

walkMarkerPresentBounded is walkMarkerPresent with the depth and file bounds injected, so both caps are unit-testable without materialising a markerWa

withGitHubAPI points the fetcher at a test server for the duration of a test.

AccountErrorText returns s when it looks like an account-level failure from the harness's provider (a usage/rate/plan limit, or access disabled/revoke

Args is the argv (without the binary) for one skill run. effort is the runner's configured default; globalMaxTurns is the runner's -max-turns flag. Pe

BackfillFindingRepository copies Scan.RepositoryID onto Finding rows whose RepositoryID column is still zero. Used on first boot after adding the deno

CloneOrPull prepares a local copy of a git repo at dst. On first call it clones; on subsequent calls it fetches and resets to the requested ref so ski

Closed reports whether the lifecycle is terminal or hidden-by-default (fixed, published, rejected, duplicate) — a finding no longer in the active tria

ConfidenceAtLeast reports whether got ranks at or above min on the low/medium/high scale. A finding without a confidence value is dropped when a min_c

DetectRuntime resolves the operator's --runtime choice into a ContainerRuntime, verifying the engine is actually reachable. prefer is "docker" (or ""

DirAllExcluded reports whether every file under directory rel is excluded by the configured filters — i.e. the workspace pruner can safely RemoveAll/S

EgressSidecarEnv returns the SCRUTINEER_PROXY_* environment assignments the container runner injects into the egress proxy sidecar. It is the single s

FormatEvent renders an Event as one log line.

HardeningSupportError reports why the runtime cannot honour the requested hardening mode, or nil when it can. Apple's container runtime supports --har

HostLoopbackBackendLikely reports whether the detected podman is recent enough to default to a backend (pasta >= 5.0) that forwards host-gateway to th

IsNamedProfile reports whether name is a registered profile, excluding the default (which is the *absence* of a profile and cannot be the target of `r

KnownProfile reports whether name is an acceptable `?profile=` value: empty, "default", or a registered named profile. Use this to validate operator-s

NeedsEgressSidecar is the exported form of needsEgressSidecar. The startup path uses it to decide whether a hardened run sets up a per-scan egress pro

ParseRepoSpec splits a skills_repo spec into a clone URL and an optional git ref. Two forms are accepted: owner/repo[@ref] — shorthan

ParseStream reads the harness's combined stdout/stderr and emits one Event per logical line. The Event vocabulary (KindText, KindTool, KindSession, Ki

Publish sends an event to all matching clients. Non-blocking: slow clients get their channel drained.

RefreshEcosystems pre-fetches and caches the ecosyste.ms payloads for one repository. With staleOnly true, only sources past their TTL are re-fetched,

RunnerImageStaleness compares the locally pulled runner image against the :latest manifest in the registry and reports whether it is stale: a newer di

RuntimeOf returns the container runtime the given runner uses, or the docker zero value when the runner is not container-backed (LocalClaude under --n

RuntimeServerVersion returns a human-readable engine version for the settings page, e.g. "docker 24.0.7", "podman 4.9.4", or "Apple container 1.0.0",

ServeEgressProxy runs p on addr and blocks until the server stops. The egress proxy sidecar uses it to listen on a fixed port inside its container; th

SetRunnerImageStatus records the boot-time runner-image staleness result so the settings page can surface it. Called once from main after the backgrou

StartEgressProxy listens on all interfaces on an ephemeral port and serves p in a goroutine. It returns the chosen port. The caller embeds the port an

StateEnv returns the env entries (KEY=VALUE) that point the harness at containerPath as its persistent state/config directory. The runner bind-mounts

ValidateClone returns an error when s is neither empty, "shallow", nor "full". Exposed so the CLI flag can use the same rule as the YAML field.

ValidateSELinux returns an error when s is not one of "", "auto", "on", or "off". Exposed so the CLI flag can use the same rule as the YAML field.

allEcosystems returns every brief package-manager name the profile matches: the singular Ecosystem (if set) plus any in Ecosystems.

apiAuth validates bearer tokens against the currently running scan rows and puts the scan on the request context so handlers can apply the "skills onl

applyOverageDowngrade rewrites an expensive tier preference to mid when the overage fallback is active; otherwise it returns the preference unchanged.

applyResume fills a SkillJob's session-resume inputs from the scan: the claude session id to --resume (set on a retry that carries one forward from a

assertProfileChainAcyclic walks the chain reached by next() from every registered profile and fails if a name repeats. A FallbackProfile cycle would s

buildResumePrompt is the nudge handed to a `--resume`d run. The prior turns are already in context, so this just tells the agent to carry on and resta

cancelScan aborts one non-terminal scan. A running scan is signalled through the worker, which flips its row and publishes scan-status as it unwinds;