Function executeScan

src/codeScan/scanner/index.ts:87–409

(repoPath: string, options: ScanOptions)

 * @param options - Scan options from CLI
 */
export async function executeScan(repoPath: string, options: ScanOptions): Promise<void> {
  let client: AgentClient | null = null;
  let mcpProcess: ChildProcess | null = null;
  let mcpBridge: SocketIoMcpBridge | null = null;
  let sessionId: string | undefined = undefined;
  const originalLogLevel = getLogLevel();
  const structuredOutputRequested =
    options.json === true ||
    options.format === CodeScanOutputFormat.JSON ||
    options.format === CodeScanOutputFormat.SARIF;
  const absoluteRepoPath = path.resolve(repoPath);
  const cleanupRefs: CleanupRefs = {
    repoPath: absoluteRepoPath,
    socket: null,
    mcpBridge: null,
    mcpProcess: null,
    spinner: null,
    abortController: null,
  };
  let outputFormat: CodeScanOutputFormat | null = null;
  let spinner: ReturnType<typeof createSpinner> | undefined;
  let showSpinner = false;

  const startTime = Date.now();

  try {
    outputFormat = resolveOutputFormat(options);
    // Structured modes reserve stdout for the payload. src/entrypoint.ts already pre-sets
    // LOG_LEVEL=error before the logger module is imported (so any module-init logs are
    // already suppressed); we re-apply here for callers that bypass the CLI entrypoint
    // (e.g., library consumers calling executeScan directly).
    if (outputFormat !== CodeScanOutputFormat.TEXT) {
      setLogLevel('error');
    }

    // Load and merge configuration
    const baseConfig: Config = loadConfigOrDefault(options.config);
    const config = mergeConfigWithOptions(baseConfig, options);

    // Resolve guidance (CLI options take precedence)
    const guidance = resolveGuidance(options, config);

    // Display startup messages (skipped for non-text formats to keep stdout clean for parsing)
    if (outputFormat === CodeScanOutputFormat.TEXT) {
      logger.info('Beginning scan for LLM-related vulnerabilities in your code.');
      logger.info(`  Minimum severity: ${config.minimumSeverity}`);
      if (config.diffsOnly) {
        logger.info(`  Mode: diffs only`);
      } else {
        logger.info(`  Mode: diffs + tracing into repo`);
      }
      logger.info('');
    }

    logger.debug(`Repository: ${absoluteRepoPath}`);

    // Register cleanup handlers for signals (SIGINT, SIGTERM, etc.)
    registerCleanupHandlers(cleanupRefs);