checkLocationFile returns "" when the diff touches at least one file named in location, otherwise a one-line reason. It matches on file, not line: a f

claudeConfigDir is the host directory holding the claude session store for this scan's lineage. The container runner mounts it as CLAUDE_CONFIG_DIR so

cweFromTags extracts a single CWE id from SARIF rule tags. CodeQL emits "external/cwe/cwe-079", other tools emit "CWE-79"; both match.

dedupCandidateOpen reports whether a finding is still in the active funnel and so eligible to be marked (or kept as) a duplicate. The complement of db

distinctLanguages returns the sorted set of individual language names across every repository. Repository.Languages is a ", "-joined string written by

dnsCandidates reduces an egress allowlist to resolvable hostnames for the sidecar's DNS readiness check: it drops the host-gateway alias (which resolv

ecosystemsGetWithLink performs one GET and returns the size-capped body plus the rel="next" URL from the Link header, if present. Redirects are follow

effectiveMaxTurns resolves the turn cap: per-skill wins, then global, then the built-in default of 30.

emitProxyLogLines forwards the WARN/ERROR lines of a sidecar's log output into the scan record (prefixed "egress-proxy:"), dropping routine INFO readi

enqueueRevalidateForFinding looks up the active revalidate skill and enqueues a finding-scoped run. No revalidate skill means no auto-sort, which is f

ensureImportRepo resolves a repository URL from an import request to a Repository row, creating it on first sight.

evalRunnerStaleness is the pure staleness decision, split out so it can be tested without a registry: the image is stale when the registry digest has

expandRepoSlug turns a bare "owner/repo" into a GitHub URL. The CSV export carries only the slug and the producer is GitHub-only, so this is the only

failCreate registers a before-create callback that fails any insert for which pred returns true, simulating a mid-write database error. The returned f

fetchGitHubRepos pages through /{kind}/{owner}/repos and returns every repo.

findingIDs collects the IDs of a finding slice for membership assertions.

firstClause returns the text up to the first sentence or clause terminator, trimmed. Used to fit a ruled-out reason into one inventory-table cell whil

freeAddr returns a loopback address with nothing listening on it, so the restore server-running guard sees no server.

freeformCellString collapses a JSON value into a single-line string suitable for a markdown table cell. For leaf scalars it delegates to scalarString

genSSHKey returns an unencrypted OpenSSH ed25519 private key PEM and the corresponding public key line.

getCSAFSchema returns the compiled validator, building it on first call.

gitShowBlob runs `git show <commit>:<path>` and returns (content, isBinary, truncated, err). The read is capped at maxBrowserBytes+1 so the extra byte

goResolve launches resolveSBOMPackages. Indirected so tests can run it synchronously and avoid racing the in-memory database teardown.

hardenedNetworkCreateArgs builds the `network create` args for the per-scan --internal network. --disable-dns is load-bearing: a sidecar later connect

highlightLang returns the highlight.js language hint for path, or "" to let the library auto-detect.

isLLMAuditSkill reports whether a finalized scan is one of the curated LLM audits (security-deep-dive, vuln-scan) whose fresh output drives the auto-t

jsonTree turns a JSON document into a nested <dl> for the Data tab. Objects become dl/dt/dd, arrays become ul, scalars are escaped text. Null and empt

loadFindingDependents fetches the Dependent rows referenced by the given exposure rows, keyed by ID for cheap lookup in buildCSAF.

loadRepoFindings returns the open findings for a repo split into two slices: deep-dive output and tool-scanner output (zizmor, semgrep, …). Findings w

locationLess sorts file:line strings naturally: by file path first, then by line number as an integer. Without this, "x.html:110" sorts before "x.html

locationPaths returns the file paths a Finding.Location names. A location may list several files with line ranges and a "(data path: a -> b)" trace, e

locationURL turns a finding location ("path/to/file.rb:12-34") into a link to the in-app code browser pinned to the recorded scan commit. Returns "" w

mapProductStatus picks the CSAF product_status bucket. FindingPublished means the advisory went out, not that the bug is fixed; only emit "fixed" when

needsHardenedNetVerify reports whether a hardened scan must prove its per-scan --internal network fail-closed before running. True for rootless podman

nextLink extracts the URL of the rel="next" entry from an RFC 8288 Link header, or "" when absent.

normaliseLocation reduces "path/to/file.go:42:7" to "path/to/file.go". A leading "./" is stripped so "./src/x.go" and "src/x.go" agree.

normalizePaths expands a leading ~ in the host-filesystem paths scrutineer opens or creates (data dir, local skill dirs, profiles dir, and the recipie

noteworthyProxyLogLine reports whether a sidecar log line is worth surfacing into the scan record -- denials and failures (WARN/ERROR), not routine IN

orgImportToastTitle summarizes an org import the same way the bulk paste path does, plus a count of repos held back by the fork/archived filters.

osvAliases collects upstream identifiers: the finding's CVE and GHSA id plus any GHSA id found in a reference URL or summary. De-duplicated, CVE first

osvCWEIDs splits the finding's comma-joined CWE string into an array of normalised `CWE-N` ids, deduped and order-preserved.

osvReferenceType maps a finding reference's comma-joined tags to one of OSV's reference type enum values, defaulting to WEB.

osvSemverRangeFromFix turns a `fix_version` like "1.6.3" (with or without a leading "v") into a SEMVER range pinned at introduced=0 and fixed=<that ve

parseDiscloseOutput posts a FindingNote summarising a disclose run so the finding's Notes panel records that a draft was prepared, alongside the verif

parseImageInspect parses the two-line `image inspect` output (digest line, then created line) localRunnerImage's format template produces. A missing R

parsePackagesOutput replaces Package rows for the scan's repository. We delete all existing rows and insert whatever the skill produced, mirroring the

parsePodmanInfo splits the "<version>|<rootless>" line emitted by the podman info probe. ok is false when the line is malformed or the rootless field

parseVerifyOutput records the outcome of a finding-scoped verification run. Reproducer, evidence and notes become a FindingNote; the status transition

persistFinding writes one finding into the repository's finding set using fingerprint dedup: a match re-observes the existing row, otherwise a new row

podmanHostGatewaySupported reports whether the podman version is recent enough to honour `--add-host host.docker.internal:host-gateway`, which the egr

podmanPastaDefault reports whether the podman version defaults to the pasta backend (>= 5.0), the most reliable host-gateway -> host-loopback path for

prereqBackoff doubles the base delay per attempt up to MaxPrereqRetryDelay. Prereqs include hour-scale scans (semgrep, threat-model) competing for run

proxySidecarRunArgs builds the detached `run` args for the egress proxy sidecar: locked down (cap-drop ALL, read-only rootfs, no-new-privileges, a sma

purlType returns the ecosystem segment of a Package URL (the bit between "pkg:" and the first "/").

redactURLUserinfo strips embedded credentials from a URL before logging. Anthropic-compatible base URLs sometimes carry a token in userinfo (https://u

refreshRepoDiskUsage recomputes the clone-cache size for one repository and stores it on the row, so the repo list can read the badge from a column in

renderScanStatus loads a scan and renders the OOB row + toast fragment pushed to repo_show via the scan-status SSE event.

renderSkillMD rebuilds a SKILL.md from the stored fields. The frontmatter is re-serialised rather than preserved verbatim so UI edits round-trip clean

repoCreateError renders feedback for a failed Add Repository submission. htmx clients get an inline alert inside the dialog (a toast would render behi