codebase-onboarder 0.5.0 → 0.7.0

package/server/tools/registry.js

@@ -4,209 +4,210 @@
 // every entry is well-formed, and the UI renders it as the "available tools"
 // list. A new analyzer is a new entry here and a new parser in `parse.js`;
 // nothing else should have to know about it.
-
 import os from 'node:os';
 import path from 'node:path';
-
-import {
-  parseDepcheck, parseGitleaks, parseKnip, parseSemgrep, parseVulture,
-} from './parse.js';
-
+import { parseDepcheck, parseGitleaks, parseKnip, parseSemgrep, parseVulture, } from './parse.js';
 // `rel` turns a tool's absolute path into the repo-relative path the whole app
 // uses. Tools report paths rooted wherever they ran from.
 const makeRel = (root) => (p) => {
-  const s = String(p || '');
-  const win = s.startsWith(root + '\\') ? s.slice(root.length + 1) : null;
-  if (win) return win.replace(/\\/g, '/');
-  return s.startsWith(root + '/') ? s.slice(root.length + 1) : s.replace(/^[/\\]+/, '');
+    const s = String(p || '');
+    const win = s.startsWith(root + '\\') ? s.slice(root.length + 1) : null;
+    if (win)
+        return win.replace(/\\/g, '/');
+    return s.startsWith(root + '/') ? s.slice(root.length + 1) : s.replace(/^[/\\]+/, '');
 };
-
 // Gitleaks writes its JSON to a *file* (`--report-path`); the old code pointed
 // that at `/dev/stdout`, a path Windows does not have. Every run gets a real
 // temp file instead, which `scan.js` reads and removes afterwards.
 function defaultReportPath() {
-  return path.join(os.tmpdir(), `onboarder-gitleaks-${process.pid}.json`);
+    return path.join(os.tmpdir(), `onboarder-gitleaks-${process.pid}.json`);
 }
-
 // The options schema is data for two consumers. The GUI renders it as a small
 // per-engine form (select, checkbox, number) so a person can use what each
 // tool actually offers without a terminal; the server's `sanitizeOptions`
 // walks the same list and drops anything else, so an option the registry does
 // not declare can never reach a command line.
-
 export const TOOL_DEFS = [
-  {
-    id: 'semgrep',
-    label: 'Semgrep',
-    kind: 'security',
-    purpose: 'Deep static analysis — injection, crypto, auth — across 30+ languages.',
-    commands: [
-      { kind: 'direct', bin: 'semgrep' },
-      { kind: 'direct', bin: 'opengrep' }, // the OSS fork, drop-in compatible
-      { kind: 'uvx', pkg: 'semgrep', bin: 'semgrep' },
-    ],
-    install: ['Install with: pip install semgrep  (or: brew install semgrep, or uv tool install semgrep).'],
-    options: [
-      {
-        key: 'config', label: 'Rule set', type: 'enum',
-        values: ['p/default', 'p/security-audit', 'p/secrets', 'p/ci', 'auto'],
-        default: 'p/default',
-        hint: '“auto” downloads the recommended set — it needs network access.',
-      },
-      {
-        key: 'severity', label: 'Minimum severity', type: 'enum',
-        values: ['all', 'WARNING', 'ERROR'],
-        default: 'all',
-        hint: 'ERROR only keeps the findings Semgrep itself calls errors.',
-      },
-    ],
-    // `--config auto` needs network; the offline path is `--config p/default`.
-    // We run offline by default: self-host means the box may not be online.
-    argv: (root, options = {}) => {
-      const args = ['scan', '--json', '--quiet', '--no-git-ignore', '--timeout', '60',
-        '--config', options.config || 'p/default'];
-      if (options.severity === 'WARNING') args.push('--severity', 'WARNING', '--severity', 'ERROR');
-      if (options.severity === 'ERROR') args.push('--severity', 'ERROR');
-      args.push(root);
-      return args;
+    {
+        id: 'semgrep',
+        label: 'Semgrep',
+        kind: 'security',
+        purpose: 'Deep static analysis — injection, crypto, auth — across 30+ languages.',
+        commands: [
+            { kind: 'direct', bin: 'semgrep' },
+            { kind: 'direct', bin: 'opengrep' }, // the OSS fork, drop-in compatible
+            { kind: 'uvx', pkg: 'semgrep', bin: 'semgrep' },
+        ],
+        install: ['Install with: pip install semgrep  (or: brew install semgrep, or uv tool install semgrep).'],
+        options: [
+            {
+                key: 'config', label: 'Rule set', type: 'enum',
+                values: ['p/default', 'p/security-audit', 'p/secrets', 'p/ci', 'auto'],
+                default: 'p/default',
+                hint: '“auto” downloads the recommended set — it needs network access.',
+            },
+            {
+                key: 'severity', label: 'Minimum severity', type: 'enum',
+                values: ['all', 'WARNING', 'ERROR'],
+                default: 'all',
+                hint: 'ERROR only keeps the findings Semgrep itself calls errors.',
+            },
+        ],
+        // `--config auto` needs network; the offline path is `--config p/default`.
+        // We run offline by default: self-host means the box may not be online.
+        argv: (root, options = {}) => {
+            const args = ['scan', '--json', '--quiet', '--no-git-ignore', '--timeout', '60',
+                '--config', options.config || 'p/default'];
+            if (options.severity === 'WARNING')
+                args.push('--severity', 'WARNING', '--severity', 'ERROR');
+            if (options.severity === 'ERROR')
+                args.push('--severity', 'ERROR');
+            args.push(root);
+            return args;
+        },
+        parse: (text, root) => parseSemgrep(JSON.parse(text), makeRel(root)),
     },
-    parse: (text, root) => parseSemgrep(JSON.parse(text), makeRel(root)),
-  },
-  {
-    id: 'gitleaks',
-    label: 'Gitleaks',
-    kind: 'security',
-    purpose: 'Secrets — committed keys, tokens, private keys.',
-    commands: [{ kind: 'direct', bin: 'gitleaks' }],
-    install: ['Install with: brew install gitleaks  (or download the binary from its GitHub releases).'],
-    options: [
-      {
-        key: 'history', label: 'Scan git history too', type: 'boolean',
-        default: false,
-        hint: 'Slower, but finds secrets that were committed and later deleted.',
-      },
-      {
-        key: 'redact', label: 'Redact secrets in output', type: 'boolean',
-        default: true,
-        hint: 'The parser never relays a secret either way; this hides it in the raw report too.',
-      },
-    ],
-    usesReportFile: true,
-    argv: (root, options = {}, ctx = {}) => {
-      const args = ['detect', '--source', root,
-        '--report-format', 'json', '--report-path', ctx.reportPath || defaultReportPath(),
-        '--exit-code', '0'];
-      if (!options.history) args.push('--no-git');
-      if (options.redact !== false) args.push('--redact');
-      return args;
+    {
+        id: 'gitleaks',
+        label: 'Gitleaks',
+        kind: 'security',
+        purpose: 'Secrets — committed keys, tokens, private keys.',
+        commands: [{ kind: 'direct', bin: 'gitleaks' }],
+        install: ['Install with: brew install gitleaks  (or download the binary from its GitHub releases).'],
+        options: [
+            {
+                key: 'history', label: 'Scan git history too', type: 'boolean',
+                default: false,
+                hint: 'Slower, but finds secrets that were committed and later deleted.',
+            },
+            {
+                key: 'redact', label: 'Redact secrets in output', type: 'boolean',
+                default: true,
+                hint: 'The parser never relays a secret either way; this hides it in the raw report too.',
+            },
+        ],
+        usesReportFile: true,
+        argv: (root, options = {}, ctx = {}) => {
+            const args = ['detect', '--source', root,
+                '--report-format', 'json', '--report-path', ctx.reportPath || defaultReportPath(),
+                '--exit-code', '0'];
+            if (!options.history)
+                args.push('--no-git');
+            if (options.redact !== false)
+                args.push('--redact');
+            return args;
+        },
+        parse: (text, root) => parseGitleaks(JSON.parse(text), makeRel(root)),
     },
-    parse: (text, root) => parseGitleaks(JSON.parse(text), makeRel(root)),
-  },
-  {
-    id: 'knip',
-    label: 'Knip',
-    kind: 'dead-code',
-    purpose: 'Dead code for JS/TS — unused files, exports and dependencies.',
-    commands: [
-      { kind: 'direct', bin: 'knip' },
-      { kind: 'npx', pkg: 'knip' },
-    ],
-    install: ['Install with: npm install -g knip  (or run it through npx, which this will do for you).'],
-    options: [
-      {
-        key: 'include', label: 'Issue types', type: 'multi',
-        values: ['files', 'dependencies', 'exports', 'types', 'duplicates'],
-        default: [],
-        hint: 'Nothing checked means Knip reports every kind it knows.',
-      },
-    ],
-    argv: (root, options = {}) => {
-      const args = ['--reporter', 'json', '--directory', root, '--no-progress'];
-      const include = Array.isArray(options.include) ? options.include.filter(Boolean) : [];
-      if (include.length) args.push('--include', include.join(','));
-      return args;
+    {
+        id: 'knip',
+        label: 'Knip',
+        kind: 'dead-code',
+        purpose: 'Dead code for JS/TS — unused files, exports and dependencies.',
+        commands: [
+            { kind: 'direct', bin: 'knip' },
+            { kind: 'npx', pkg: 'knip' },
+        ],
+        install: ['Install with: npm install -g knip  (or run it through npx, which this will do for you).'],
+        options: [
+            {
+                key: 'include', label: 'Issue types', type: 'multi',
+                values: ['files', 'dependencies', 'exports', 'types', 'duplicates'],
+                default: [],
+                hint: 'Nothing checked means Knip reports every kind it knows.',
+            },
+        ],
+        argv: (root, options = {}) => {
+            const args = ['--reporter', 'json', '--directory', root, '--no-progress'];
+            const include = Array.isArray(options.include) ? options.include.filter(Boolean) : [];
+            if (include.length)
+                args.push('--include', include.join(','));
+            return args;
+        },
+        parse: (text, root) => parseKnip(JSON.parse(text), makeRel(root)),
     },
-    parse: (text, root) => parseKnip(JSON.parse(text), makeRel(root)),
-  },
-  {
-    id: 'vulture',
-    label: 'Vulture',
-    kind: 'dead-code',
-    purpose: 'Dead code for Python — unused functions, classes, variables.',
-    commands: [
-      { kind: 'direct', bin: 'vulture' },
-      { kind: 'uvx', pkg: 'vulture', bin: 'vulture' },
-    ],
-    install: ['Install with: pip install vulture  (or run it through uvx, which this will do for you).'],
-    options: [
-      {
-        key: 'minConfidence', label: 'Minimum confidence (%)', type: 'number',
-        min: 1, max: 100, default: 60,
-        hint: 'Lower finds more, and guesses more. 60 is Vulture’s own default.',
-      },
-    ],
-    argv: (root, options = {}) => {
-      const n = Number(options.minConfidence);
-      const confidence = Number.isFinite(n) ? Math.min(100, Math.max(1, Math.round(n))) : 60;
-      return [root, '--min-confidence', String(confidence)];
+    {
+        id: 'vulture',
+        label: 'Vulture',
+        kind: 'dead-code',
+        purpose: 'Dead code for Python — unused functions, classes, variables.',
+        commands: [
+            { kind: 'direct', bin: 'vulture' },
+            { kind: 'uvx', pkg: 'vulture', bin: 'vulture' },
+        ],
+        install: ['Install with: pip install vulture  (or run it through uvx, which this will do for you).'],
+        options: [
+            {
+                key: 'minConfidence', label: 'Minimum confidence (%)', type: 'number',
+                min: 1, max: 100, default: 60,
+                hint: 'Lower finds more, and guesses more. 60 is Vulture’s own default.',
+            },
+        ],
+        argv: (root, options = {}) => {
+            const n = Number(options.minConfidence);
+            const confidence = Number.isFinite(n) ? Math.min(100, Math.max(1, Math.round(n))) : 60;
+            return [root, '--min-confidence', String(confidence)];
+        },
+        parse: (text, root) => parseVulture(text, makeRel(root)),
+        textOutput: true,
     },
-    parse: (text, root) => parseVulture(text, makeRel(root)),
-    textOutput: true,
-  },
-  {
-    id: 'depcheck',
-    label: 'Depcheck',
-    kind: 'dead-code',
-    purpose: 'Unused npm dependencies (a narrower, faster slice of Knip).',
-    commands: [
-      { kind: 'direct', bin: 'depcheck' },
-      { kind: 'npx', pkg: 'depcheck' },
-    ],
-    install: ['Install with: npm install -g depcheck  (or run it through npx).'],
-    options: [
-      {
-        key: 'skipMissing', label: 'Skip “missing from package.json” reports', type: 'boolean',
-        default: false,
-        hint: 'Useful when imports are resolved by a bundler depcheck cannot see.',
-      },
-    ],
-    argv: (root, options = {}) => {
-      const args = ['--json'];
-      if (options.skipMissing) args.push('--skip-missing=true');
-      return args;
+    {
+        id: 'depcheck',
+        label: 'Depcheck',
+        kind: 'dead-code',
+        purpose: 'Unused npm dependencies (a narrower, faster slice of Knip).',
+        commands: [
+            { kind: 'direct', bin: 'depcheck' },
+            { kind: 'npx', pkg: 'depcheck' },
+        ],
+        install: ['Install with: npm install -g depcheck  (or run it through npx).'],
+        options: [
+            {
+                key: 'skipMissing', label: 'Skip “missing from package.json” reports', type: 'boolean',
+                default: false,
+                hint: 'Useful when imports are resolved by a bundler depcheck cannot see.',
+            },
+        ],
+        argv: (root, options = {}) => {
+            const args = ['--json'];
+            if (options.skipMissing)
+                args.push('--skip-missing=true');
+            return args;
+        },
+        cwd: true, // depcheck reads the package.json in its working directory
+        parse: (text) => parseDepcheck(JSON.parse(text)),
     },
-    cwd: true, // depcheck reads the package.json in its working directory
-    parse: (text) => parseDepcheck(JSON.parse(text)),
-  },
 ];
-
 // Turn a raw `options` object from a request body into one the registry
 // trusts: only declared keys, values coerced to the declared type, enum and
 // multi values restricted to the declared lists. Anything else falls back to
 // the default — the GUI sends well-formed values, and anything else is noise.
 export function sanitizeOptions(def, raw) {
-  const clean = {};
-  const input = raw && typeof raw === 'object' ? raw : {};
-  for (const opt of def.options || []) {
-    const value = input[opt.key];
-    if (opt.type === 'boolean') {
-      clean[opt.key] = value === undefined ? opt.default : Boolean(value);
-    } else if (opt.type === 'enum') {
-      clean[opt.key] = opt.values.includes(value) ? value : opt.default;
-    } else if (opt.type === 'multi') {
-      clean[opt.key] = Array.isArray(value) ? value.filter((v) => opt.values.includes(v)) : [...opt.default];
-    } else if (opt.type === 'number') {
-      const n = Number(value);
-      clean[opt.key] = Number.isFinite(n)
-        ? Math.min(opt.max, Math.max(opt.min, Math.round(n)))
-        : opt.default;
+    const clean = {};
+    const input = raw && typeof raw === 'object' ? raw : {};
+    for (const opt of def.options || []) {
+        const value = input[opt.key];
+        if (opt.type === 'boolean') {
+            clean[opt.key] = value === undefined ? opt.default : Boolean(value);
+        }
+        else if (opt.type === 'enum') {
+            clean[opt.key] = opt.values.includes(value) ? value : opt.default;
+        }
+        else if (opt.type === 'multi') {
+            clean[opt.key] = Array.isArray(value) ? value.filter((v) => opt.values.includes(v)) : [...opt.default];
+        }
+        else if (opt.type === 'number') {
+            const n = Number(value);
+            clean[opt.key] = Number.isFinite(n)
+                ? Math.min(opt.max, Math.max(opt.min, Math.round(n)))
+                : opt.default;
+        }
     }
-  }
-  return clean;
+    return clean;
 }
-
 // The schema with every default filled in — what the GUI renders before the
 // person touches anything.
 export function defaultOptions(def) {
-  return sanitizeOptions(def, {});
+    return sanitizeOptions(def, {});
 }
+//# sourceMappingURL=registry.js.map

package/server/tools/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/server/tools/registry.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,6CAA6C;AAE7C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,GACpE,MAAM,YAAY,CAAC;AAEpB,+EAA+E;AAC/E,0DAA0D;AAC1D,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC,CAAC;AAEF,+EAA+E;AAC/E,6EAA6E;AAC7E,mEAAmE;AACnE,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,8CAA8C;AAE9C,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,wEAAwE;QACjF,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;YAClC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,mCAAmC;YACxE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE;SAChD;QACD,OAAO,EAAE,CAAC,4FAA4F,CAAC;QACvG,OAAO,EAAE;YACP;gBACE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM;gBAC9C,MAAM,EAAE,CAAC,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC;gBACtE,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,iEAAiE;aACxE;YACD;gBACE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM;gBACxD,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC;gBACnC,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,4DAA4D;aACnE;SACF;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,GAAwB,EAAE,EAAE,EAAE;YAChD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI;gBAC7E,UAAU,EAAE,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;YAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAC9F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;KACrE;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,iDAAiD;QAC1D,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAC/C,OAAO,EAAE,CAAC,yFAAyF,CAAC;QACpG,OAAO,EAAE;YACP;gBACE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS;gBAC9D,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,kEAAkE;aACzE;YACD;gBACE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,SAAS;gBACjE,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,mFAAmF;aAC1F;SACF;QACD,cAAc,EAAE,IAAI;QACpB,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,GAAwB,EAAE,EAAE,GAAG,GAAwB,EAAE,EAAE,EAAE;YAC/E,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI;gBACtC,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,UAAU,IAAI,iBAAiB,EAAE;gBACjF,aAAa,EAAE,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;KACtE;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,+DAA+D;QACxE,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE;YAC/B,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;SAC7B;QACD,OAAO,EAAE,CAAC,yFAAyF,CAAC;QACpG,OAAO,EAAE;YACP;gBACE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO;gBACnD,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC;gBACnE,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,yDAAyD;aAChE;SACF;QACD,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,GAAwB,EAAE,EAAE,EAAE;YAChD,MAAM,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,IAAI,OAAO,CAAC,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;KAClE;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,8DAA8D;QACvE,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;YAClC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE;SAChD;QACD,OAAO,EAAE,CAAC,yFAAyF,CAAC;QACpG,OAAO,EAAE;YACP;gBACE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,QAAQ;gBACrE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;gBAC7B,IAAI,EAAE,kEAAkE;aACzE;SACF;QACD,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,GAAwB,EAAE,EAAE,EAAE;YAChD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,OAAO,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,UAAU,EAAE,IAAI;KACjB;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,6DAA6D;QACtE,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE;YACnC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;SACjC;QACD,OAAO,EAAE,CAAC,iEAAiE,CAAC;QAC5E,OAAO,EAAE;YACP;gBACE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,0CAA0C,EAAE,IAAI,EAAE,SAAS;gBACtF,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,oEAAoE;aAC3E;SACF;QACD,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,GAAwB,EAAE,EAAE,EAAE;YAChD,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,IAAI,OAAO,CAAC,WAAW;gBAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,EAAE,IAAI,EAAE,2DAA2D;QACtE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;KACjD;CACF,CAAC;AAEF,wEAAwE;AACxE,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,GAAG,EAAE,GAAG;IACtC,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/B,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACpE,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACzG,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,2BAA2B;AAC3B,MAAM,UAAU,cAAc,CAAC,GAAG;IAChC,OAAO,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC","sourcesContent":["// The registry: what each engine is for, where to find it, and how to run it.\n//\n// This is data, deliberately — the engine in `tools.js` walks it and asserts\n// every entry is well-formed, and the UI renders it as the \"available tools\"\n// list. A new analyzer is a new entry here and a new parser in `parse.js`;\n// nothing else should have to know about it.\n\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport {\n  parseDepcheck, parseGitleaks, parseKnip, parseSemgrep, parseVulture,\n} from './parse.js';\n\n// `rel` turns a tool's absolute path into the repo-relative path the whole app\n// uses. Tools report paths rooted wherever they ran from.\nconst makeRel = (root) => (p) => {\n  const s = String(p || '');\n  const win = s.startsWith(root + '\\\\') ? s.slice(root.length + 1) : null;\n  if (win) return win.replace(/\\\\/g, '/');\n  return s.startsWith(root + '/') ? s.slice(root.length + 1) : s.replace(/^[/\\\\]+/, '');\n};\n\n// Gitleaks writes its JSON to a *file* (`--report-path`); the old code pointed\n// that at `/dev/stdout`, a path Windows does not have. Every run gets a real\n// temp file instead, which `scan.js` reads and removes afterwards.\nfunction defaultReportPath() {\n  return path.join(os.tmpdir(), `onboarder-gitleaks-${process.pid}.json`);\n}\n\n// The options schema is data for two consumers. The GUI renders it as a small\n// per-engine form (select, checkbox, number) so a person can use what each\n// tool actually offers without a terminal; the server's `sanitizeOptions`\n// walks the same list and drops anything else, so an option the registry does\n// not declare can never reach a command line.\n\nexport const TOOL_DEFS = [\n  {\n    id: 'semgrep',\n    label: 'Semgrep',\n    kind: 'security',\n    purpose: 'Deep static analysis — injection, crypto, auth — across 30+ languages.',\n    commands: [\n      { kind: 'direct', bin: 'semgrep' },\n      { kind: 'direct', bin: 'opengrep' }, // the OSS fork, drop-in compatible\n      { kind: 'uvx', pkg: 'semgrep', bin: 'semgrep' },\n    ],\n    install: ['Install with: pip install semgrep  (or: brew install semgrep, or uv tool install semgrep).'],\n    options: [\n      {\n        key: 'config', label: 'Rule set', type: 'enum',\n        values: ['p/default', 'p/security-audit', 'p/secrets', 'p/ci', 'auto'],\n        default: 'p/default',\n        hint: '“auto” downloads the recommended set — it needs network access.',\n      },\n      {\n        key: 'severity', label: 'Minimum severity', type: 'enum',\n        values: ['all', 'WARNING', 'ERROR'],\n        default: 'all',\n        hint: 'ERROR only keeps the findings Semgrep itself calls errors.',\n      },\n    ],\n    // `--config auto` needs network; the offline path is `--config p/default`.\n    // We run offline by default: self-host means the box may not be online.\n    argv: (root, options: Record<string, any> = {}) => {\n      const args = ['scan', '--json', '--quiet', '--no-git-ignore', '--timeout', '60',\n        '--config', options.config || 'p/default'];\n      if (options.severity === 'WARNING') args.push('--severity', 'WARNING', '--severity', 'ERROR');\n      if (options.severity === 'ERROR') args.push('--severity', 'ERROR');\n      args.push(root);\n      return args;\n    },\n    parse: (text, root) => parseSemgrep(JSON.parse(text), makeRel(root)),\n  },\n  {\n    id: 'gitleaks',\n    label: 'Gitleaks',\n    kind: 'security',\n    purpose: 'Secrets — committed keys, tokens, private keys.',\n    commands: [{ kind: 'direct', bin: 'gitleaks' }],\n    install: ['Install with: brew install gitleaks  (or download the binary from its GitHub releases).'],\n    options: [\n      {\n        key: 'history', label: 'Scan git history too', type: 'boolean',\n        default: false,\n        hint: 'Slower, but finds secrets that were committed and later deleted.',\n      },\n      {\n        key: 'redact', label: 'Redact secrets in output', type: 'boolean',\n        default: true,\n        hint: 'The parser never relays a secret either way; this hides it in the raw report too.',\n      },\n    ],\n    usesReportFile: true,\n    argv: (root, options: Record<string, any> = {}, ctx: Record<string, any> = {}) => {\n      const args = ['detect', '--source', root,\n        '--report-format', 'json', '--report-path', ctx.reportPath || defaultReportPath(),\n        '--exit-code', '0'];\n      if (!options.history) args.push('--no-git');\n      if (options.redact !== false) args.push('--redact');\n      return args;\n    },\n    parse: (text, root) => parseGitleaks(JSON.parse(text), makeRel(root)),\n  },\n  {\n    id: 'knip',\n    label: 'Knip',\n    kind: 'dead-code',\n    purpose: 'Dead code for JS/TS — unused files, exports and dependencies.',\n    commands: [\n      { kind: 'direct', bin: 'knip' },\n      { kind: 'npx', pkg: 'knip' },\n    ],\n    install: ['Install with: npm install -g knip  (or run it through npx, which this will do for you).'],\n    options: [\n      {\n        key: 'include', label: 'Issue types', type: 'multi',\n        values: ['files', 'dependencies', 'exports', 'types', 'duplicates'],\n        default: [],\n        hint: 'Nothing checked means Knip reports every kind it knows.',\n      },\n    ],\n    argv: (root, options: Record<string, any> = {}) => {\n      const args = ['--reporter', 'json', '--directory', root, '--no-progress'];\n      const include = Array.isArray(options.include) ? options.include.filter(Boolean) : [];\n      if (include.length) args.push('--include', include.join(','));\n      return args;\n    },\n    parse: (text, root) => parseKnip(JSON.parse(text), makeRel(root)),\n  },\n  {\n    id: 'vulture',\n    label: 'Vulture',\n    kind: 'dead-code',\n    purpose: 'Dead code for Python — unused functions, classes, variables.',\n    commands: [\n      { kind: 'direct', bin: 'vulture' },\n      { kind: 'uvx', pkg: 'vulture', bin: 'vulture' },\n    ],\n    install: ['Install with: pip install vulture  (or run it through uvx, which this will do for you).'],\n    options: [\n      {\n        key: 'minConfidence', label: 'Minimum confidence (%)', type: 'number',\n        min: 1, max: 100, default: 60,\n        hint: 'Lower finds more, and guesses more. 60 is Vulture’s own default.',\n      },\n    ],\n    argv: (root, options: Record<string, any> = {}) => {\n      const n = Number(options.minConfidence);\n      const confidence = Number.isFinite(n) ? Math.min(100, Math.max(1, Math.round(n))) : 60;\n      return [root, '--min-confidence', String(confidence)];\n    },\n    parse: (text, root) => parseVulture(text, makeRel(root)),\n    textOutput: true,\n  },\n  {\n    id: 'depcheck',\n    label: 'Depcheck',\n    kind: 'dead-code',\n    purpose: 'Unused npm dependencies (a narrower, faster slice of Knip).',\n    commands: [\n      { kind: 'direct', bin: 'depcheck' },\n      { kind: 'npx', pkg: 'depcheck' },\n    ],\n    install: ['Install with: npm install -g depcheck  (or run it through npx).'],\n    options: [\n      {\n        key: 'skipMissing', label: 'Skip “missing from package.json” reports', type: 'boolean',\n        default: false,\n        hint: 'Useful when imports are resolved by a bundler depcheck cannot see.',\n      },\n    ],\n    argv: (root, options: Record<string, any> = {}) => {\n      const args = ['--json'];\n      if (options.skipMissing) args.push('--skip-missing=true');\n      return args;\n    },\n    cwd: true, // depcheck reads the package.json in its working directory\n    parse: (text) => parseDepcheck(JSON.parse(text)),\n  },\n];\n\n// Turn a raw `options` object from a request body into one the registry\n// trusts: only declared keys, values coerced to the declared type, enum and\n// multi values restricted to the declared lists. Anything else falls back to\n// the default — the GUI sends well-formed values, and anything else is noise.\nexport function sanitizeOptions(def, raw) {\n  const clean: Record<string, any> = {};\n  const input = raw && typeof raw === 'object' ? raw : {};\n  for (const opt of def.options || []) {\n    const value = input[opt.key];\n    if (opt.type === 'boolean') {\n      clean[opt.key] = value === undefined ? opt.default : Boolean(value);\n    } else if (opt.type === 'enum') {\n      clean[opt.key] = opt.values.includes(value) ? value : opt.default;\n    } else if (opt.type === 'multi') {\n      clean[opt.key] = Array.isArray(value) ? value.filter((v) => opt.values.includes(v)) : [...opt.default];\n    } else if (opt.type === 'number') {\n      const n = Number(value);\n      clean[opt.key] = Number.isFinite(n)\n        ? Math.min(opt.max, Math.max(opt.min, Math.round(n)))\n        : opt.default;\n    }\n  }\n  return clean;\n}\n\n// The schema with every default filled in — what the GUI renders before the\n// person touches anything.\nexport function defaultOptions(def) {\n  return sanitizeOptions(def, {});\n}\n"]}

package/server/tools/scan.d.ts

@@ -0,0 +1,34 @@
+export declare function toolsStatus(): Record<string, any>;
+export declare function runExternalAnalysis(root: any, options?: Record<string, any>): Promise<{
+    ms: number;
+    passes: ({
+        id: any;
+        label: any;
+        ok: boolean;
+        available: boolean;
+        findings: any[];
+        reason: any;
+        source: string;
+        tool: any;
+    } | {
+        id: any;
+        label: any;
+        kind: any;
+        ok: boolean;
+        available: boolean;
+        findings: any;
+        source: string;
+        tool: any;
+        how: any;
+        ms: number;
+    })[];
+    findings: any[];
+    ranCount: number;
+    totalTools: number;
+    unavailable: {
+        id: any;
+        label: any;
+        reason: any;
+    }[];
+    source: string;
+}>;