codebase-onboarder 0.5.0 → 0.7.0

package/public/workbench.css

@@ -0,0 +1,166 @@
+/* Shared workbench tokens keep the paper palette with a quieter, clearer hierarchy. */
+:root { --shadow: 0 8px 24px rgba(42,39,33,.06); --shadow-sm: 0 3px 10px rgba(42,39,33,.08); --workbench-radius: 12px; }
+[data-theme="dark"] { --shadow: 0 8px 24px rgba(0,0,0,.18); --shadow-sm: 0 3px 10px rgba(0,0,0,.2); }
+.btn { font-family: var(--sans); font-weight: 550; border-width: 1px; border-radius: 7px; padding: 8px 13px; transition: background .15s, border-color .15s; }
+.btn:hover { transform: none; box-shadow: none; background: var(--paper-2); }
+.btn-ink { background: var(--accent); color: var(--card); border-color: var(--accent); }
+[data-theme="dark"] .btn-ink { color: var(--paper); }
+.btn-ink:hover { background: var(--ink); border-color: var(--ink); color: var(--paper); }
+.text-input { border: 1px solid var(--line); border-radius: 7px; padding: 11px 12px; }
+:where(button, a, input, select, summary):focus-visible { outline: 2px solid var(--accent); outline-offset: 3px; }
+.topbar { height: 104px; display: grid; grid-template-columns: minmax(160px,1fr) auto; grid-template-rows: 56px 48px; gap: 0 16px; overflow: visible; padding: 0 24px; border-color: var(--line); background: var(--card); }
+.topbar:has(.views[hidden]) { height: 64px; grid-template-rows: 64px; }
+.brand { grid-column: 1; grid-row: 1; }
+.brand-mark { font-size: 25px; letter-spacing: -.8px; }
+.brand-note { font-size: 11px; }
+.topbar-right { grid-column: 2; grid-row: 1; min-width: 0; gap: 4px; }
+.views { grid-column: 1 / -1; grid-row: 2; overflow-x: auto; align-items: stretch; min-width: 0; gap: 8px; scrollbar-width: thin; }
+.view-tab { font: 500 12px var(--sans); white-space: nowrap; border: 0; border-bottom: 3px solid transparent; border-radius: 0; background: transparent; color: var(--ink-2); padding: 12px 13px; }
+.view-tab:hover { background: var(--paper); }
+.view-tab.is-active { border-bottom-color: var(--accent); color: var(--accent); background: transparent; box-shadow: none; font-weight: 650; }
+.explorer { height: calc(100dvh - 104px); }
+.sidebar, .inspector, .stage-head { border-color: var(--line); }
+.landing { min-height: calc(100dvh - 64px); }
+.landing-inner { width: min(1060px, 92vw); margin-top: clamp(36px,7vh,80px); }
+.workbench-eyebrow { font: 600 10px var(--mono); letter-spacing: 1.5px; color: var(--ink-2); display: flex; align-items: center; gap: 9px; }
+.review-dot { width: 7px; height: 7px; background: var(--accent); border-radius: 50%; display: inline-block; flex-shrink: 0; }
+.landing-eyebrow { margin-bottom: 22px; }
+.landing-title { font-size: clamp(38px,5.2vw,64px); letter-spacing: -2px; line-height: 1.08; }
+.landing-title span { color: var(--accent); }
+.landing-sub { line-height: 1.7; max-width: 660px; margin-bottom: 32px; }
+.load-grid { gap: 18px; }
+.load-card { border: 1px solid var(--line); border-radius: var(--workbench-radius); padding: 23px; box-shadow: var(--shadow); gap: 12px; }
+.load-card-title { font: 600 15px var(--sans); }
+.load-card-note { color: var(--ink-2); line-height: 1.6; min-height: 38px; }
+.landing-capabilities { display: flex; flex-wrap: wrap; gap: 12px 24px; margin: 25px 0; color: var(--ink-2); font-size: 12px; }
+.landing-alt { margin: 24px 0; }
+.landing-about { border-color: var(--line); box-shadow: none; border-radius: var(--workbench-radius); margin-top: 32px; }
+.review-workspace { grid-template-columns: minmax(0,1fr); }
+.review-workspace > .sidebar, .review-workspace > .inspector, .review-workspace .stage-head, .review-workspace .stage-foot { display: none !important; }
+.review-workspace .stage { min-width: 0; }
+#reviewView { background: var(--paper); }
+.review-shell { max-width: 1400px; padding: 34px 40px 56px; margin: 0 auto; }
+.review-heading { display: flex; justify-content: space-between; align-items: center; gap: 20px; margin-bottom: 28px; }
+.review-heading h1 { font: 500 clamp(28px,3vw,38px) var(--serif); letter-spacing: -.9px; margin: 10px 0 8px; }
+.review-heading p { margin: 0; color: var(--ink-2); font-size: 13px; }
+.review-local-badge { color: var(--accent); background: var(--accent-soft); border-radius: 25px; font: 500 11px var(--sans); padding: 8px 12px; white-space: nowrap; }
+.review-controls { display: flex; flex-wrap: wrap; align-items: flex-end; gap: 14px; padding: 18px; background: var(--card); border: 1px solid var(--line); border-radius: var(--workbench-radius); }
+.review-controls label { display: flex; flex: 1 1 165px; flex-direction: column; gap: 7px; font: 600 11px var(--sans); color: var(--ink-2); }
+.review-controls input, .review-controls select, .review-filters select { width: 100%; min-width: 0; height: 38px; padding: 8px 10px; border: 1px solid var(--line); border-radius: 6px; font: 12px var(--sans); color: var(--ink); background: var(--card); }
+.review-controls .review-run { min-height: 38px; padding-inline: 22px; }
+.review-run span { margin-left: 12px; }
+.review-comparison-note { font-size: 11px; color: var(--ink-2); margin: 10px 3px 20px; }
+.review-feedback, .review-error { padding: 12px 16px; margin: 16px 0; font-size: 13px; border-radius: 8px; background: var(--accent-soft); color: var(--accent); }
+.review-error { color: var(--warn); background: var(--warn-soft); border: 1px solid var(--warn); }
+.review-welcome { margin-top: 36px; text-align: center; padding: 32px; border: 1px solid var(--line); background: var(--card); border-radius: var(--workbench-radius); }
+.review-welcome-icon { font: 26px var(--mono); color: var(--accent); width: 56px; height: 56px; margin: 0 auto 20px; border-radius: 15px; background: var(--accent-soft); display: grid; place-items: center; }
+.review-welcome h2 { font: 500 26px var(--serif); margin: 10px 0; }
+.review-welcome > p { font-size: 13px; color: var(--ink-2); max-width: 620px; margin: 0 auto; line-height: 1.7; }
+.review-preview-grid { display: grid; grid-template-columns: repeat(3,minmax(0,1fr)); text-align: left; gap: 32px; margin: 36px 0 24px; padding-top: 28px; border-top: 1px solid var(--line); }
+.review-preview-grid span { font: 11px var(--mono); color: var(--accent); }
+.review-preview-grid h3 { font: 600 14px var(--sans); }
+.review-preview-grid p { color: var(--ink-2); font-size: 12px; line-height: 1.7; }
+.review-welcome .review-scope { max-width: none; font-size: 11px; border-top: 1px solid var(--line); padding-top: 20px; }
+.review-summary { display: flex; justify-content: space-between; gap: 24px; align-items: center; margin: 28px 0 20px; }
+.review-status { display: inline-block; font-size: 11px; font-weight: 600; border-radius: 20px; padding: 5px 10px; background: var(--accent-soft); color: var(--accent); }
+.review-status.needs-review { background: var(--warn-soft); color: var(--warn); }
+.review-summary h2 { font: 500 19px var(--sans); line-height: 1.5; max-width: 780px; margin: 12px 0 6px; }
+.review-summary p { color: var(--ink-2); font: 11px var(--mono); }
+.review-export { display: flex; flex-shrink: 0; gap: 5px; }
+.review-metrics { display: grid; grid-template-columns: repeat(4,minmax(0,1fr)); gap: 16px; margin-bottom: 24px; }
+.review-metrics article { background: var(--card); padding: 20px; border: 1px solid var(--line); border-radius: var(--workbench-radius); }
+.review-metrics span { font-size: 12px; color: var(--ink-2); }
+.review-metrics strong { display: block; font: 500 32px var(--sans); margin: 8px 0; }
+.review-metrics em { font-size: 18px; font-style: normal; color: var(--faint); }
+.review-metrics small { font-size: 11px; color: var(--ink-2); }
+.review-add { color: var(--accent); font-weight: 500; }
+.review-del { color: var(--warn); font-weight: 500; }
+.review-columns { display: grid; grid-template-columns: minmax(0,1fr) 300px; gap: 20px; align-items: start; }
+.review-card { background: var(--card); border: 1px solid var(--line); padding: 22px; border-radius: var(--workbench-radius); min-width: 0; }
+.review-card h2 { font: 600 17px var(--sans); margin: 9px 0 18px; }
+.review-count { font: 11px var(--mono); border-radius: 6px; padding: 3px 6px; background: var(--paper-2); vertical-align: middle; }
+.review-filters { display: flex; flex-wrap: wrap; gap: 10px; align-items: center; margin-bottom: 20px; }
+.review-filters .text-input { flex: 1 1 160px; width: auto; font: 12px var(--sans); }
+.review-filters select { width: auto; }
+.review-notes-toggle, .review-ack { color: var(--ink-2); font-size: 11px; display: flex; align-items: center; gap: 6px; }
+.review-finding { padding: 20px 0; border-top: 1px solid var(--line); }
+.review-finding-meta { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; color: var(--ink-2); font: 10px var(--mono); }
+.review-severity, .review-risk { border-radius: 5px; padding: 4px 7px; font: 600 10px var(--sans); }
+.sev-critical { background: var(--sev-critical-bg); color: var(--sev-critical-ink); }
+.sev-high, .risk-high { background: var(--sev-high-bg); color: var(--sev-high-ink); }
+.sev-medium, .risk-medium { background: var(--sev-medium-bg); color: var(--sev-medium-ink); }
+.sev-low, .risk-low { background: var(--sev-low-bg); color: var(--sev-low-ink); }
+.sev-info { background: var(--sev-info-bg); color: var(--ink-2); }
+.review-location { margin-left: auto; overflow-wrap: anywhere; text-align: left; }
+.review-finding h3 { font: 600 14px var(--sans); margin: 13px 0; }
+.review-finding pre { font: 11px/1.6 var(--mono); padding: 12px; background: var(--paper); border-radius: 6px; white-space: pre-wrap; overflow-wrap: anywhere; }
+.review-suggestion { border-left: 2px solid var(--accent); padding: 4px 12px; margin: 16px 0; }
+.review-suggestion strong { color: var(--accent); font-size: 11px; }
+.review-suggestion p { font-size: 12px; line-height: 1.65; margin: 6px 0; }
+.review-finding.is-acknowledged { opacity: .7; }
+.review-aside { display: grid; gap: 18px; }
+.review-check { display: flex; align-items: flex-start; gap: 10px; margin-top: 18px; }
+.review-check-icon { display: grid; place-items: center; width: 21px; height: 21px; flex-shrink: 0; border-radius: 50%; font: 600 11px var(--sans); background: var(--paper-2); color: var(--ink-2); }
+.check-pass { background: var(--accent-soft); color: var(--accent); }
+.check-fail { background: var(--warn-soft); color: var(--warn); }
+.check-warn { background: var(--hub-soft); color: var(--hub); }
+.review-check strong { font-size: 12px; }
+.review-check p, .review-small { color: var(--ink-2); font-size: 11px; line-height: 1.65; margin: 5px 0; }
+.review-impact-file { display: block; text-align: left; font: 11px/1.7 var(--mono); overflow-wrap: anywhere; }
+.review-section-heading { display: flex; align-items: center; justify-content: space-between; gap: 20px; }
+.review-walkthrough, .review-ai { margin-top: 24px; }
+.review-table-wrap { overflow-x: auto; }
+.review-walkthrough table { width: 100%; border-collapse: collapse; text-align: left; font-size: 12px; }
+.review-walkthrough th { font: 500 10px var(--mono); color: var(--ink-2); border-bottom: 1px solid var(--line); padding: 12px 8px; }
+.review-walkthrough td { padding: 14px 8px; border-bottom: 1px solid var(--line); vertical-align: top; }
+.review-walkthrough td:first-child { min-width: 160px; max-width: 450px; overflow-wrap: anywhere; }
+.review-walkthrough td:nth-child(3) { white-space: nowrap; }
+.review-walkthrough small { display: block; color: var(--ink-2); font-size: 10px; margin-top: 5px; }
+.review-empty { text-align: center; padding: 36px 12px; color: var(--ink-2); }
+.review-empty > span { font-size: 27px; color: var(--accent); }
+.review-empty h3 { font-size: 14px; }
+.review-empty p { font-size: 12px; max-width: 400px; margin: auto; line-height: 1.7; }
+.review-ai-text { white-space: pre-wrap; font: 13px/1.7 var(--sans); margin-top: 15px; overflow-wrap: anywhere; }
+.review-limitations { padding: 22px 4px; color: var(--ink-2); font-size: 11px; line-height: 1.7; }
+.review-limitations summary { cursor: pointer; }
+@media (max-width: 1100px) { .brand-note, .me-links { display: none; } .review-shell { padding: 28px 24px; } .review-columns { grid-template-columns: minmax(0,1fr) 270px; } }
+@media (max-width: 900px) {
+ .topbar { height: 100px; grid-template-rows: 50px 50px; padding-inline: 12px; gap: 0 8px; grid-template-columns: minmax(0,1fr) minmax(0,auto); }
+ .topbar:has(.views[hidden]) { height: 56px; grid-template-rows: 56px; }
+ .topbar-right { max-width: min(64vw,500px); overflow-x: auto; }
+ .topbar-right > * { flex: none; }
+ .views { gap: 2px; }
+ .explorer { height: calc(100dvh - 100px); }
+ .landing { min-height: calc(100dvh - 56px); }
+ .review-shell { padding: 24px 18px 40px; }
+ .review-heading { align-items: flex-start; }
+ .review-local-badge { font-size: 10px; }
+ .review-columns { grid-template-columns: minmax(0,1fr); }
+ .review-aside { grid-template-columns: repeat(2,minmax(0,1fr)); }
+ .review-summary { align-items: flex-start; }
+ .review-metrics { gap: 10px; }
+ .review-metrics article { padding: 16px; }
+}
+@media (max-width: 600px) {
+ .landing-title { letter-spacing: -1px; }
+ .landing-capabilities { font-size: 11px; gap: 12px 18px; }
+ .review-heading { flex-direction: column; gap: 12px; margin-bottom: 20px; }
+ .review-controls { padding: 14px; gap: 12px; }
+ .review-controls label { flex-basis: 100%; }
+ .review-controls .review-run { flex: 1; }
+ .review-preview-grid, .review-aside { grid-template-columns: minmax(0,1fr); gap: 16px; }
+ .review-welcome { padding: 22px; margin-top: 24px; }
+ .review-welcome h2 { font-size: 24px; }
+ .review-preview-grid { margin-top: 26px; }
+ .review-metrics { grid-template-columns: repeat(2,minmax(0,1fr)); }
+ .review-summary, .review-section-heading { flex-direction: column; align-items: flex-start; gap: 8px; }
+ .review-card { padding: 18px; }
+ .review-filters .text-input { flex-basis: 100%; }
+ .review-location { margin-left: 0; width: 100%; }
+ .review-filters select { min-height: 40px; }
+ .review-ack input, .review-notes-toggle input { width: 18px; height: 18px; flex-shrink: 0; }
+ .review-export .btn { min-height: 40px; }
+ .review-shell { padding-inline: 14px; }
+}
+@media (prefers-reduced-motion: reduce) { .btn { transition: none; } }
+.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }

package/server/apiAuth.d.ts

@@ -0,0 +1,3 @@
+export declare function handleAuthStatus(req: any, res: any, settings: any): void;
+export declare function handleLogin(req: any, res: any, body: any, settings: any): void;
+export declare function handleLogout(req: any, res: any): void;

package/server/apiAuth.js

@@ -1,32 +1,30 @@
 // The access-key form. Kept tiny and independent from the main app: an
 // unauthenticated visitor must be able to load this page without loading any
 // analyzer, settings drawer, or other application surface.
-
 import { accessKeysMatch, authReason } from './config.js';
 import { hasValidSession, sessionCookie } from './auth.js';
 import { sendError, sendJSON } from './http.js';
-
 export function handleAuthStatus(req, res, settings) {
-  sendJSON(res, 200, {
-    authenticated: !authReason(req, settings) || hasValidSession(req, settings),
-    configured: Boolean(settings.accessKey),
-  });
+    sendJSON(res, 200, {
+        authenticated: !authReason(req, settings) || hasValidSession(req, settings),
+        configured: Boolean(settings.accessKey),
+    });
 }
-
 export function handleLogin(req, res, body, settings) {
-  if (!settings.accessKey) return sendError(res, 503, 'This server has no access key configured. Run `onboarder setup` on the server.');
-  if (!accessKeysMatch(settings.accessKey, body?.accessKey)) {
-    return sendError(res, 401, 'That access key is not correct.');
-  }
-  sendJSON(res, 200, { ok: true }, {
-    'cache-control': 'no-store',
-    'set-cookie': sessionCookie(req, settings),
-  });
+    if (!settings.accessKey)
+        return sendError(res, 503, 'This server has no access key configured. Run `onboarder setup` on the server.');
+    if (!accessKeysMatch(settings.accessKey, body?.accessKey)) {
+        return sendError(res, 401, 'That access key is not correct.');
+    }
+    sendJSON(res, 200, { ok: true }, {
+        'cache-control': 'no-store',
+        'set-cookie': sessionCookie(req, settings),
+    });
 }
-
 export function handleLogout(req, res) {
-  sendJSON(res, 200, { ok: true }, {
-    'cache-control': 'no-store',
-    'set-cookie': sessionCookie(req, {}, { clear: true }),
-  });
+    sendJSON(res, 200, { ok: true }, {
+        'cache-control': 'no-store',
+        'set-cookie': sessionCookie(req, {}, { clear: true }),
+    });
 }
+//# sourceMappingURL=apiAuth.js.map

package/server/apiAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiAuth.js","sourceRoot":"","sources":["../src/server/apiAuth.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,6EAA6E;AAC7E,2DAA2D;AAE3D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEhD,MAAM,UAAU,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ;IACjD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACjB,aAAa,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC3E,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ;IAClD,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,gFAAgF,CAAC,CAAC;IACtI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAChE,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;QAC/B,eAAe,EAAE,UAAU;QAC3B,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAG,EAAE,GAAG;IACnC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;QAC/B,eAAe,EAAE,UAAU;QAC3B,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC","sourcesContent":["// The access-key form. Kept tiny and independent from the main app: an\n// unauthenticated visitor must be able to load this page without loading any\n// analyzer, settings drawer, or other application surface.\n\nimport { accessKeysMatch, authReason } from './config.js';\nimport { hasValidSession, sessionCookie } from './auth.js';\nimport { sendError, sendJSON } from './http.js';\n\nexport function handleAuthStatus(req, res, settings) {\n  sendJSON(res, 200, {\n    authenticated: !authReason(req, settings) || hasValidSession(req, settings),\n    configured: Boolean(settings.accessKey),\n  });\n}\n\nexport function handleLogin(req, res, body, settings) {\n  if (!settings.accessKey) return sendError(res, 503, 'This server has no access key configured. Run `onboarder setup` on the server.');\n  if (!accessKeysMatch(settings.accessKey, body?.accessKey)) {\n    return sendError(res, 401, 'That access key is not correct.');\n  }\n  sendJSON(res, 200, { ok: true }, {\n    'cache-control': 'no-store',\n    'set-cookie': sessionCookie(req, settings),\n  });\n}\n\nexport function handleLogout(req, res) {\n  sendJSON(res, 200, { ok: true }, {\n    'cache-control': 'no-store',\n    'set-cookie': sessionCookie(req, {}, { clear: true }),\n  });\n}\n"]}

package/server/apiDiff.d.ts

@@ -0,0 +1,2 @@
+export declare function handleDiffRefs(res: any, scanId: any): Promise<void>;
+export declare function handleDiff(res: any, scanId: any, queryParams?: Record<string, any>): Promise<void>;

package/server/apiDiff.js

@@ -1,25 +1,27 @@
 // GET /api/diff and GET /api/diff/refs — Git diff and branch endpoints.
-
-import { getGitDiff, getGitRefs } from './gitDiff.js';
+import { getGitDiff, getGitRefs, GitDiffError } from './gitDiff.js';
 import { sendError, sendJSON } from './http.js';
 import { getSession } from './sessions.js';
-
 export async function handleDiffRefs(res, scanId) {
-  const session = getSession(scanId);
-  if (!session) return sendError(res, 404, 'Scan session not found.');
-
-  const refs = await getGitRefs(session.root);
-  sendJSON(res, 200, refs);
+    const session = getSession(scanId);
+    if (!session)
+        return sendError(res, 404, 'Scan session not found.');
+    const refs = await getGitRefs(session.root);
+    sendJSON(res, 200, refs);
 }
-
 export async function handleDiff(res, scanId, queryParams = {}) {
-  const session = getSession(scanId);
-  if (!session) return sendError(res, 404, 'Scan session not found.');
-
-  const base = queryParams.get('base') || '';
-  const head = queryParams.get('head') || '';
-  const file = queryParams.get('file') || '';
-
-  const diff = await getGitDiff(session.root, { base, head, file });
-  sendJSON(res, 200, diff);
+    const session = getSession(scanId);
+    if (!session)
+        return sendError(res, 404, 'Scan session not found.');
+    const base = queryParams.get('base') || '';
+    const head = queryParams.get('head') || '';
+    const file = queryParams.get('file') || '';
+    try {
+        const diff = await getGitDiff(session.root, { base, head, file });
+        sendJSON(res, 200, diff);
+    }
+    catch (error) {
+        sendError(res, error instanceof GitDiffError ? error.status : 500, error instanceof Error ? error.message : 'Comparison failed.');
+    }
 }
+//# sourceMappingURL=apiDiff.js.map

package/server/apiDiff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiDiff.js","sourceRoot":"","sources":["../src/server/apiDiff.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAG,EAAE,MAAM;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAEpE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,GAAwB,EAAE;IACjF,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAEpE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,GAAG,EAAE,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;IACpI,CAAC;AACH,CAAC","sourcesContent":["// GET /api/diff and GET /api/diff/refs — Git diff and branch endpoints.\n\nimport { getGitDiff, getGitRefs, GitDiffError } from './gitDiff.js';\nimport { sendError, sendJSON } from './http.js';\nimport { getSession } from './sessions.js';\n\nexport async function handleDiffRefs(res, scanId) {\n  const session = getSession(scanId);\n  if (!session) return sendError(res, 404, 'Scan session not found.');\n\n  const refs = await getGitRefs(session.root);\n  sendJSON(res, 200, refs);\n}\n\nexport async function handleDiff(res, scanId, queryParams: Record<string, any> = {}) {\n  const session = getSession(scanId);\n  if (!session) return sendError(res, 404, 'Scan session not found.');\n\n  const base = queryParams.get('base') || '';\n  const head = queryParams.get('head') || '';\n  const file = queryParams.get('file') || '';\n\n  try {\n    const diff = await getGitDiff(session.root, { base, head, file });\n    sendJSON(res, 200, diff);\n  } catch (error) {\n    sendError(res, error instanceof GitDiffError ? error.status : 500, error instanceof Error ? error.message : 'Comparison failed.');\n  }\n}\n"]}

package/server/apiDocs.d.ts

@@ -0,0 +1,2 @@
+export declare function isAllowedDocHost(hostname: any): boolean;
+export declare function handleDocs(res: any, body: any, fetchImpl?: typeof fetch): Promise<void>;

package/server/apiDocs.js

@@ -10,20 +10,16 @@
 // means the set of fetchable hosts is exactly the set of hosts a scanned
 // dependency can point at. Nothing else is reachable: no private addresses, no
 // loopback, no arbitrary sites, and no host that drifted into a hand-kept list.
-
 import { DOC_HOSTS } from '../shared/analyzer/stack.js';
 import { htmlToText } from './htmlText.js';
 import { sendError, sendJSON } from './http.js';
-
 const FETCH_TIMEOUT_MS = 12_000;
-
 export function isAllowedDocHost(hostname) {
-  const host = String(hostname).replace(/^www\./, '').toLowerCase();
-  // Subdomains of an allowed host are allowed — docs sites move between
-  // `example.com` and `docs.example.com` and the allowlist names one of them.
-  return DOC_HOSTS.some((allowed) => host === allowed || host.endsWith('.' + allowed));
+    const host = String(hostname).replace(/^www\./, '').toLowerCase();
+    // Subdomains of an allowed host are allowed — docs sites move between
+    // `example.com` and `docs.example.com` and the allowlist names one of them.
+    return DOC_HOSTS.some((allowed) => host === allowed || host.endsWith('.' + allowed));
 }
-
 // A failure here is not fatal to the caller: `about.js` falls back to summarising
 // the library from the model's own knowledge when no text comes back. That is
 // what makes it safe to refuse in the ambiguous cases below rather than guess.
@@ -31,37 +27,39 @@ export function isAllowedDocHost(hostname) {
 // `fetchImpl` is injectable so the redirect check can be tested without a
 // docs site that redirects.
 export async function handleDocs(res, body, fetchImpl = fetch) {
-  if (!body || typeof body.url !== 'string') return sendError(res, 400, 'Bad url.');
-
-  let url;
-  try {
-    url = new URL(body.url);
-  } catch {
-    return sendError(res, 400, 'Bad url.');
-  }
-
-  if (url.protocol !== 'https:') return sendError(res, 400, 'Only https docs are fetched.');
-  if (!isAllowedDocHost(url.hostname)) {
-    return sendError(res, 403, 'That is not an allowed docs site.');
-  }
-
-  try {
-    const response = await fetchImpl(url.toString(), {
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      // Redirects are followed because docs sites are full of them, and checked
-      // again on the way out. An allowlisted host with an open redirect would
-      // otherwise be a way through this guard to anywhere — including the
-      // link-local metadata address that is the reason the guard exists.
-      redirect: 'follow',
-      headers: { 'user-agent': 'onboarder/1.0' },
-    });
-    const landed = new URL(response.url || url.toString());
-    if (!isAllowedDocHost(landed.hostname)) {
-      return sendError(res, 403, 'That page redirected somewhere we do not fetch from.');
+    if (!body || typeof body.url !== 'string')
+        return sendError(res, 400, 'Bad url.');
+    let url;
+    try {
+        url = new URL(body.url);
+    }
+    catch {
+        return sendError(res, 400, 'Bad url.');
+    }
+    if (url.protocol !== 'https:')
+        return sendError(res, 400, 'Only https docs are fetched.');
+    if (!isAllowedDocHost(url.hostname)) {
+        return sendError(res, 403, 'That is not an allowed docs site.');
+    }
+    try {
+        const response = await fetchImpl(url.toString(), {
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            // Redirects are followed because docs sites are full of them, and checked
+            // again on the way out. An allowlisted host with an open redirect would
+            // otherwise be a way through this guard to anywhere — including the
+            // link-local metadata address that is the reason the guard exists.
+            redirect: 'follow',
+            headers: { 'user-agent': 'onboarder/1.0' },
+        });
+        const landed = new URL(response.url || url.toString());
+        if (!isAllowedDocHost(landed.hostname)) {
+            return sendError(res, 403, 'That page redirected somewhere we do not fetch from.');
+        }
+        const { title, text } = htmlToText(await response.text());
+        sendJSON(res, 200, { url: landed.toString(), title, text, status: response.status });
+    }
+    catch (err) {
+        sendError(res, 502, 'Could not fetch: ' + err.message);
     }
-    const { title, text } = htmlToText(await response.text());
-    sendJSON(res, 200, { url: landed.toString(), title, text, status: response.status });
-  } catch (err) {
-    sendError(res, 502, 'Could not fetch: ' + err.message);
-  }
 }
+//# sourceMappingURL=apiDocs.js.map

package/server/apiDocs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiDocs.js","sourceRoot":"","sources":["../src/server/apiDocs.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,0CAA0C;AAC1C,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAEhF,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEhD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,UAAU,gBAAgB,CAAC,QAAQ;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,sEAAsE;IACtE,4EAA4E;IAC5E,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,kFAAkF;AAClF,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,0EAA0E;AAC1E,4BAA4B;AAC5B,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,GAAG,KAAK;IAC3D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAElF,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAC1F,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,mCAAmC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC7C,0EAA0E;YAC1E,wEAAwE;YACxE,oEAAoE;YACpE,mEAAmE;YACnE,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,EAAE,YAAY,EAAE,eAAe,EAAE;SAC3C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,sDAAsD,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;AACH,CAAC","sourcesContent":["// POST /api/doc — fetch a library's official documentation page as text.\n//\n// This exists because the browser cannot: docs sites do not send CORS headers,\n// so the page has no way to read them. That makes this endpoint a fetcher acting\n// on behalf of whoever can reach it, which is the definition of an SSRF hazard,\n// and the reason for the two gates below.\n//\n// https only, and a host allowlist. The allowlist is not written here — it is\n// derived from the docs URLs `shared/analyzer/stack.js` already knows, which\n// means the set of fetchable hosts is exactly the set of hosts a scanned\n// dependency can point at. Nothing else is reachable: no private addresses, no\n// loopback, no arbitrary sites, and no host that drifted into a hand-kept list.\n\nimport { DOC_HOSTS } from '../shared/analyzer/stack.js';\nimport { htmlToText } from './htmlText.js';\nimport { sendError, sendJSON } from './http.js';\n\nconst FETCH_TIMEOUT_MS = 12_000;\n\nexport function isAllowedDocHost(hostname) {\n  const host = String(hostname).replace(/^www\\./, '').toLowerCase();\n  // Subdomains of an allowed host are allowed — docs sites move between\n  // `example.com` and `docs.example.com` and the allowlist names one of them.\n  return DOC_HOSTS.some((allowed) => host === allowed || host.endsWith('.' + allowed));\n}\n\n// A failure here is not fatal to the caller: `about.js` falls back to summarising\n// the library from the model's own knowledge when no text comes back. That is\n// what makes it safe to refuse in the ambiguous cases below rather than guess.\n//\n// `fetchImpl` is injectable so the redirect check can be tested without a\n// docs site that redirects.\nexport async function handleDocs(res, body, fetchImpl = fetch) {\n  if (!body || typeof body.url !== 'string') return sendError(res, 400, 'Bad url.');\n\n  let url;\n  try {\n    url = new URL(body.url);\n  } catch {\n    return sendError(res, 400, 'Bad url.');\n  }\n\n  if (url.protocol !== 'https:') return sendError(res, 400, 'Only https docs are fetched.');\n  if (!isAllowedDocHost(url.hostname)) {\n    return sendError(res, 403, 'That is not an allowed docs site.');\n  }\n\n  try {\n    const response = await fetchImpl(url.toString(), {\n      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),\n      // Redirects are followed because docs sites are full of them, and checked\n      // again on the way out. An allowlisted host with an open redirect would\n      // otherwise be a way through this guard to anywhere — including the\n      // link-local metadata address that is the reason the guard exists.\n      redirect: 'follow',\n      headers: { 'user-agent': 'onboarder/1.0' },\n    });\n    const landed = new URL(response.url || url.toString());\n    if (!isAllowedDocHost(landed.hostname)) {\n      return sendError(res, 403, 'That page redirected somewhere we do not fetch from.');\n    }\n    const { title, text } = htmlToText(await response.text());\n    sendJSON(res, 200, { url: landed.toString(), title, text, status: response.status });\n  } catch (err) {\n    sendError(res, 502, 'Could not fetch: ' + err.message);\n  }\n}\n"]}

package/server/apiFile.d.ts

@@ -0,0 +1 @@
+export declare function handleFile(res: any, scanId: any, relPath: any): Promise<void>;

package/server/apiFile.js

@@ -8,29 +8,26 @@
 // enough that reading it is not itself the problem. The router adds a fourth —
 // it is the single GET that the cross-origin check applies to, because a page on
 // another site could otherwise read files through the browser.
-
 import { promises as fs } from 'node:fs';
-
 import { sendError, sendText } from './http.js';
 import { resolveInside } from './paths.js';
 import { getSession } from './sessions.js';
-
 // Code, not assets. Past this the viewer would choke anyway, and a 200 MB
 // checked-in binary should not be buffered into a response to find that out.
 const MAX_FILE_BYTES = 200 * 1024;
-
 export async function handleFile(res, scanId, relPath) {
-  const session = getSession(scanId);
-  if (!session) return sendError(res, 404, 'That scan is gone. Rescan the repo.');
-
-  const abs = resolveInside(session.root, relPath);
-  if (!abs) return sendError(res, 400, 'Bad path.');
-
-  const stat = await fs.stat(abs).catch(() => null);
-  if (!stat?.isFile()) return sendError(res, 404, 'No such file in the repo.');
-  if (stat.size > MAX_FILE_BYTES) {
-    return sendError(res, 413, 'That file is too large to send around.');
-  }
-
-  sendText(res, 200, await fs.readFile(abs, 'utf8'));
+    const session = getSession(scanId);
+    if (!session)
+        return sendError(res, 404, 'That scan is gone. Rescan the repo.');
+    const abs = resolveInside(session.root, relPath);
+    if (!abs)
+        return sendError(res, 400, 'Bad path.');
+    const stat = await fs.stat(abs).catch(() => null);
+    if (!stat?.isFile())
+        return sendError(res, 404, 'No such file in the repo.');
+    if (stat.size > MAX_FILE_BYTES) {
+        return sendError(res, 413, 'That file is too large to send around.');
+    }
+    sendText(res, 200, await fs.readFile(abs, 'utf8'));
 }
+//# sourceMappingURL=apiFile.js.map

package/server/apiFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiFile.js","sourceRoot":"","sources":["../src/server/apiFile.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,0BAA0B;AAC1B,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,+DAA+D;AAE/D,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,0EAA0E;AAC1E,6EAA6E;AAC7E,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAElC,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;IAEhF,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAElD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,wCAAwC,CAAC,CAAC;IACvE,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC","sourcesContent":["// GET /api/file?scan=…&path=… — one file's text, for the code viewer and for the\n// AI explainer's context.\n//\n// This is the only endpoint that returns the contents of something on the\n// person's disk, which makes it the one worth being strict at. Three gates, and\n// none of them is authentication: the scan id has to name a live session, the\n// path has to resolve inside that session's root, and the file has to be small\n// enough that reading it is not itself the problem. The router adds a fourth —\n// it is the single GET that the cross-origin check applies to, because a page on\n// another site could otherwise read files through the browser.\n\nimport { promises as fs } from 'node:fs';\n\nimport { sendError, sendText } from './http.js';\nimport { resolveInside } from './paths.js';\nimport { getSession } from './sessions.js';\n\n// Code, not assets. Past this the viewer would choke anyway, and a 200 MB\n// checked-in binary should not be buffered into a response to find that out.\nconst MAX_FILE_BYTES = 200 * 1024;\n\nexport async function handleFile(res, scanId, relPath) {\n  const session = getSession(scanId);\n  if (!session) return sendError(res, 404, 'That scan is gone. Rescan the repo.');\n\n  const abs = resolveInside(session.root, relPath);\n  if (!abs) return sendError(res, 400, 'Bad path.');\n\n  const stat = await fs.stat(abs).catch(() => null);\n  if (!stat?.isFile()) return sendError(res, 404, 'No such file in the repo.');\n  if (stat.size > MAX_FILE_BYTES) {\n    return sendError(res, 413, 'That file is too large to send around.');\n  }\n\n  sendText(res, 200, await fs.readFile(abs, 'utf8'));\n}\n"]}

package/server/apiGitBlame.d.ts

@@ -0,0 +1,2 @@
+export declare function parsePorcelainBlame(stdout: any): any[];
+export declare function handleBlame(res: any, scanId: any, filePath: any): Promise<void>;

package/server/apiGitBlame.js

@@ -4,60 +4,59 @@ import { resolveInside } from './paths.js';
 import { getSession } from './sessions.js';
 import { sendError, sendJSON } from './http.js';
 import { promises as fs } from 'node:fs';
-
 const execAsync = promisify(execFile);
-
 export function parsePorcelainBlame(stdout) {
-  const lines = [];
-  const linesArr = stdout.split('\n');
-  let currentCommit = {};
-  let currentLine = null;
-  const commits = new Map();
-
-  for (let i = 0; i < linesArr.length; i++) {
-    const line = linesArr[i];
-    if (!line) continue;
-
-    if (/^[0-9a-f]{40} \d+ \d+/.test(line)) {
-      const parts = line.split(' ');
-      const sha = parts[0];
-      const lineNo = parseInt(parts[2], 10);
-      
-      currentLine = { lineNo, sha, content: '' };
-      
-      if (!commits.has(sha)) {
-        commits.set(sha, { sha });
-      }
-      currentCommit = commits.get(sha);
-    } else if (line.startsWith('author ')) {
-      currentCommit.author = line.slice(7);
-    } else if (line.startsWith('author-time ')) {
-      currentCommit.date = new Date(parseInt(line.slice(12), 10) * 1000).toISOString();
-    } else if (line.startsWith('\t')) {
-      if (currentLine) {
-        currentLine.content = line.slice(1);
-        currentLine.author = currentCommit.author || 'Unknown';
-        currentLine.date = currentCommit.date || '';
-        lines.push(currentLine);
-        currentLine = null;
-      }
+    const lines = [];
+    const linesArr = stdout.split('\n');
+    let currentCommit = {};
+    let currentLine = null;
+    const commits = new Map();
+    for (let i = 0; i < linesArr.length; i++) {
+        const line = linesArr[i];
+        if (!line)
+            continue;
+        if (/^[0-9a-f]{40} \d+ \d+/.test(line)) {
+            const parts = line.split(' ');
+            const sha = parts[0];
+            const lineNo = parseInt(parts[2], 10);
+            currentLine = { lineNo, sha, content: '' };
+            if (!commits.has(sha)) {
+                commits.set(sha, { sha });
+            }
+            currentCommit = commits.get(sha);
+        }
+        else if (line.startsWith('author ')) {
+            currentCommit.author = line.slice(7);
+        }
+        else if (line.startsWith('author-time ')) {
+            currentCommit.date = new Date(parseInt(line.slice(12), 10) * 1000).toISOString();
+        }
+        else if (line.startsWith('\t')) {
+            if (currentLine) {
+                currentLine.content = line.slice(1);
+                currentLine.author = currentCommit.author || 'Unknown';
+                currentLine.date = currentCommit.date || '';
+                lines.push(currentLine);
+                currentLine = null;
+            }
+        }
     }
-  }
-  return lines;
+    return lines;
 }
-
 export async function handleBlame(res, scanId, filePath) {
-  const session = getSession(scanId);
-  if (!session) return sendError(res, 404, 'Scan not found.');
-
-  const absPath = resolveInside(session.root, filePath);
-  if (!absPath) return sendError(res, 400, 'Bad path.');
-
-  try {
-    const { stdout } = await execAsync('git', ['blame', '--porcelain', absPath], { cwd: session.root });
-    const lines = parsePorcelainBlame(stdout);
-    return sendJSON(res, 200, { lines });
-  } catch (err) {
-    return sendJSON(res, 200, { available: false, reason: 'Git blame failed or not a git repository.' });
-  }
+    const session = getSession(scanId);
+    if (!session)
+        return sendError(res, 404, 'Scan not found.');
+    const absPath = resolveInside(session.root, filePath);
+    if (!absPath)
+        return sendError(res, 400, 'Bad path.');
+    try {
+        const { stdout } = await execAsync('git', ['blame', '--porcelain', absPath], { cwd: session.root });
+        const lines = parsePorcelainBlame(stdout);
+        return sendJSON(res, 200, { lines });
+    }
+    catch (err) {
+        return sendJSON(res, 200, { available: false, reason: 'Git blame failed or not a git repository.' });
+    }
 }
+//# sourceMappingURL=apiGitBlame.js.map

package/server/apiGitBlame.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiGitBlame.js","sourceRoot":"","sources":["../src/server/apiGitBlame.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEtC,MAAM,UAAU,mBAAmB,CAAC,MAAM;IACxC,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,aAAa,GAAwB,EAAE,CAAC;IAC5C,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;IAE1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAEtC,WAAW,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAE3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,aAAa,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnF,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpC,WAAW,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,SAAS,CAAC;gBACvD,WAAW,CAAC,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACxB,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ;IACrD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC","sourcesContent":["import { execFile } from 'node:child_process';\nimport { promisify } from 'node:util';\nimport { resolveInside } from './paths.js';\nimport { getSession } from './sessions.js';\nimport { sendError, sendJSON } from './http.js';\nimport { promises as fs } from 'node:fs';\n\nconst execAsync = promisify(execFile);\n\nexport function parsePorcelainBlame(stdout) {\n  const lines = [];\n  const linesArr = stdout.split('\\n');\n  let currentCommit: Record<string, any> = {};\n  let currentLine = null;\n  const commits = new Map();\n\n  for (let i = 0; i < linesArr.length; i++) {\n    const line = linesArr[i];\n    if (!line) continue;\n\n    if (/^[0-9a-f]{40} \\d+ \\d+/.test(line)) {\n      const parts = line.split(' ');\n      const sha = parts[0];\n      const lineNo = parseInt(parts[2], 10);\n      \n      currentLine = { lineNo, sha, content: '' };\n      \n      if (!commits.has(sha)) {\n        commits.set(sha, { sha });\n      }\n      currentCommit = commits.get(sha);\n    } else if (line.startsWith('author ')) {\n      currentCommit.author = line.slice(7);\n    } else if (line.startsWith('author-time ')) {\n      currentCommit.date = new Date(parseInt(line.slice(12), 10) * 1000).toISOString();\n    } else if (line.startsWith('\\t')) {\n      if (currentLine) {\n        currentLine.content = line.slice(1);\n        currentLine.author = currentCommit.author || 'Unknown';\n        currentLine.date = currentCommit.date || '';\n        lines.push(currentLine);\n        currentLine = null;\n      }\n    }\n  }\n  return lines;\n}\n\nexport async function handleBlame(res, scanId, filePath) {\n  const session = getSession(scanId);\n  if (!session) return sendError(res, 404, 'Scan not found.');\n\n  const absPath = resolveInside(session.root, filePath);\n  if (!absPath) return sendError(res, 400, 'Bad path.');\n\n  try {\n    const { stdout } = await execAsync('git', ['blame', '--porcelain', absPath], { cwd: session.root });\n    const lines = parsePorcelainBlame(stdout);\n    return sendJSON(res, 200, { lines });\n  } catch (err) {\n    return sendJSON(res, 200, { available: false, reason: 'Git blame failed or not a git repository.' });\n  }\n}\n"]}

package/server/apiMcp.d.ts

@@ -0,0 +1,4 @@
+export declare function handleMcpStatus(req: any, res: any, config: any): void;
+export declare function handleMcpStart(req: any, res: any, config: any): Promise<void>;
+export declare function handleMcpStop(req: any, res: any, config: any): Promise<void>;
+export declare function handleMcpCommand(req: any, res: any, config: any): void;