codebase-onboarder 0.5.0 → 0.7.0

package/server/tools/parse.js

@@ -12,159 +12,157 @@
 // `severity` is one of the built-in five. `source` is 'builtin' or 'external'
 // and `tool` names which engine answered, so the UI can say "found by Semgrep"
 // rather than letting a finding appear from nowhere.
-
 export const SEVERITY_ORDER = ['info', 'low', 'medium', 'high', 'critical'];
-
 export function normalizeSeverity(raw) {
-  const s = String(raw || '').toLowerCase();
-  if (s === 'critical' || s === 'error') return s === 'error' ? 'high' : 'critical';
-  if (s === 'high') return 'high';
-  if (s === 'medium' || s === 'warning' || s === 'warn' || s === 'moderate') return 'medium';
-  if (s === 'low' || s === 'note') return 'low';
-  return 'info';
+    const s = String(raw || '').toLowerCase();
+    if (s === 'critical' || s === 'error')
+        return s === 'error' ? 'high' : 'critical';
+    if (s === 'high')
+        return 'high';
+    if (s === 'medium' || s === 'warning' || s === 'warn' || s === 'moderate')
+        return 'medium';
+    if (s === 'low' || s === 'note')
+        return 'low';
+    return 'info';
 }
-
 function clipExcerpt(text) {
-  return String(text ?? '').replace(/\s+/g, ' ').trim().slice(0, 90);
+    return String(text ?? '').replace(/\s+/g, ' ').trim().slice(0, 90);
 }
-
 // ---- Semgrep / Opengrep ----------------------------------------------------
 // `semgrep --json` → { results: [ { check_id, path, start:{line}, extra:
 // { severity, message, lines, metadata:{category} } } ] }. Opengrep is the same
 // JSON. `rel` strips the scan root so paths match the repo-relative form the
 // rest of the app uses.
 export function parseSemgrep(json, rel) {
-  const results = Array.isArray(json && json.results) ? json.results : [];
-  const findings = [];
-  for (const r of results) {
-    const extra = r.extra || {};
-    findings.push({
-      rule: String(r.check_id || 'semgrep-rule'),
-      severity: normalizeSeverity(extra.severity),
-      category: (extra.metadata && extra.metadata.category) || 'security',
-      message: clipExcerpt(extra.message || r.check_id),
-      path: rel(r.path),
-      line: r.start && r.start.line ? r.start.line : 1,
-      excerpt: clipExcerpt(extra.lines),
-      source: 'external',
-      tool: 'semgrep',
-    });
-  }
-  return findings;
+    const results = Array.isArray(json && json.results) ? json.results : [];
+    const findings = [];
+    for (const r of results) {
+        const extra = r.extra || {};
+        findings.push({
+            rule: String(r.check_id || 'semgrep-rule'),
+            severity: normalizeSeverity(extra.severity),
+            category: (extra.metadata && extra.metadata.category) || 'security',
+            message: clipExcerpt(extra.message || r.check_id),
+            path: rel(r.path),
+            line: r.start && r.start.line ? r.start.line : 1,
+            excerpt: clipExcerpt(extra.lines),
+            source: 'external',
+            tool: 'semgrep',
+        });
+    }
+    return findings;
 }
-
 // ---- Gitleaks ---------------------------------------------------------------
 // `gitleaks --report-format json` → an array of secrets: [ { RuleID,
 // Description, File, StartLine, Match, Secret } ]. The finding reports *that* a
 // secret exists, never the secret — `Secret` is read for nothing.
 export function parseGitleaks(json, rel) {
-  const list = Array.isArray(json) ? json : [];
-  const findings = [];
-  for (const r of list) {
-    findings.push({
-      rule: 'secret:' + (r.RuleID || 'unknown'),
-      severity: 'critical',
-      category: 'secret',
-      message: clipExcerpt(r.Description || 'A secret is committed to the source.'),
-      path: rel(r.File),
-      line: r.StartLine || 1,
-      excerpt: 'committed credential (value redacted)',
-      source: 'external',
-      tool: 'gitleaks',
-    });
-  }
-  return findings;
+    const list = Array.isArray(json) ? json : [];
+    const findings = [];
+    for (const r of list) {
+        findings.push({
+            rule: 'secret:' + (r.RuleID || 'unknown'),
+            severity: 'critical',
+            category: 'secret',
+            message: clipExcerpt(r.Description || 'A secret is committed to the source.'),
+            path: rel(r.File),
+            line: r.StartLine || 1,
+            excerpt: 'committed credential (value redacted)',
+            source: 'external',
+            tool: 'gitleaks',
+        });
+    }
+    return findings;
 }
-
 // ---- Knip -------------------------------------------------------------------
 // `knip --reporter json` groups dead code by kind: { files:[], dependencies:[],
 // unused:[{name,file,line}], ... }. Each becomes a finding so the dead-code
 // pass can be read in one list; the kind is the rule.
 export function parseKnip(json, rel) {
-  const findings = [];
-  const push = (rule, category, severity, path, line, message) => {
-    findings.push({ rule, category, severity, message, path: rel(path), line: line || 1, excerpt: '', source: 'external', tool: 'knip' });
-  };
-
-  for (const file of (json && json.files) || []) {
-    push('knip:unused-file', 'dead-file', 'medium', file, 1, 'This file is never imported anywhere.');
-  }
-  for (const dep of (json && json.dependencies) || []) {
-    push('knip:unused-dependency', 'dead-dependency', 'low', dep, 1, `Dependency "${dep}" is declared but never imported.`);
-  }
-  for (const u of (json && json.unused) || []) {
-    push('knip:unused-export', 'dead-export', 'low', u.file, u.line, `Export "${u.name}" is never used.`);
-  }
-  for (const u of (json && json.unresolved) || []) {
-    push('knip:unresolved', 'dead-import', 'medium', u.file, u.line, `Import "${u.name}" does not resolve to anything.`);
-  }
-  return findings;
+    const findings = [];
+    const push = (rule, category, severity, path, line, message) => {
+        findings.push({ rule, category, severity, message, path: rel(path), line: line || 1, excerpt: '', source: 'external', tool: 'knip' });
+    };
+    for (const file of (json && json.files) || []) {
+        push('knip:unused-file', 'dead-file', 'medium', file, 1, 'This file is never imported anywhere.');
+    }
+    for (const dep of (json && json.dependencies) || []) {
+        push('knip:unused-dependency', 'dead-dependency', 'low', dep, 1, `Dependency "${dep}" is declared but never imported.`);
+    }
+    for (const u of (json && json.unused) || []) {
+        push('knip:unused-export', 'dead-export', 'low', u.file, u.line, `Export "${u.name}" is never used.`);
+    }
+    for (const u of (json && json.unresolved) || []) {
+        push('knip:unresolved', 'dead-import', 'medium', u.file, u.line, `Import "${u.name}" does not resolve to anything.`);
+    }
+    return findings;
 }
-
 // ---- Vulture ----------------------------------------------------------------
 // `vulture` prints lines like `src/util.py:42: unused function 'helper' (60%
 // confidence)`. There is no stable JSON, so we parse the text — which is why the
 // parser is a pure function over a string, and why the line shape is pinned by
 // a test rather than by reading the binary's source.
 const VULTURE_RE = /^(.+?):(\d+):\s+(.+?)\s+\((\d+)% confidence\)/;
-
 export function parseVulture(text, rel) {
-  const findings = [];
-  for (const line of String(text || '').split('\n')) {
-    const m = line.match(VULTURE_RE);
-    if (!m) continue;
-    const confidence = Number(m[4]);
-    if (confidence < 60) continue; // below vulture's own floor, it is guessing
-    findings.push({
-      rule: 'vulture:' + (m[3].split(' ')[0] || 'unused'),
-      severity: confidence >= 90 ? 'medium' : 'low',
-      category: 'dead-code',
-      message: clipExcerpt(m[3]) + ` (${confidence}% confident)`,
-      path: rel(m[1]),
-      line: Number(m[2]) || 1,
-      excerpt: '',
-      source: 'external',
-      tool: 'vulture',
-    });
-  }
-  return findings;
+    const findings = [];
+    for (const line of String(text || '').split('\n')) {
+        const m = line.match(VULTURE_RE);
+        if (!m)
+            continue;
+        const confidence = Number(m[4]);
+        if (confidence < 60)
+            continue; // below vulture's own floor, it is guessing
+        findings.push({
+            rule: 'vulture:' + (m[3].split(' ')[0] || 'unused'),
+            severity: confidence >= 90 ? 'medium' : 'low',
+            category: 'dead-code',
+            message: clipExcerpt(m[3]) + ` (${confidence}% confident)`,
+            path: rel(m[1]),
+            line: Number(m[2]) || 1,
+            excerpt: '',
+            source: 'external',
+            tool: 'vulture',
+        });
+    }
+    return findings;
 }
-
 // ---- Depcheck ---------------------------------------------------------------
 // `depcheck --json` → { dependencies:[], devDependencies:[], missing:{} }.
 export function parseDepcheck(json) {
-  const findings = [];
-  const push = (name, dev) => findings.push({
-    rule: 'depcheck:unused',
-    severity: 'low',
-    category: 'dead-dependency',
-    message: `Package "${name}" is declared in package.json but never imported.`,
-    path: 'package.json',
-    line: 1,
-    excerpt: '',
-    source: 'external',
-    tool: 'depcheck',
-    dev,
-  });
-  for (const name of (json && json.dependencies) || []) push(name, false);
-  for (const name of (json && json.devDependencies) || []) push(name, true);
-  return findings;
+    const findings = [];
+    const push = (name, dev) => findings.push({
+        rule: 'depcheck:unused',
+        severity: 'low',
+        category: 'dead-dependency',
+        message: `Package "${name}" is declared in package.json but never imported.`,
+        path: 'package.json',
+        line: 1,
+        excerpt: '',
+        source: 'external',
+        tool: 'depcheck',
+        dev,
+    });
+    for (const name of (json && json.dependencies) || [])
+        push(name, false);
+    for (const name of (json && json.devDependencies) || [])
+        push(name, true);
+    return findings;
 }
-
 // Merge the external passes into one list, keeping the built-in scan's findings
 // untouched. Dedup on (path, line, rule): two engines that flag the same line
 // for the same reason are one problem, not two.
 export function mergeFindings(...lists) {
-  const seen = new Set();
-  const out = [];
-  for (const list of lists) {
-    for (const f of list || []) {
-      const key = `${f.path}:${f.line}:${f.rule}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      out.push(f);
+    const seen = new Set();
+    const out = [];
+    for (const list of lists) {
+        for (const f of list || []) {
+            const key = `${f.path}:${f.line}:${f.rule}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push(f);
+        }
     }
-  }
-  return out;
+    return out;
 }
-
+//# sourceMappingURL=parse.js.map

package/server/tools/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/server/tools/parse.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,yDAAyD;AACzD,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,eAAe;AACf,EAAE;AACF,uEAAuE;AACvE,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,qDAAqD;AAErD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAE5E,MAAM,UAAU,iBAAiB,CAAC,GAAG;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAClF,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IAC3F,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAI;IACvB,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,+EAA+E;AAC/E,yEAAyE;AACzE,gFAAgF;AAChF,6EAA6E;AAC7E,wBAAwB;AACxB,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,GAAG;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,cAAc,CAAC;YAC1C,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC3C,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU;YACnE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;YACjD,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChD,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;YACjC,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,qEAAqE;AACrE,gFAAgF;AAChF,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,IAAI,EAAE,GAAG;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;YACzC,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,IAAI,sCAAsC,CAAC;YAC7E,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC;YACtB,OAAO,EAAE,uCAAuC;YAChD,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,4EAA4E;AAC5E,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,IAAI,EAAE,GAAG;IACjC,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACxI,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,uCAAuC,CAAC,CAAC;IACpG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC,wBAAwB,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,eAAe,GAAG,mCAAmC,CAAC,CAAC;IAC1H,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,oBAAoB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,iCAAiC,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,iFAAiF;AACjF,+EAA+E;AAC/E,qDAAqD;AACrD,MAAM,UAAU,GAAG,+CAA+C,CAAC;AAEnE,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,GAAG;IACpC,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,UAAU,GAAG,EAAE;YAAE,SAAS,CAAC,4CAA4C;QAC3E,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;YACnD,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;YAC7C,QAAQ,EAAE,WAAW;YACrB,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,cAAc;YAC1D,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvB,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,IAAI;IAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxC,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,YAAY,IAAI,mDAAmD;QAC5E,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,CAAC;QACP,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,UAAU;QAChB,GAAG;KACJ,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxE,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,GAAG,KAAK;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["// Parsing the dialects. Every analyzer speaks its own JSON (or SARIF); the UI\n// speaks one. This file is the translation layer, and it is pure — it takes a\n// string a tool printed and returns findings, so it can be tested in Node with\n// fixtures and needs no process, no filesystem, no PATH.\n//\n// The single target shape is the one the built-in scanner already emits\n// (`shared/analyzer/security.js`), so the existing security view needs no new\n// kind of row:\n//\n//   { rule, severity, category, message, line, excerpt, source, tool }\n//\n// `severity` is one of the built-in five. `source` is 'builtin' or 'external'\n// and `tool` names which engine answered, so the UI can say \"found by Semgrep\"\n// rather than letting a finding appear from nowhere.\n\nexport const SEVERITY_ORDER = ['info', 'low', 'medium', 'high', 'critical'];\n\nexport function normalizeSeverity(raw) {\n  const s = String(raw || '').toLowerCase();\n  if (s === 'critical' || s === 'error') return s === 'error' ? 'high' : 'critical';\n  if (s === 'high') return 'high';\n  if (s === 'medium' || s === 'warning' || s === 'warn' || s === 'moderate') return 'medium';\n  if (s === 'low' || s === 'note') return 'low';\n  return 'info';\n}\n\nfunction clipExcerpt(text) {\n  return String(text ?? '').replace(/\\s+/g, ' ').trim().slice(0, 90);\n}\n\n// ---- Semgrep / Opengrep ----------------------------------------------------\n// `semgrep --json` → { results: [ { check_id, path, start:{line}, extra:\n// { severity, message, lines, metadata:{category} } } ] }. Opengrep is the same\n// JSON. `rel` strips the scan root so paths match the repo-relative form the\n// rest of the app uses.\nexport function parseSemgrep(json, rel) {\n  const results = Array.isArray(json && json.results) ? json.results : [];\n  const findings = [];\n  for (const r of results) {\n    const extra = r.extra || {};\n    findings.push({\n      rule: String(r.check_id || 'semgrep-rule'),\n      severity: normalizeSeverity(extra.severity),\n      category: (extra.metadata && extra.metadata.category) || 'security',\n      message: clipExcerpt(extra.message || r.check_id),\n      path: rel(r.path),\n      line: r.start && r.start.line ? r.start.line : 1,\n      excerpt: clipExcerpt(extra.lines),\n      source: 'external',\n      tool: 'semgrep',\n    });\n  }\n  return findings;\n}\n\n// ---- Gitleaks ---------------------------------------------------------------\n// `gitleaks --report-format json` → an array of secrets: [ { RuleID,\n// Description, File, StartLine, Match, Secret } ]. The finding reports *that* a\n// secret exists, never the secret — `Secret` is read for nothing.\nexport function parseGitleaks(json, rel) {\n  const list = Array.isArray(json) ? json : [];\n  const findings = [];\n  for (const r of list) {\n    findings.push({\n      rule: 'secret:' + (r.RuleID || 'unknown'),\n      severity: 'critical',\n      category: 'secret',\n      message: clipExcerpt(r.Description || 'A secret is committed to the source.'),\n      path: rel(r.File),\n      line: r.StartLine || 1,\n      excerpt: 'committed credential (value redacted)',\n      source: 'external',\n      tool: 'gitleaks',\n    });\n  }\n  return findings;\n}\n\n// ---- Knip -------------------------------------------------------------------\n// `knip --reporter json` groups dead code by kind: { files:[], dependencies:[],\n// unused:[{name,file,line}], ... }. Each becomes a finding so the dead-code\n// pass can be read in one list; the kind is the rule.\nexport function parseKnip(json, rel) {\n  const findings = [];\n  const push = (rule, category, severity, path, line, message) => {\n    findings.push({ rule, category, severity, message, path: rel(path), line: line || 1, excerpt: '', source: 'external', tool: 'knip' });\n  };\n\n  for (const file of (json && json.files) || []) {\n    push('knip:unused-file', 'dead-file', 'medium', file, 1, 'This file is never imported anywhere.');\n  }\n  for (const dep of (json && json.dependencies) || []) {\n    push('knip:unused-dependency', 'dead-dependency', 'low', dep, 1, `Dependency \"${dep}\" is declared but never imported.`);\n  }\n  for (const u of (json && json.unused) || []) {\n    push('knip:unused-export', 'dead-export', 'low', u.file, u.line, `Export \"${u.name}\" is never used.`);\n  }\n  for (const u of (json && json.unresolved) || []) {\n    push('knip:unresolved', 'dead-import', 'medium', u.file, u.line, `Import \"${u.name}\" does not resolve to anything.`);\n  }\n  return findings;\n}\n\n// ---- Vulture ----------------------------------------------------------------\n// `vulture` prints lines like `src/util.py:42: unused function 'helper' (60%\n// confidence)`. There is no stable JSON, so we parse the text — which is why the\n// parser is a pure function over a string, and why the line shape is pinned by\n// a test rather than by reading the binary's source.\nconst VULTURE_RE = /^(.+?):(\\d+):\\s+(.+?)\\s+\\((\\d+)% confidence\\)/;\n\nexport function parseVulture(text, rel) {\n  const findings = [];\n  for (const line of String(text || '').split('\\n')) {\n    const m = line.match(VULTURE_RE);\n    if (!m) continue;\n    const confidence = Number(m[4]);\n    if (confidence < 60) continue; // below vulture's own floor, it is guessing\n    findings.push({\n      rule: 'vulture:' + (m[3].split(' ')[0] || 'unused'),\n      severity: confidence >= 90 ? 'medium' : 'low',\n      category: 'dead-code',\n      message: clipExcerpt(m[3]) + ` (${confidence}% confident)`,\n      path: rel(m[1]),\n      line: Number(m[2]) || 1,\n      excerpt: '',\n      source: 'external',\n      tool: 'vulture',\n    });\n  }\n  return findings;\n}\n\n// ---- Depcheck ---------------------------------------------------------------\n// `depcheck --json` → { dependencies:[], devDependencies:[], missing:{} }.\nexport function parseDepcheck(json) {\n  const findings = [];\n  const push = (name, dev) => findings.push({\n    rule: 'depcheck:unused',\n    severity: 'low',\n    category: 'dead-dependency',\n    message: `Package \"${name}\" is declared in package.json but never imported.`,\n    path: 'package.json',\n    line: 1,\n    excerpt: '',\n    source: 'external',\n    tool: 'depcheck',\n    dev,\n  });\n  for (const name of (json && json.dependencies) || []) push(name, false);\n  for (const name of (json && json.devDependencies) || []) push(name, true);\n  return findings;\n}\n\n// Merge the external passes into one list, keeping the built-in scan's findings\n// untouched. Dedup on (path, line, rule): two engines that flag the same line\n// for the same reason are one problem, not two.\nexport function mergeFindings(...lists) {\n  const seen = new Set();\n  const out = [];\n  for (const list of lists) {\n    for (const f of list || []) {\n      const key = `${f.path}:${f.line}:${f.rule}`;\n      if (seen.has(key)) continue;\n      seen.add(key);\n      out.push(f);\n    }\n  }\n  return out;\n}\n\n"]}

package/server/tools/platform.d.ts

@@ -0,0 +1,9 @@
+export declare function onboarderBinDir(home?: string): string;
+export declare function candidateNames(cmd: any, platform?: NodeJS.Platform, pathext?: string): any[];
+export declare function extraSearchDirs(platform?: NodeJS.Platform, home?: string): string[];
+export declare function splitPath(pathValue: any, platform?: NodeJS.Platform): string[];
+export declare function findOnPath(cmd: any, options?: Record<string, any>): string;
+export declare function spawnArgv(argv: any, platform?: NodeJS.Platform): {
+    command: any;
+    args: any;
+};

package/server/tools/platform.js

@@ -12,80 +12,82 @@
 // Silicon is the classic case — and the folder Onboarder's own installer
 // drops downloaded binaries into, so a tool installed from the GUI is found
 // on the next status check without a server restart.
-
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-
 // Where `install.js` puts binaries it downloads itself (gitleaks on Linux and
 // Windows). One fixed place, under the user's home, never the scanned repo.
 export function onboarderBinDir(home = os.homedir()) {
-  return path.join(home, '.onboarder', 'bin');
+    return path.join(home, '.onboarder', 'bin');
 }
-
 // The names a command can go by on disk. Windows resolves `npm` to the first
 // of `npm.exe`, `npm.cmd`, … on PATHEXT; POSIX looks for the name as-is.
 export function candidateNames(cmd, platform = process.platform, pathext = '') {
-  if (platform !== 'win32') return [cmd];
-  const exts = (pathext || process.env.PATHEXT || '.EXE;.CMD;.BAT;.COM')
-    .split(';').map((e) => e.trim()).filter(Boolean);
-  const lower = cmd.toLowerCase();
-  if (exts.some((e) => lower.endsWith(e.toLowerCase()))) return [cmd];
-  return [cmd, ...exts.map((e) => cmd + e.toLowerCase())];
+    if (platform !== 'win32')
+        return [cmd];
+    const exts = (pathext || process.env.PATHEXT || '.EXE;.CMD;.BAT;.COM')
+        .split(';').map((e) => e.trim()).filter(Boolean);
+    const lower = cmd.toLowerCase();
+    if (exts.some((e) => lower.endsWith(e.toLowerCase())))
+        return [cmd];
+    return [cmd, ...exts.map((e) => cmd + e.toLowerCase())];
 }
-
 // Directories worth checking beyond PATH itself. The Homebrew pair matters on
 // a Mac launched from Spotlight rather than a shell; the Onboarder bin dir is
 // where the GUI installer puts self-downloaded tools.
 export function extraSearchDirs(platform = process.platform, home = os.homedir()) {
-  const dirs = [onboarderBinDir(home)];
-  if (platform === 'darwin') dirs.push('/opt/homebrew/bin', '/usr/local/bin');
-  if (platform === 'linux') dirs.push('/usr/local/bin', path.join(home, '.local', 'bin'));
-  if (platform === 'win32') {
-    const local = process.env.LOCALAPPDATA;
-    if (local) dirs.push(path.join(local, 'Programs', 'Gitleaks'));
-  }
-  return dirs;
+    const dirs = [onboarderBinDir(home)];
+    if (platform === 'darwin')
+        dirs.push('/opt/homebrew/bin', '/usr/local/bin');
+    if (platform === 'linux')
+        dirs.push('/usr/local/bin', path.join(home, '.local', 'bin'));
+    if (platform === 'win32') {
+        const local = process.env.LOCALAPPDATA;
+        if (local)
+            dirs.push(path.join(local, 'Programs', 'Gitleaks'));
+    }
+    return dirs;
 }
-
 // Split a PATH string the way the platform does. Exported for tests.
 export function splitPath(pathValue, platform = process.platform) {
-  return String(pathValue || '')
-    .split(platform === 'win32' ? ';' : ':')
-    .map((d) => d.trim())
-    .filter(Boolean);
+    return String(pathValue || '')
+        .split(platform === 'win32' ? ';' : ':')
+        .map((d) => d.trim())
+        .filter(Boolean);
 }
-
 // Find `cmd` on PATH (plus the extra dirs). Returns the absolute path, or
 // null. Pure apart from the `exists` probe, which defaults to the disk and is
 // injectable so the tests never touch a real filesystem layout.
 export function findOnPath(cmd, options = {}) {
-  const platform = options.platform || process.platform;
-  const envPath = options.envPath !== undefined ? options.envPath : process.env.PATH;
-  const pathext = options.pathext !== undefined ? options.pathext : process.env.PATHEXT;
-  const exists = options.exists || ((p) => fs.existsSync(p));
-  const home = options.home || os.homedir();
-
-  const dirs = [...splitPath(envPath, platform), ...extraSearchDirs(platform, home)];
-  for (const dir of dirs) {
-    for (const name of candidateNames(cmd, platform, pathext)) {
-      const full = path.join(dir, name);
-      try {
-        if (exists(full)) return full;
-      } catch {
-        /* an unreadable dir is just not where the tool lives */
-      }
+    const platform = options.platform || process.platform;
+    const envPath = options.envPath !== undefined ? options.envPath : process.env.PATH;
+    const pathext = options.pathext !== undefined ? options.pathext : process.env.PATHEXT;
+    const exists = options.exists || ((p) => fs.existsSync(p));
+    const home = options.home || os.homedir();
+    const dirs = [...splitPath(envPath, platform), ...extraSearchDirs(platform, home)];
+    for (const dir of dirs) {
+        for (const name of candidateNames(cmd, platform, pathext)) {
+            const full = path.join(dir, name);
+            try {
+                if (exists(full))
+                    return full;
+            }
+            catch {
+                /* an unreadable dir is just not where the tool lives */
+            }
+        }
     }
-  }
-  return null;
+    return null;
 }
-
 // A `.cmd`/`.bat` shim cannot be spawned directly on Windows (Node refuses
 // with EINVAL): it needs cmd.exe. `spawnArgv` rewrites the argv for that case
 // and leaves everything else untouched, so callers keep passing plain arrays.
 export function spawnArgv(argv, platform = process.platform) {
-  if (platform !== 'win32') return { command: argv[0], args: argv.slice(1) };
-  if (!/\.(cmd|bat)$/i.test(argv[0] || '')) return { command: argv[0], args: argv.slice(1) };
-  const quoted = argv.map((a) => `"${String(a).replace(/"/g, '\\"')}"`).join(' ');
-  return { command: 'cmd.exe', args: ['/d', '/s', '/c', quoted] };
+    if (platform !== 'win32')
+        return { command: argv[0], args: argv.slice(1) };
+    if (!/\.(cmd|bat)$/i.test(argv[0] || ''))
+        return { command: argv[0], args: argv.slice(1) };
+    const quoted = argv.map((a) => `"${String(a).replace(/"/g, '\\"')}"`).join(' ');
+    return { command: 'cmd.exe', args: ['/d', '/s', '/c', quoted] };
 }
+//# sourceMappingURL=platform.js.map

package/server/tools/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/server/tools/platform.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,qDAAqD;AAErD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG,EAAE;IAC3E,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC;SACnE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE;IAC9E,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACvC,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAC9D,OAAO,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;SAC3B,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,8EAA8E;AAC9E,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,GAAG,EAAE,OAAO,GAAwB,EAAE;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACtF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAE1C,MAAM,IAAI,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACnF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACzD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC","sourcesContent":["// Cross-platform binary lookup.\n//\n// The engine used to ask the Unix `which` command where a tool lives. That is\n// the right answer on macOS and Linux and *no* answer on Windows, where the\n// command is `where` and an npm-installed tool is a `npm.cmd` shim, not an\n// ELF file. Doing the lookup by hand — split PATH, try the PATHEXT suffixes\n// on Windows — keeps one code path for all three platforms, keeps it testable\n// (`exists` is injectable), and removes a spawned process from detection.\n//\n// `findOnPath` also checks a couple of well-known directories that are on a\n// user's interactive PATH but often not on the server's — Homebrew on Apple\n// Silicon is the classic case — and the folder Onboarder's own installer\n// drops downloaded binaries into, so a tool installed from the GUI is found\n// on the next status check without a server restart.\n\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\n// Where `install.js` puts binaries it downloads itself (gitleaks on Linux and\n// Windows). One fixed place, under the user's home, never the scanned repo.\nexport function onboarderBinDir(home = os.homedir()) {\n  return path.join(home, '.onboarder', 'bin');\n}\n\n// The names a command can go by on disk. Windows resolves `npm` to the first\n// of `npm.exe`, `npm.cmd`, … on PATHEXT; POSIX looks for the name as-is.\nexport function candidateNames(cmd, platform = process.platform, pathext = '') {\n  if (platform !== 'win32') return [cmd];\n  const exts = (pathext || process.env.PATHEXT || '.EXE;.CMD;.BAT;.COM')\n    .split(';').map((e) => e.trim()).filter(Boolean);\n  const lower = cmd.toLowerCase();\n  if (exts.some((e) => lower.endsWith(e.toLowerCase()))) return [cmd];\n  return [cmd, ...exts.map((e) => cmd + e.toLowerCase())];\n}\n\n// Directories worth checking beyond PATH itself. The Homebrew pair matters on\n// a Mac launched from Spotlight rather than a shell; the Onboarder bin dir is\n// where the GUI installer puts self-downloaded tools.\nexport function extraSearchDirs(platform = process.platform, home = os.homedir()) {\n  const dirs = [onboarderBinDir(home)];\n  if (platform === 'darwin') dirs.push('/opt/homebrew/bin', '/usr/local/bin');\n  if (platform === 'linux') dirs.push('/usr/local/bin', path.join(home, '.local', 'bin'));\n  if (platform === 'win32') {\n    const local = process.env.LOCALAPPDATA;\n    if (local) dirs.push(path.join(local, 'Programs', 'Gitleaks'));\n  }\n  return dirs;\n}\n\n// Split a PATH string the way the platform does. Exported for tests.\nexport function splitPath(pathValue, platform = process.platform) {\n  return String(pathValue || '')\n    .split(platform === 'win32' ? ';' : ':')\n    .map((d) => d.trim())\n    .filter(Boolean);\n}\n\n// Find `cmd` on PATH (plus the extra dirs). Returns the absolute path, or\n// null. Pure apart from the `exists` probe, which defaults to the disk and is\n// injectable so the tests never touch a real filesystem layout.\nexport function findOnPath(cmd, options: Record<string, any> = {}) {\n  const platform = options.platform || process.platform;\n  const envPath = options.envPath !== undefined ? options.envPath : process.env.PATH;\n  const pathext = options.pathext !== undefined ? options.pathext : process.env.PATHEXT;\n  const exists = options.exists || ((p) => fs.existsSync(p));\n  const home = options.home || os.homedir();\n\n  const dirs = [...splitPath(envPath, platform), ...extraSearchDirs(platform, home)];\n  for (const dir of dirs) {\n    for (const name of candidateNames(cmd, platform, pathext)) {\n      const full = path.join(dir, name);\n      try {\n        if (exists(full)) return full;\n      } catch {\n        /* an unreadable dir is just not where the tool lives */\n      }\n    }\n  }\n  return null;\n}\n\n// A `.cmd`/`.bat` shim cannot be spawned directly on Windows (Node refuses\n// with EINVAL): it needs cmd.exe. `spawnArgv` rewrites the argv for that case\n// and leaves everything else untouched, so callers keep passing plain arrays.\nexport function spawnArgv(argv, platform = process.platform) {\n  if (platform !== 'win32') return { command: argv[0], args: argv.slice(1) };\n  if (!/\\.(cmd|bat)$/i.test(argv[0] || '')) return { command: argv[0], args: argv.slice(1) };\n  const quoted = argv.map((a) => `\"${String(a).replace(/\"/g, '\\\\\"')}\"`).join(' ');\n  return { command: 'cmd.exe', args: ['/d', '/s', '/c', quoted] };\n}\n"]}

package/server/tools/registry.d.ts

@@ -0,0 +1,137 @@
+export declare const TOOL_DEFS: ({
+    id: string;
+    label: string;
+    kind: string;
+    purpose: string;
+    commands: ({
+        kind: string;
+        bin: string;
+        pkg?: undefined;
+    } | {
+        kind: string;
+        pkg: string;
+        bin: string;
+    })[];
+    install: string[];
+    options: {
+        key: string;
+        label: string;
+        type: string;
+        values: string[];
+        default: string;
+        hint: string;
+    }[];
+    argv: (root: any, options?: Record<string, any>) => any[];
+    parse: (text: any, root: any) => any[];
+    usesReportFile?: undefined;
+    textOutput?: undefined;
+    cwd?: undefined;
+} | {
+    id: string;
+    label: string;
+    kind: string;
+    purpose: string;
+    commands: {
+        kind: string;
+        bin: string;
+    }[];
+    install: string[];
+    options: {
+        key: string;
+        label: string;
+        type: string;
+        default: boolean;
+        hint: string;
+    }[];
+    usesReportFile: boolean;
+    argv: (root: any, options?: Record<string, any>, ctx?: Record<string, any>) => any[];
+    parse: (text: any, root: any) => any[];
+    textOutput?: undefined;
+    cwd?: undefined;
+} | {
+    usesReportFile?: undefined;
+    id: string;
+    label: string;
+    kind: string;
+    purpose: string;
+    commands: ({
+        pkg?: undefined;
+        kind: string;
+        bin: string;
+    } | {
+        bin?: undefined;
+        kind: string;
+        pkg: string;
+    })[];
+    install: string[];
+    options: {
+        key: string;
+        label: string;
+        type: string;
+        values: string[];
+        default: any[];
+        hint: string;
+    }[];
+    argv: (root: any, options?: Record<string, any>) => any[];
+    parse: (text: any, root: any) => any[];
+    textOutput?: undefined;
+    cwd?: undefined;
+} | {
+    usesReportFile?: undefined;
+    id: string;
+    label: string;
+    kind: string;
+    purpose: string;
+    commands: ({
+        pkg?: undefined;
+        kind: string;
+        bin: string;
+    } | {
+        kind: string;
+        pkg: string;
+        bin: string;
+    })[];
+    install: string[];
+    options: {
+        key: string;
+        label: string;
+        type: string;
+        min: number;
+        max: number;
+        default: number;
+        hint: string;
+    }[];
+    argv: (root: any, options?: Record<string, any>) => any[];
+    parse: (text: any, root: any) => any[];
+    textOutput: boolean;
+    cwd?: undefined;
+} | {
+    usesReportFile?: undefined;
+    textOutput?: undefined;
+    id: string;
+    label: string;
+    kind: string;
+    purpose: string;
+    commands: ({
+        pkg?: undefined;
+        kind: string;
+        bin: string;
+    } | {
+        bin?: undefined;
+        kind: string;
+        pkg: string;
+    })[];
+    install: string[];
+    options: {
+        key: string;
+        label: string;
+        type: string;
+        default: boolean;
+        hint: string;
+    }[];
+    argv: (root: any, options?: Record<string, any>) => string[];
+    cwd: boolean;
+    parse: (text: any) => any[];
+})[];
+export declare function sanitizeOptions(def: any, raw: any): Record<string, any>;
+export declare function defaultOptions(def: any): Record<string, any>;