buildTarGz writes the entries to a gzipped tar archive. Files land at the archive root with 0644; the bundle is meant to be unpacked, inspected, and f

cfgPath returns the path the loader actually used for logging.

checkRunnerImage compares the pulled runner image against the registry and, when it is stale (a newer build exists and the local one is past the age t

classifyTopLevel sorts an object's keys into scalar-shaped (single-row metadata) and array-of-objects (their own section). Arrays of scalars and neste

clearSessionStore wipes a finished scan's resume state so its next deliberate re-run starts fresh: it drops the session id and tears down the persiste

copyAux copies every top-level entry in src other than SKILL.md and schema.json (which are staged from the DB row) into dst, recursively. Delegates to

detect decodes just enough structure to tell the supported formats apart. JSON inputs are probed for top-level keys; non-JSON inputs are matched on sh

dispositionCounts returns (ruled out, became findings, unresolved). The catalogued count is len(disp).

emitSidecarLogs captures the egress proxy sidecar's logs (while it still exists) and forwards the noteworthy lines into the scan's event stream. Best-

enqueueFindingDedupForRepo looks up the active finding-dedup skill and enqueues a repository-scoped run. No dedup skill registered means no auto-dedup

enqueueValidateFixVerify runs the verify skill finding-scoped against the fix ref for each targeted finding. A missing verify skill degrades to "no re

enqueueVerifyForFinding looks up the active verify skill and enqueues a finding-scoped run, with the same absent-skill, already-queued, and log-but-do

envOr returns getenv(key) when non-empty, else def.

fieldTestValue returns a value WriteFindingField will accept for field. Most fields are free text; a few have format constraints.

finalizeScan persists the terminal/paused scan state, fires post-completion hooks, bulk-pauses the rest of the queue when this scan hit an account-lev

SARIF lets a result reference its rule by ruleId, by ruleIndex into tool.driver.rules, or both. Some emitters set only ruleIndex, so fall back to it w

findingBundleDownload writes a tar.gz containing every per-finding export scrutineer produces (OSV, CSAF, markdown report, patch.diff when one is on f

findingTimeFieldAccessor mirrors findingFieldAccessor for timestamp columns. Same closed-list pattern: adding a new editable timestamp means adding a

fixValidationVerdicts collects, for each baseline finding that had a verify run against the fix ref, that verify's reproduction-level verdict. Finding

forgeBlobURL builds a link to one file at a specific commit on the forge web UI. Returns "" when the host is not one of the four recognised forges, wh

forgeCommitURL builds a link to one commit on the forge web UI. The path segment differs by host: Bitbucket uses /commits/<sha> (plural), the others u

formatUSD renders a dollar amount with enough precision that the cheap metadata-style scans (fractions of a cent) don't all read as $0.00, while keepi

formatValidationError flattens a jsonschema validation error into one line per leaf failure as "/json/pointer: message". The library's BasicOutput alr

gatewayDialHost is the address HostGatewayAlias resolves to when dialing. "" (the host-proxy default) means 127.0.0.1, preserving the loopback rewrite

getOSVSchema returns the compiled validator, building it on first call.

hasEverBeenReportedOrAcknowledged checks if the finding ever reached reported or acknowledged status.

hasOpenRepoScopedScan returns true when a queued or running repository-scoped scan (no finding attached) of the given skill already exists for the rep

hasOpenRevalidate returns true when a queued or running revalidate scan already exists for the finding. Avoids piling duplicate work onto the queue wh

hostOf returns the host component of raw, used as the Tool name when the export carries a per-finding URL but no explicit producer field.

importFallback routes a payload that matched no supported format to the ingest skill. The raw bytes ride on the Scan row and the worker stages them in

importRevalidate reads the ?revalidate= toggle that controls whether each newly-imported finding is fed into the revalidate -> verify funnel. Absent m

inlineGmailStyles rewrites goldmark's output so the formatting survives a paste into Gmail. Code blocks are collapsed to a single styled <pre> (the ne

installRestore copies src over the database at dbPath. It writes a temp file first, then removes the WAL sidecars, then renames into place, so the liv

intVal extracts an int from an untyped JSON value. encoding/json decodes numbers as float64 by default; ruled_out.step is documented as an integer so

isEmptyJSONValue returns true for the JSON values that carry no information — "", [], {}, null. Numbers and booleans are always counted as content, on

Findings-markdown export shape: each finding is an H1 title followed by H2 sections (Details, Location, Impact, Reproduction steps, Recommended fix) a

isFreeformCellValue tells writeArraySection whether a value fits in a single markdown table cell. Strings, numbers, booleans, and short lists of those

isSQLiteFile reports whether path begins with the SQLite file magic, so restore refuses to clobber the live database with a non-database file. A file

latestDeepDive returns the most recent done security-deep-dive scan for the repo plus its parsed report JSON (if any).

latestDepsCommit returns the commit of the latest successful dependencies scan: the run that owns the current Dependency rows (parseDependenciesOutput

latestPatchScan returns the most recent done patch-skill scan for a finding along with its parsed report. Returns (nil, nil, nil) when no patch scan h

latestScanFindings loads the findings produced by one scan, for resolving sink dispositions. Inventory sink ids (S1, S2, …) are only unique within a s

loadReportFindings mirrors the repo page Findings tab: open deep-dive findings (closed lifecycles excluded, as the tab does), ordered Critical-first t

loadSkills loads local skill directories and, if a remote skills repo is configured, clones/pulls it at the requested ref and loads it too. Returns th

localRunnerImage reads the locally stored runner image's registry digest and build timestamp via `image inspect`. The RepoDigest is the manifest the i