codebase-onboarder 0.5.0 → 0.7.0

package/server/apiMcp.js

@@ -14,10 +14,8 @@
 // The GET is guarded too: the status includes the command line an agent is
 // configured with, which a foreign page has no business having even though it is
 // not a secret.
-
 import { sendJSON } from './http.js';
 import { mcpCommand, mcpEntryPoint } from './mcp/runner.js';
-
 // Every handler here has the same shape: work out the answer, then let whoever is
 // driving decide how it gets sent. That split exists so `config.handleMcp` — a test
 // double, or an embedding that supervises MCP itself — can observe the real result
@@ -27,84 +25,84 @@ import { mcpCommand, mcpEntryPoint } from './mcp/runner.js';
 // The hook owns the response when present. `server/index.js` supplies none, so the
 // ordinary path is exactly what it was.
 function reply(res, config, method, req, result) {
-  if (typeof config?.handleMcp === 'function') {
-    config.handleMcp(method, req, res, result);
-    return;
-  }
-  sendJSON(res, result.status, result.body);
+    if (typeof config?.handleMcp === 'function') {
+        config.handleMcp(method, req, res, result);
+        return;
+    }
+    sendJSON(res, result.status, result.body);
 }
-
 // The runner, however the caller named it. `mcp` is what `server/index.js` sets;
 // `runner` is accepted because that is the obvious name and a test reaching for it
 // should not have to read the index to find the convention.
 function runnerFor(config) {
-  return config?.mcp || config?.runner || null;
+    return config?.mcp || config?.runner || null;
 }
-
 export function handleMcpStatus(req, res, config) {
-  const runner = runnerFor(config);
-  if (!runner) {
-    // The app is running without the control surface (a test, or an embedding
-    // that drives MCP itself). Say so rather than pretending it is stopped.
-    return reply(res, config, 'GET /api/mcp', req, {
-      status: 200,
-      body: {
-        running: false,
-        state: 'unavailable',
-        reason: 'MCP supervision is not enabled in this process.',
-        tools: [],
-      },
-    });
-  }
-  reply(res, config, 'GET /api/mcp', req, { status: 200, body: runner.status() });
+    const runner = runnerFor(config);
+    if (!runner) {
+        // The app is running without the control surface (a test, or an embedding
+        // that drives MCP itself). Say so rather than pretending it is stopped.
+        return reply(res, config, 'GET /api/mcp', req, {
+            status: 200,
+            body: {
+                running: false,
+                state: 'unavailable',
+                reason: 'MCP supervision is not enabled in this process.',
+                tools: [],
+            },
+        });
+    }
+    reply(res, config, 'GET /api/mcp', req, { status: 200, body: runner.status() });
 }
-
 export async function handleMcpStart(req, res, config) {
-  const runner = runnerFor(config);
-  if (!runner) return reply(res, config, 'POST /api/mcp/start', req, { status: 501, body: { error: 'MCP supervision is not enabled in this process.' } });
-  try {
-    const status = await runner.start();
-    reply(res, config, 'POST /api/mcp/start', req, { status: 200, body: status });
-  } catch (err) {
-    // A start that cannot happen is usually a missing Node, a bad path, or a
-    // child that failed its handshake — the message says which, because the
-    // person clicking the button can only fix one of those three.
-    reply(res, config, 'POST /api/mcp/start', req, { status: 500, body: { error: err.message || 'The MCP server could not be started.' } });
-  }
+    const runner = runnerFor(config);
+    if (!runner)
+        return reply(res, config, 'POST /api/mcp/start', req, { status: 501, body: { error: 'MCP supervision is not enabled in this process.' } });
+    try {
+        const status = await runner.start();
+        reply(res, config, 'POST /api/mcp/start', req, { status: 200, body: status });
+    }
+    catch (err) {
+        // A start that cannot happen is usually a missing Node, a bad path, or a
+        // child that failed its handshake — the message says which, because the
+        // person clicking the button can only fix one of those three.
+        reply(res, config, 'POST /api/mcp/start', req, { status: 500, body: { error: err.message || 'The MCP server could not be started.' } });
+    }
 }
-
 export async function handleMcpStop(req, res, config) {
-  const runner = runnerFor(config);
-  if (!runner) return reply(res, config, 'POST /api/mcp/stop', req, { status: 501, body: { error: 'MCP supervision is not enabled in this process.' } });
-  try {
-    const status = await runner.stop();
-    reply(res, config, 'POST /api/mcp/stop', req, { status: 200, body: status });
-  } catch (err) {
-    reply(res, config, 'POST /api/mcp/stop', req, { status: 500, body: { error: err.message || 'The MCP server could not be stopped.' } });
-  }
+    const runner = runnerFor(config);
+    if (!runner)
+        return reply(res, config, 'POST /api/mcp/stop', req, { status: 501, body: { error: 'MCP supervision is not enabled in this process.' } });
+    try {
+        const status = await runner.stop();
+        reply(res, config, 'POST /api/mcp/stop', req, { status: 200, body: status });
+    }
+    catch (err) {
+        reply(res, config, 'POST /api/mcp/stop', req, { status: 500, body: { error: err.message || 'The MCP server could not be stopped.' } });
+    }
 }
-
 // The command an agent harness is configured with, shown in the panel so nobody
 // has to read the README to find it. The paths come from the same function that
 // starts the child, so the copy-paste text cannot drift from what actually runs.
 export function handleMcpCommand(req, res, config) {
-  // The absolute path, not the relative one the runner uses: this text gets
-  // pasted into a client config that spawns the command from the harness's own
-  // working directory, where a relative path does not resolve.
-  const entry = mcpEntryPoint();
-  reply(res, config, 'GET /api/mcp/command', req, {
-    status: 200,
-    body: {
-      command: entry,
-      relative: mcpCommand(),
-      transports: ['stdio'],
-      // The two config shapes a client is overwhelmingly likely to want. Both use
-      // the absolute path, for the reason above.
-      examples: [
-        { name: 'node', command: process.execPath, args: [entry] },
-        { name: 'node (assuming node is on PATH)', command: 'node', args: [entry] },
-      ],
-      docs: 'https://modelcontextprotocol.io/docs/develop/connect-local-servers',
-    },
-  });
+    // The absolute path, not the relative one the runner uses: this text gets
+    // pasted into a client config that spawns the command from the harness's own
+    // working directory, where a relative path does not resolve.
+    const entry = mcpEntryPoint();
+    reply(res, config, 'GET /api/mcp/command', req, {
+        status: 200,
+        body: {
+            command: entry,
+            relative: mcpCommand(),
+            transports: ['stdio'],
+            // The two config shapes a client is overwhelmingly likely to want. Both use
+            // the absolute path, for the reason above.
+            examples: [
+                { name: 'node', command: process.execPath, args: [entry] },
+                { name: 'node (assuming node is on PATH)', command: 'node', args: [entry] },
+            ],
+            docs: 'https://modelcontextprotocol.io/docs/develop/connect-local-servers',
+        },
+    });
 }
+//# sourceMappingURL=apiMcp.js.map

package/server/apiMcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiMcp.js","sourceRoot":"","sources":["../src/server/apiMcp.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,6EAA6E;AAC7E,mDAAmD;AACnD,mCAAmC;AACnC,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,iFAAiF;AACjF,gBAAgB;AAEhB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE5D,kFAAkF;AAClF,oFAAoF;AACpF,mFAAmF;AACnF,6EAA6E;AAC7E,2EAA2E;AAC3E,EAAE;AACF,mFAAmF;AACnF,wCAAwC;AACxC,SAAS,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;IAC7C,IAAI,OAAO,MAAM,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,iFAAiF;AACjF,mFAAmF;AACnF,4DAA4D;AAC5D,SAAS,SAAS,CAAC,MAAM;IACvB,OAAO,MAAM,EAAE,GAAG,IAAI,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,0EAA0E;QAC1E,wEAAwE;QACxE,OAAO,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE;YAC7C,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,iDAAiD;gBACzD,KAAK,EAAE,EAAE;aACV;SACF,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM;IACnD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iDAAiD,EAAE,EAAE,CAAC,CAAC;IACxJ,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACpC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,sCAAsC,EAAE,EAAE,CAAC,CAAC;IAC1I,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iDAAiD,EAAE,EAAE,CAAC,CAAC;IACvJ,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,sCAAsC,EAAE,EAAE,CAAC,CAAC;IACzI,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM;IAC/C,0EAA0E;IAC1E,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAE;QAC9C,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,UAAU,EAAE;YACtB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,4EAA4E;YAC5E,2CAA2C;YAC3C,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;gBAC1D,EAAE,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;aAC5E;YACD,IAAI,EAAE,oEAAoE;SAC3E;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["// The endpoints behind the topbar button:\n//\n//   GET  /api/mcp        — is it running, what is it offering, what happened\n//   POST /api/mcp/start  — start the child process\n//   POST /api/mcp/stop   — stop it\n//\n// The control surface and the protocol are deliberately separate. This process\n// never speaks MCP itself; it supervises a child that does. That is what makes\n// \"stop\" real — closing stdin lets the server drain and exit on its own terms\n// rather than leaving a half-torn-down process holding the scan cache.\n//\n// Starting a server is a side effect on the person's machine, so start and stop\n// take a body like every other POST and are same-origin like every other POST.\n// The GET is guarded too: the status includes the command line an agent is\n// configured with, which a foreign page has no business having even though it is\n// not a secret.\n\nimport { sendJSON } from './http.js';\nimport { mcpCommand, mcpEntryPoint } from './mcp/runner.js';\n\n// Every handler here has the same shape: work out the answer, then let whoever is\n// driving decide how it gets sent. That split exists so `config.handleMcp` — a test\n// double, or an embedding that supervises MCP itself — can observe the real result\n// of the real action rather than standing in for it. A hook that skipped the\n// action would make a start endpoint that never starts anything look fine.\n//\n// The hook owns the response when present. `server/index.js` supplies none, so the\n// ordinary path is exactly what it was.\nfunction reply(res, config, method, req, result) {\n  if (typeof config?.handleMcp === 'function') {\n    config.handleMcp(method, req, res, result);\n    return;\n  }\n  sendJSON(res, result.status, result.body);\n}\n\n// The runner, however the caller named it. `mcp` is what `server/index.js` sets;\n// `runner` is accepted because that is the obvious name and a test reaching for it\n// should not have to read the index to find the convention.\nfunction runnerFor(config) {\n  return config?.mcp || config?.runner || null;\n}\n\nexport function handleMcpStatus(req, res, config) {\n  const runner = runnerFor(config);\n  if (!runner) {\n    // The app is running without the control surface (a test, or an embedding\n    // that drives MCP itself). Say so rather than pretending it is stopped.\n    return reply(res, config, 'GET /api/mcp', req, {\n      status: 200,\n      body: {\n        running: false,\n        state: 'unavailable',\n        reason: 'MCP supervision is not enabled in this process.',\n        tools: [],\n      },\n    });\n  }\n  reply(res, config, 'GET /api/mcp', req, { status: 200, body: runner.status() });\n}\n\nexport async function handleMcpStart(req, res, config) {\n  const runner = runnerFor(config);\n  if (!runner) return reply(res, config, 'POST /api/mcp/start', req, { status: 501, body: { error: 'MCP supervision is not enabled in this process.' } });\n  try {\n    const status = await runner.start();\n    reply(res, config, 'POST /api/mcp/start', req, { status: 200, body: status });\n  } catch (err) {\n    // A start that cannot happen is usually a missing Node, a bad path, or a\n    // child that failed its handshake — the message says which, because the\n    // person clicking the button can only fix one of those three.\n    reply(res, config, 'POST /api/mcp/start', req, { status: 500, body: { error: err.message || 'The MCP server could not be started.' } });\n  }\n}\n\nexport async function handleMcpStop(req, res, config) {\n  const runner = runnerFor(config);\n  if (!runner) return reply(res, config, 'POST /api/mcp/stop', req, { status: 501, body: { error: 'MCP supervision is not enabled in this process.' } });\n  try {\n    const status = await runner.stop();\n    reply(res, config, 'POST /api/mcp/stop', req, { status: 200, body: status });\n  } catch (err) {\n    reply(res, config, 'POST /api/mcp/stop', req, { status: 500, body: { error: err.message || 'The MCP server could not be stopped.' } });\n  }\n}\n\n// The command an agent harness is configured with, shown in the panel so nobody\n// has to read the README to find it. The paths come from the same function that\n// starts the child, so the copy-paste text cannot drift from what actually runs.\nexport function handleMcpCommand(req, res, config) {\n  // The absolute path, not the relative one the runner uses: this text gets\n  // pasted into a client config that spawns the command from the harness's own\n  // working directory, where a relative path does not resolve.\n  const entry = mcpEntryPoint();\n  reply(res, config, 'GET /api/mcp/command', req, {\n    status: 200,\n    body: {\n      command: entry,\n      relative: mcpCommand(),\n      transports: ['stdio'],\n      // The two config shapes a client is overwhelmingly likely to want. Both use\n      // the absolute path, for the reason above.\n      examples: [\n        { name: 'node', command: process.execPath, args: [entry] },\n        { name: 'node (assuming node is on PATH)', command: 'node', args: [entry] },\n      ],\n      docs: 'https://modelcontextprotocol.io/docs/develop/connect-local-servers',\n    },\n  });\n}\n"]}

package/server/apiReview.d.ts

@@ -0,0 +1,2 @@
+import type { ServerResponse } from 'node:http';
+export declare function handleReview(res: ServerResponse, body: unknown): Promise<void>;

package/server/apiReview.js

@@ -0,0 +1,45 @@
+import { getSession } from './sessions.js';
+import { sendError, sendJSON } from './http.js';
+import { GitDiffError } from './gitDiff.js';
+import { runReview } from './review.js';
+import { reviewProfile } from '../shared/review/review.js';
+export async function handleReview(res, body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return sendError(res, 400, 'Provide a review request object.');
+    const b = body;
+    if (typeof b.scanId !== 'string')
+        return sendError(res, 400, 'Choose a scanned repository.');
+    const session = getSession(b.scanId);
+    if (!session)
+        return sendError(res, 404, 'Scan session expired. Scan this repository again.');
+    if (b.mode !== undefined && !['working', 'staged', 'range'].includes(b.mode))
+        return sendError(res, 400, 'Choose working, staged, or range review.');
+    for (const key of ['base', 'head'])
+        if (b[key] !== undefined && (typeof b[key] !== 'string' || b[key].length > 200))
+            return sendError(res, 400, 'References must be strings of at most 200 characters.');
+    let profile;
+    try {
+        if (b.profile !== undefined)
+            profile = reviewProfile(b.profile);
+    }
+    catch (error) {
+        return sendError(res, 400, error.message);
+    }
+    const abort = new AbortController();
+    const close = () => { if (!res.writableEnded)
+        abort.abort(); };
+    res.once('close', close);
+    try {
+        const report = await runReview(session.root, { base: b.base || 'HEAD', head: b.head || '', mode: b.mode || 'working', profile, signal: abort.signal });
+        if (!abort.signal.aborted)
+            sendJSON(res, 200, report);
+    }
+    catch (error) {
+        if (!abort.signal.aborted)
+            sendError(res, error instanceof GitDiffError ? error.status : 500, error instanceof Error ? error.message : 'Review failed.');
+    }
+    finally {
+        res.off('close', close);
+    }
+}
+//# sourceMappingURL=apiReview.js.map

package/server/apiReview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiReview.js","sourceRoot":"","sources":["../src/server/apiReview.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB,EAAE,IAAa;IACnE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;IAC7H,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,mDAAmD,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAc,CAAC;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,0CAA0C,CAAC,CAAC;IAC/J,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,uDAAuD,CAAC,CAAC;IACrN,IAAI,OAAkC,CAAC;IACvC,IAAI,CAAC;QAAC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACxE,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAkB,IAAI,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzL,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;YAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS,CAAC,GAAG,EAAE,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAC3J,CAAC;YAAS,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;AACxC,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http';\nimport { getSession } from './sessions.js';\nimport { sendError, sendJSON } from './http.js';\nimport { GitDiffError } from './gitDiff.js';\nimport { runReview } from './review.js';\nimport { reviewProfile } from '../shared/review/review.js';\nimport type { ReviewMode, ReviewProfile } from '../shared/review/contracts.js';\n\nexport async function handleReview(res: ServerResponse, body: unknown) {\n  if (!body || typeof body !== 'object' || Array.isArray(body)) return sendError(res, 400, 'Provide a review request object.');\n  const b = body as Record<string, unknown>;\n  if (typeof b.scanId !== 'string') return sendError(res, 400, 'Choose a scanned repository.');\n  const session = getSession(b.scanId);\n  if (!session) return sendError(res, 404, 'Scan session expired. Scan this repository again.');\n  if (b.mode !== undefined && !['working', 'staged', 'range'].includes(b.mode as string)) return sendError(res, 400, 'Choose working, staged, or range review.');\n  for (const key of ['base', 'head']) if (b[key] !== undefined && (typeof b[key] !== 'string' || (b[key] as string).length > 200)) return sendError(res, 400, 'References must be strings of at most 200 characters.');\n  let profile: ReviewProfile | undefined;\n  try { if (b.profile !== undefined) profile = reviewProfile(b.profile); }\n  catch (error) { return sendError(res, 400, (error as Error).message); }\n  const abort = new AbortController();\n  const close = () => { if (!res.writableEnded) abort.abort(); };\n  res.once('close', close);\n  try {\n    const report = await runReview(session.root, { base: b.base as string || 'HEAD', head: b.head as string || '', mode: b.mode as ReviewMode || 'working', profile, signal: abort.signal });\n    if (!abort.signal.aborted) sendJSON(res, 200, report);\n  } catch (error) {\n    if (!abort.signal.aborted) sendError(res, error instanceof GitDiffError ? error.status : 500, error instanceof Error ? error.message : 'Review failed.');\n  } finally { res.off('close', close); }\n}\n"]}

package/server/apiScan.d.ts

@@ -0,0 +1,5 @@
+import type { ServerResponse } from 'node:http';
+export declare function handleScan(res: ServerResponse, body: unknown, { projectRoot }: {
+    projectRoot: string;
+}): Promise<void>;
+export declare function handleCleanup(res: any, cloneId: any): Promise<void>;

package/server/apiScan.js

@@ -1,3 +1,5 @@
+import { parseScanRequest } from './scanRequest.js';
+import { throwIfAborted } from '../shared/analyzer/scanControl.js';
 // POST /api/scan and DELETE /api/scan/:cloneId — the endpoint the whole app
 // starts from.
 //
@@ -13,10 +15,8 @@
 // hop inside a filter keystroke. The search index travels the same way: built
 // once at scan time, attached to the session, and queried without re-walking
 // the tree.
-
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
-
 import { computeFacts } from '../shared/analyzer/graph.js';
 import { scanRepo } from '../shared/analyzer/scan.js';
 import { detectManifest } from '../shared/analyzer/services.js';
@@ -28,92 +28,111 @@ import { gitLog, parseGitLog } from './gitHistory.js';
 import { sendError, sendJSON } from './http.js';
 import { expandHome } from './paths.js';
 import { closeClone, isCloneId, openSession } from './sessions.js';
-
 export async function handleScan(res, body, { projectRoot }) {
-  const target = await resolveTarget(body, projectRoot);
-  if (target.error) return sendError(res, 400, target.error);
-
-  const { root, cloneDir, cloneId, gitMeta } = target;
-  try {
-    const source = nodeFileSource(root);
-    const scan = await scanRepo(source);
-    if (gitMeta) {
-      // Show the repo's real name up top; keep the temp dir name for honesty,
-      // so a path in the UI is still a path you could go and look at.
-      scan.name = gitMeta.repoName;
-      scan.tempId = path.basename(root);
-      scan.gitUrl = gitMeta.gitUrl;
+    let request;
+    try {
+        request = parseScanRequest(body);
+        if (request.gitUrl)
+            assertGitUrl(request.gitUrl);
+    }
+    catch (error) {
+        return sendError(res, 400, error.message);
+    }
+    const controller = new AbortController();
+    const disconnected = () => { if (!res.writableEnded)
+        controller.abort(); };
+    res.once('close', disconnected);
+    let cloneDir;
+    try {
+        const target = await resolveTarget(request, projectRoot);
+        if (target.error)
+            return sendError(res, 400, target.error);
+        const { root, cloneId, gitMeta } = target;
+        cloneDir = target.cloneDir;
+        throwIfAborted(controller.signal);
+        const source = nodeFileSource(root);
+        const scan = await scanRepo(source, { ...request.options, signal: controller.signal });
+        if (gitMeta) {
+            // Show the repo's real name up top; keep the temp dir name for honesty,
+            // so a path in the UI is still a path you could go and look at.
+            scan.name = gitMeta.repoName;
+            scan.tempId = path.basename(root);
+            scan.gitUrl = gitMeta.gitUrl;
+        }
+        const manifest = await detectManifest(source);
+        const facts = computeFacts(scan, manifest);
+        // The search index is built from the same files the scanner accepted.
+        // Doing it here, against the same FileSource, means a search request
+        // becomes a Map lookup plus a scoring pass; the per-file reads the old
+        // `/api/search` did on first use are gone. Cap behaviour and skip rules
+        // live in `searchIndex.js` and are tested there.
+        const codeFiles = scan.files.map((f) => f.path);
+        const searchIndexData = await buildSearchIndex(source, codeFiles);
+        const history = await collectHistory(root, scan);
+        throwIfAborted(controller.signal);
+        const scanId = openSession({ root, cloneDir, searchIndex: searchIndexData });
+        sendJSON(res, 200, { scan, facts, manifest, history, scanId, cloneId });
+    }
+    catch (err) {
+        // A clone that was never scanned successfully has no session to evict it
+        // later, so it has to go now or it is a temp directory nobody owns.
+        if (cloneDir)
+            await removeClone(cloneDir);
+        if (!controller.signal.aborted)
+            sendError(res, 500, 'The scan failed: ' + err.message);
+    }
+    finally {
+        res.removeListener('close', disconnected);
     }
-    const manifest = await detectManifest(source);
-    const facts = computeFacts(scan, manifest);
-
-    // The search index is built from the same files the scanner accepted.
-    // Doing it here, against the same FileSource, means a search request
-    // becomes a Map lookup plus a scoring pass; the per-file reads the old
-    // `/api/search` did on first use are gone. Cap behaviour and skip rules
-    // live in `searchIndex.js` and are tested there.
-    const codeFiles = scan.files.map((f) => f.path);
-    const searchIndexData = await buildSearchIndex(source, codeFiles);
-
-    const history = await collectHistory(root, scan);
-    const scanId = openSession({ root, cloneDir, searchIndex: searchIndexData });
-    sendJSON(res, 200, { scan, facts, manifest, history, scanId, cloneId });
-  } catch (err) {
-    // A clone that was never scanned successfully has no session to evict it
-    // later, so it has to go now or it is a temp directory nobody owns.
-    if (cloneDir) await removeClone(cloneDir);
-    sendError(res, 500, 'The scan failed: ' + err.message);
-  }
 }
-
 // History is a bonus layer over the scan, never a reason for it to fail. When
 // git is missing, the folder has no .git, or the log somehow blows up, the
 // payload carries the honest unavailable shape instead — the UI says why
 // rather than inventing zeros.
 async function collectHistory(root, scan) {
-  try {
-    const log = await gitLog(root);
-    if (!log.ok) return unavailableHistory(log.reason);
-    return analyzeHistory(scan, parseGitLog(log.text), { totalCommits: log.totalCommits });
-  } catch {
-    return unavailableHistory('The history could not be read — the scan itself is unaffected.');
-  }
+    try {
+        const log = await gitLog(root);
+        if (!log.ok)
+            return unavailableHistory(log.reason);
+        return analyzeHistory(scan, parseGitLog(log.text), { totalCommits: log.totalCommits });
+    }
+    catch {
+        return unavailableHistory('The history could not be read — the scan itself is unaffected.');
+    }
 }
-
 // The three request shapes, reduced to a directory. Cloning happens here, which
 // is why this returns rather than sends: the caller owns cleanup if the scan that
 // follows fails.
 async function resolveTarget(body, projectRoot) {
-  if (body.demo) return { root: projectRoot };
-
-  if (body.path) {
-    const root = expandHome(String(body.path));
-    const stat = await fs.stat(root).catch(() => null);
-    if (!stat?.isDirectory()) {
-      return { error: 'No folder at ' + root + '. Check the path and try again.' };
+    if (body.demo)
+        return { root: projectRoot };
+    if (body.path) {
+        const root = expandHome(String(body.path));
+        const stat = await fs.stat(root).catch(() => null);
+        if (!stat?.isDirectory()) {
+            return { error: 'No folder at ' + root + '. Check the path and try again.' };
+        }
+        return { root };
+    }
+    if (body.gitUrl) {
+        const url = assertGitUrl(body.gitUrl);
+        const clone = await cloneRepo(url);
+        return {
+            root: clone.dir,
+            cloneDir: clone.dir,
+            cloneId: clone.id,
+            gitMeta: { gitUrl: url, repoName: repoNameFromUrl(url) },
+        };
     }
-    return { root };
-  }
-
-  if (body.gitUrl) {
-    const url = assertGitUrl(body.gitUrl);
-    const clone = await cloneRepo(url);
-    return {
-      root: clone.dir,
-      cloneDir: clone.dir,
-      cloneId: clone.id,
-      gitMeta: { gitUrl: url, repoName: repoNameFromUrl(url) },
-    };
-  }
-
-  return { error: 'Send a path, a gitUrl, or { demo: true }.' };
+    return { error: 'Send a path, a gitUrl, or { demo: true }.' };
 }
-
 // The page sends this when it is done with a cloned repo. Nothing is reported
 // about whether the clone was there: the browser cannot act on the difference,
 // and an unload-time request that 404s looks like a bug in the console.
 export async function handleCleanup(res, cloneId) {
-  if (!isCloneId(cloneId)) return sendError(res, 400, 'That is not a clone id.');
-  await closeClone(cloneId);
-  sendJSON(res, 200, { ok: true });
+    if (!isCloneId(cloneId))
+        return sendError(res, 400, 'That is not a clone id.');
+    await closeClone(cloneId);
+    sendJSON(res, 200, { ok: true });
 }
+//# sourceMappingURL=apiScan.js.map

package/server/apiScan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiScan.js","sourceRoot":"","sources":["../src/server/apiScan.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,4EAA4E;AAC5E,eAAe;AACf,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,6DAA6D;AAC7D,EAAE;AACF,yEAAyE;AACzE,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,YAAY;AAEZ,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEnE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,IAAa,EAAE,EAAE,WAAW,EAA2B;IAC3G,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,OAAO,CAAC,MAAM;YAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAC3F,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAChC,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC1C,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,IAAI,OAAO,EAAE,CAAC;YACZ,wEAAwE;YACxE,gEAAgE;YAChE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE3C,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjD,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,QAAQ;YAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IACzF,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,+BAA+B;AAC/B,KAAK,UAAU,cAAc,CAAC,IAAI,EAAE,IAAI;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,gEAAgE,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,kFAAkF;AAClF,iBAAiB;AACjB,KAAK,UAAU,aAAa,CAAC,IAAiB,EAAE,WAAmB;IACjE,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAE5C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,iCAAiC,EAAE,CAAC;QAC/E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,GAAG;YACf,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE;SACzD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAG,EAAE,OAAO;IAC9C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC/E,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http';\nimport type { ScanRequest } from '../shared/contracts.js';\nimport { parseScanRequest } from './scanRequest.js';\nimport { throwIfAborted } from '../shared/analyzer/scanControl.js';\n// POST /api/scan and DELETE /api/scan/:cloneId — the endpoint the whole app\n// starts from.\n//\n// Three ways in, one way out. A local path, a git URL to clone, or `demo: true`\n// meaning \"scan Onboarder itself\", which is how the app has something to show\n// before you have chosen anything. All three end at a root directory, and from\n// there the work is the same three calls the browser would make against its own\n// file source: scan, detect the manifest, compute the facts.\n//\n// The response is deliberately whole. The front end gets scan, facts and\n// manifest in one round trip and holds them for the session, because every view\n// is a projection of those three and re-fetching per view would put a network\n// hop inside a filter keystroke. The search index travels the same way: built\n// once at scan time, attached to the session, and queried without re-walking\n// the tree.\n\nimport { promises as fs } from 'node:fs';\nimport path from 'node:path';\n\nimport { computeFacts } from '../shared/analyzer/graph.js';\nimport { scanRepo } from '../shared/analyzer/scan.js';\nimport { detectManifest } from '../shared/analyzer/services.js';\nimport { analyzeHistory, unavailableHistory } from '../shared/analyzer/history.js';\nimport { buildSearchIndex } from './searchIndex.js';\nimport { nodeFileSource } from './fileSourceNode.js';\nimport { assertGitUrl, cloneRepo, removeClone, repoNameFromUrl } from './gitClone.js';\nimport { gitLog, parseGitLog } from './gitHistory.js';\nimport { sendError, sendJSON } from './http.js';\nimport { expandHome } from './paths.js';\nimport { closeClone, isCloneId, openSession } from './sessions.js';\n\nexport async function handleScan(res: ServerResponse, body: unknown, { projectRoot }: { projectRoot: string }) {\n  let request: ScanRequest;\n  try { request = parseScanRequest(body); if (request.gitUrl) assertGitUrl(request.gitUrl); }\n  catch (error) { return sendError(res, 400, error.message); }\n  const controller = new AbortController();\n  const disconnected = () => { if (!res.writableEnded) controller.abort(); };\n  res.once('close', disconnected);\n  let cloneDir: string | undefined;\n  try {\n    const target = await resolveTarget(request, projectRoot);\n    if (target.error) return sendError(res, 400, target.error);\n    const { root, cloneId, gitMeta } = target;\n    cloneDir = target.cloneDir;\n    throwIfAborted(controller.signal);\n    const source = nodeFileSource(root);\n    const scan = await scanRepo(source, { ...request.options, signal: controller.signal });\n    if (gitMeta) {\n      // Show the repo's real name up top; keep the temp dir name for honesty,\n      // so a path in the UI is still a path you could go and look at.\n      scan.name = gitMeta.repoName;\n      scan.tempId = path.basename(root);\n      scan.gitUrl = gitMeta.gitUrl;\n    }\n    const manifest = await detectManifest(source);\n    const facts = computeFacts(scan, manifest);\n\n    // The search index is built from the same files the scanner accepted.\n    // Doing it here, against the same FileSource, means a search request\n    // becomes a Map lookup plus a scoring pass; the per-file reads the old\n    // `/api/search` did on first use are gone. Cap behaviour and skip rules\n    // live in `searchIndex.js` and are tested there.\n    const codeFiles = scan.files.map((f) => f.path);\n    const searchIndexData = await buildSearchIndex(source, codeFiles);\n\n    const history = await collectHistory(root, scan);\n    throwIfAborted(controller.signal);\n    const scanId = openSession({ root, cloneDir, searchIndex: searchIndexData });\n    sendJSON(res, 200, { scan, facts, manifest, history, scanId, cloneId });\n  } catch (err) {\n    // A clone that was never scanned successfully has no session to evict it\n    // later, so it has to go now or it is a temp directory nobody owns.\n    if (cloneDir) await removeClone(cloneDir);\n    if (!controller.signal.aborted) sendError(res, 500, 'The scan failed: ' + err.message);\n  } finally {\n    res.removeListener('close', disconnected);\n  }\n}\n\n// History is a bonus layer over the scan, never a reason for it to fail. When\n// git is missing, the folder has no .git, or the log somehow blows up, the\n// payload carries the honest unavailable shape instead — the UI says why\n// rather than inventing zeros.\nasync function collectHistory(root, scan) {\n  try {\n    const log = await gitLog(root);\n    if (!log.ok) return unavailableHistory(log.reason);\n    return analyzeHistory(scan, parseGitLog(log.text), { totalCommits: log.totalCommits });\n  } catch {\n    return unavailableHistory('The history could not be read — the scan itself is unaffected.');\n  }\n}\n\n// The three request shapes, reduced to a directory. Cloning happens here, which\n// is why this returns rather than sends: the caller owns cleanup if the scan that\n// follows fails.\nasync function resolveTarget(body: ScanRequest, projectRoot: string): Promise<{ root?: string; error?: string; cloneDir?: string; cloneId?: string; gitMeta?: { gitUrl: string; repoName: string } }> {\n  if (body.demo) return { root: projectRoot };\n\n  if (body.path) {\n    const root = expandHome(String(body.path));\n    const stat = await fs.stat(root).catch(() => null);\n    if (!stat?.isDirectory()) {\n      return { error: 'No folder at ' + root + '. Check the path and try again.' };\n    }\n    return { root };\n  }\n\n  if (body.gitUrl) {\n    const url = assertGitUrl(body.gitUrl);\n    const clone = await cloneRepo(url);\n    return {\n      root: clone.dir,\n      cloneDir: clone.dir,\n      cloneId: clone.id,\n      gitMeta: { gitUrl: url, repoName: repoNameFromUrl(url) },\n    };\n  }\n\n  return { error: 'Send a path, a gitUrl, or { demo: true }.' };\n}\n\n// The page sends this when it is done with a cloned repo. Nothing is reported\n// about whether the clone was there: the browser cannot act on the difference,\n// and an unload-time request that 404s looks like a bug in the console.\nexport async function handleCleanup(res, cloneId) {\n  if (!isCloneId(cloneId)) return sendError(res, 400, 'That is not a clone id.');\n  await closeClone(cloneId);\n  sendJSON(res, 200, { ok: true });\n}\n"]}

package/server/apiSearch.d.ts

@@ -0,0 +1,33 @@
+export declare function buildTfIdfIndex(documents: any): {
+    index: Map<any, any>;
+    docCounts: Map<any, any>;
+    totalDocs: number;
+};
+export declare function searchIndex(indexData: any, queryString: any, limit?: number): any[];
+export declare function searchDocuments(indexData: any, rawQuery: any, options?: Record<string, any>): {
+    results: any[];
+    total: number;
+    indexed: any;
+    capped: boolean;
+    advanced: any;
+    query: {
+        terms: any;
+        phrases: any;
+        negatives: any;
+        exts: any;
+        paths: any;
+        kinds: any;
+        isTest: any;
+        isSource: any;
+        regex: string;
+        caseSensitive: any;
+        advanced: any;
+    };
+    error: any;
+    stats: {
+        bytes: any;
+        skipped: any;
+        cap: any;
+    };
+};
+export declare function handleSearch(res: any, body: any): Promise<void>;