codebase-onboarder 0.6.0 → 0.7.0

package/public/js/analysisReport.js

@@ -13,142 +13,137 @@
 //   * What survives a filter? Severity, engine and free text, applied as one
 //     predicate so the counts above and the table below can never disagree
 //     about what is being shown.
-
 export const SEV_ORDER = ['critical', 'high', 'medium', 'low', 'info'];
-
 export function sevRank(severity) {
-  const at = SEV_ORDER.indexOf(severity);
-  return at === -1 ? SEV_ORDER.length : at;
+    const at = SEV_ORDER.indexOf(severity);
+    return at === -1 ? SEV_ORDER.length : at;
 }
-
 export const BUILTIN_TOOL = 'built-in';
-
 // One flat list of findings, worst first. `security` is the roll-up from
 // `summarizeSecurity`, which is also what the Security panel draws.
 export function findingsFromSecurity(security) {
-  const rows = [];
-  // The parenthesised default is hoisted rather than inlined: `for (const x of
-  // (a || []))` reads as a call to a function named `of` to the front end's
-  // dangling-call lint, and the lint is right to be suspicious of that shape.
-  const files = (security && security.files) || [];
-  for (const file of files) {
-    for (const finding of file.findings || []) {
-      rows.push({
-        path: file.path,
-        name: file.name || String(file.path || '').split('/').pop(),
-        line: finding.line || 1,
-        severity: SEV_ORDER.includes(finding.severity) ? finding.severity : 'info',
-        rule: finding.rule || 'unknown',
-        category: finding.category || 'other',
-        message: finding.message || '',
-        excerpt: finding.excerpt || '',
-        tool: finding.source === 'external' ? (finding.tool || 'external') : BUILTIN_TOOL,
-      });
+    const rows = [];
+    // The parenthesised default is hoisted rather than inlined: `for (const x of
+    // (a || []))` reads as a call to a function named `of` to the front end's
+    // dangling-call lint, and the lint is right to be suspicious of that shape.
+    const files = (security && security.files) || [];
+    for (const file of files) {
+        for (const finding of file.findings || []) {
+            rows.push({
+                path: file.path,
+                name: file.name || String(file.path || '').split('/').pop(),
+                line: finding.line || 1,
+                severity: SEV_ORDER.includes(finding.severity) ? finding.severity : 'info',
+                rule: finding.rule || 'unknown',
+                category: finding.category || 'other',
+                message: finding.message || '',
+                excerpt: finding.excerpt || '',
+                tool: finding.source === 'external' ? (finding.tool || 'external') : BUILTIN_TOOL,
+            });
+        }
     }
-  }
-  return rows.sort((a, b) => sevRank(a.severity) - sevRank(b.severity)
-    || a.path.localeCompare(b.path)
-    || a.line - b.line);
+    return rows.sort((a, b) => sevRank(a.severity) - sevRank(b.severity)
+        || a.path.localeCompare(b.path)
+        || a.line - b.line);
 }
-
 // Counts for the header and the prompt. `external` vs `builtin` is kept because
 // "the built-in regex scanner said so" and "Semgrep said so" carry different
 // weight, and the UI should be able to say which.
 export function tabulate(rows) {
-  const bySeverity = {};
-  const byTool = {};
-  const byCategory = {};
-  for (const row of rows) {
-    bySeverity[row.severity] = (bySeverity[row.severity] || 0) + 1;
-    byTool[row.tool] = (byTool[row.tool] || 0) + 1;
-    byCategory[row.category] = (byCategory[row.category] || 0) + 1;
-  }
-  const external = rows.filter((r) => r.tool !== BUILTIN_TOOL).length;
-  return {
-    total: rows.length,
-    bySeverity,
-    byTool,
-    byCategory,
-    external,
-    builtin: rows.length - external,
-    critical: bySeverity.critical || 0,
-    high: bySeverity.high || 0,
-    medium: bySeverity.medium || 0,
-    low: (bySeverity.low || 0) + (bySeverity.info || 0),
-  };
+    const bySeverity = {};
+    const byTool = {};
+    const byCategory = {};
+    for (const row of rows) {
+        bySeverity[row.severity] = (bySeverity[row.severity] || 0) + 1;
+        byTool[row.tool] = (byTool[row.tool] || 0) + 1;
+        byCategory[row.category] = (byCategory[row.category] || 0) + 1;
+    }
+    const external = rows.filter((r) => r.tool !== BUILTIN_TOOL).length;
+    return {
+        total: rows.length,
+        bySeverity,
+        byTool,
+        byCategory,
+        external,
+        builtin: rows.length - external,
+        critical: bySeverity.critical || 0,
+        high: bySeverity.high || 0,
+        medium: bySeverity.medium || 0,
+        low: (bySeverity.low || 0) + (bySeverity.info || 0),
+    };
 }
-
 // The filter is one predicate over three independent axes. `all` on an axis
 // means "do not filter on this", which is why the default object is usable as-is.
 export function filterFindings(rows, { severity = 'all', tool = 'all', q = '' } = {}) {
-  const needle = String(q || '').trim().toLowerCase();
-  return rows.filter((row) => {
-    if (severity !== 'all' && row.severity !== severity) return false;
-    if (tool !== 'all' && row.tool !== tool) return false;
-    if (!needle) return true;
-    return row.path.toLowerCase().includes(needle)
-      || row.message.toLowerCase().includes(needle)
-      || row.rule.toLowerCase().includes(needle)
-      || row.category.toLowerCase().includes(needle);
-  });
+    const needle = String(q || '').trim().toLowerCase();
+    return rows.filter((row) => {
+        if (severity !== 'all' && row.severity !== severity)
+            return false;
+        if (tool !== 'all' && row.tool !== tool)
+            return false;
+        if (!needle)
+            return true;
+        return row.path.toLowerCase().includes(needle)
+            || row.message.toLowerCase().includes(needle)
+            || row.rule.toLowerCase().includes(needle)
+            || row.category.toLowerCase().includes(needle);
+    });
 }
-
 // The engine table: what each tool is, whether it is installed, and what it did
 // last time it ran. `status` comes from `GET /api/tools`, `report` from the last
 // `POST /api/tools/run` — they are joined here so the view has one list to draw
 // instead of two to reconcile.
 export function engineRows(status, report) {
-  const passes = (report && report.passes) || [];
-  return Object.keys(status || {}).map((id) => {
-    const meta = status[id] || {};
-    const pass = passes.find((p) => p.id === id) || null;
-    return {
-      id,
-      label: meta.label || id,
-      kind: meta.kind || 'security',
-      purpose: meta.purpose || '',
-      available: !!meta.available,
-      how: meta.how || null,
-      reason: meta.reason || null,
-      // The option schema and its defaults, for the Configure form; `installable`
-      // is whether the server knows how to install this engine from the GUI.
-      options: Array.isArray(meta.options) ? meta.options : [],
-      defaults: meta.defaults || {},
-      installable: meta.installable !== false,
-      ran: !!(pass && pass.ok),
-      failed: !!(pass && !pass.ok && pass.available),
-      findings: pass && pass.ok ? (pass.findings || []).length : 0,
-      ms: pass && pass.ok ? pass.ms : null,
-      failure: pass && !pass.ok && pass.available ? pass.reason : null,
-    };
-  });
+    const passes = (report && report.passes) || [];
+    return Object.keys(status || {}).map((id) => {
+        const meta = status[id] || {};
+        const pass = passes.find((p) => p.id === id) || null;
+        return {
+            id,
+            label: meta.label || id,
+            kind: meta.kind || 'security',
+            purpose: meta.purpose || '',
+            available: !!meta.available,
+            how: meta.how || null,
+            reason: meta.reason || null,
+            // The option schema and its defaults, for the Configure form; `installable`
+            // is whether the server knows how to install this engine from the GUI.
+            options: Array.isArray(meta.options) ? meta.options : [],
+            defaults: meta.defaults || {},
+            installable: meta.installable !== false,
+            ran: !!(pass && pass.ok),
+            failed: !!(pass && !pass.ok && pass.available),
+            findings: pass && pass.ok ? (pass.findings || []).length : 0,
+            ms: pass && pass.ok ? pass.ms : null,
+            failure: pass && !pass.ok && pass.available ? pass.reason : null,
+        };
+    });
 }
-
 // The one-line verdict under the engine list. Written here rather than in the
 // view because "nothing ran" and "nothing found" must never be confused, and
 // that distinction is the whole point of the panel.
 export function engineSummary(report, rows) {
-  if (!report) {
-    return { tone: 'idle', text: 'No run yet. The built-in scanner is the whole story until you run an engine.' };
-  }
-  const ran = rows.filter((r) => r.ran).length;
-  const missing = rows.filter((r) => !r.available).length;
-  const failed = rows.filter((r) => r.failed).length;
-
-  if (!ran) {
-    return {
-      tone: 'none',
-      text: missing === rows.length && rows.length
-        ? 'No engine is installed on this machine. Install any of the ones below and run again — the built-in scan still stands.'
-        : 'No engine managed to run. The reasons are listed above.',
-    };
-  }
-
-  const findings = (report.findings || []).length;
-  const parts = [`${ran} of ${rows.length} engines ran in ${report.ms}ms`];
-  parts.push(findings ? `${findings} finding${findings === 1 ? '' : 's'} came back` : 'none of them found anything');
-  if (failed) parts.push(`${failed} failed`);
-  if (missing) parts.push(`${missing} not installed`);
-  return { tone: findings ? 'found' : 'clean', text: parts.join(' · ') + '.' };
+    if (!report) {
+        return { tone: 'idle', text: 'No run yet. The built-in scanner is the whole story until you run an engine.' };
+    }
+    const ran = rows.filter((r) => r.ran).length;
+    const missing = rows.filter((r) => !r.available).length;
+    const failed = rows.filter((r) => r.failed).length;
+    if (!ran) {
+        return {
+            tone: 'none',
+            text: missing === rows.length && rows.length
+                ? 'No engine is installed on this machine. Install any of the ones below and run again — the built-in scan still stands.'
+                : 'No engine managed to run. The reasons are listed above.',
+        };
+    }
+    const findings = (report.findings || []).length;
+    const parts = [`${ran} of ${rows.length} engines ran in ${report.ms}ms`];
+    parts.push(findings ? `${findings} finding${findings === 1 ? '' : 's'} came back` : 'none of them found anything');
+    if (failed)
+        parts.push(`${failed} failed`);
+    if (missing)
+        parts.push(`${missing} not installed`);
+    return { tone: findings ? 'found' : 'clean', text: parts.join(' · ') + '.' };
 }
-
+//# sourceMappingURL=analysisReport.js.map

package/public/js/analysisReport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysisReport.js","sourceRoot":"","sources":["../../src/public/js/analysisReport.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8BAA8B;AAC9B,EAAE;AACF,uDAAuD;AACvD,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,wDAAwD;AACxD,0EAA0E;AAC1E,wEAAwE;AACxE,6EAA6E;AAC7E,2EAA2E;AAC3E,iCAAiC;AAEjC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEvE,MAAM,UAAU,OAAO,CAAC,QAAQ;IAC9B,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC,yEAAyE;AACzE,oEAAoE;AACpE,MAAM,UAAU,oBAAoB,CAAC,QAAQ;IAC3C,MAAM,IAAI,GAAG,EAAE,CAAC;IAChB,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;gBAC3D,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;gBACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;gBAC1E,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,SAAS;gBAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO;gBACrC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;gBAC9B,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY;aAClF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;WAC/D,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;WAC5B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,kDAAkD;AAClD,MAAM,UAAU,QAAQ,CAAC,IAAI;IAC3B,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC;IACpE,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,UAAU;QACV,MAAM;QACN,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,QAAQ;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,CAAC;QAClC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC;QAC1B,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,CAAC;QAC9B,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,IAAI,EAAE,EAAE,QAAQ,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,GAAwB,EAAE;IACvG,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,IAAI,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;eACzC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;eAC1C,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;eACvC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,+BAA+B;AAC/B,MAAM,UAAU,UAAU,CAAC,MAAM,EAAE,MAAM;IACvC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;QACrD,OAAO;YACL,EAAE;YACF,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,4EAA4E;YAC5E,uEAAuE;YACvE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,KAAK,KAAK;YACvC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5D,EAAE,EAAE,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YACpC,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;SACjE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,MAAM,EAAE,IAAI;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8EAA8E,EAAE,CAAC;IAChH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAEnD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;gBAC1C,CAAC,CAAC,uHAAuH;gBACzH,CAAC,CAAC,yDAAyD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,OAAO,IAAI,CAAC,MAAM,mBAAmB,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACzE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,WAAW,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;IACnH,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,gBAAgB,CAAC,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;AAC/E,CAAC","sourcesContent":["// Shaping an analysis report for the Deep Analysis view — pure, DOM-free, and\n// therefore testable in Node.\n//\n// Three questions get answered here, and nowhere else:\n//\n//   * What findings do we actually have? The built-in scanner's findings live\n//     under `security.files[].findings`; the external engines' findings are\n//     merged into the same place, tagged `source: 'external'`. Flattening them\n//     into rows is the only place that difference is spelled out, so every view\n//     downstream can stop caring which engine answered.\n//   * What is the shape of the report? Counts by severity, by tool and by\n//     category are what the header chips and the AI prompt both run on.\n//   * What survives a filter? Severity, engine and free text, applied as one\n//     predicate so the counts above and the table below can never disagree\n//     about what is being shown.\n\nexport const SEV_ORDER = ['critical', 'high', 'medium', 'low', 'info'];\n\nexport function sevRank(severity) {\n  const at = SEV_ORDER.indexOf(severity);\n  return at === -1 ? SEV_ORDER.length : at;\n}\n\nexport const BUILTIN_TOOL = 'built-in';\n\n// One flat list of findings, worst first. `security` is the roll-up from\n// `summarizeSecurity`, which is also what the Security panel draws.\nexport function findingsFromSecurity(security) {\n  const rows = [];\n  // The parenthesised default is hoisted rather than inlined: `for (const x of\n  // (a || []))` reads as a call to a function named `of` to the front end's\n  // dangling-call lint, and the lint is right to be suspicious of that shape.\n  const files = (security && security.files) || [];\n  for (const file of files) {\n    for (const finding of file.findings || []) {\n      rows.push({\n        path: file.path,\n        name: file.name || String(file.path || '').split('/').pop(),\n        line: finding.line || 1,\n        severity: SEV_ORDER.includes(finding.severity) ? finding.severity : 'info',\n        rule: finding.rule || 'unknown',\n        category: finding.category || 'other',\n        message: finding.message || '',\n        excerpt: finding.excerpt || '',\n        tool: finding.source === 'external' ? (finding.tool || 'external') : BUILTIN_TOOL,\n      });\n    }\n  }\n  return rows.sort((a, b) => sevRank(a.severity) - sevRank(b.severity)\n    || a.path.localeCompare(b.path)\n    || a.line - b.line);\n}\n\n// Counts for the header and the prompt. `external` vs `builtin` is kept because\n// \"the built-in regex scanner said so\" and \"Semgrep said so\" carry different\n// weight, and the UI should be able to say which.\nexport function tabulate(rows) {\n  const bySeverity: Record<string, any> = {};\n  const byTool: Record<string, any> = {};\n  const byCategory: Record<string, any> = {};\n  for (const row of rows) {\n    bySeverity[row.severity] = (bySeverity[row.severity] || 0) + 1;\n    byTool[row.tool] = (byTool[row.tool] || 0) + 1;\n    byCategory[row.category] = (byCategory[row.category] || 0) + 1;\n  }\n  const external = rows.filter((r) => r.tool !== BUILTIN_TOOL).length;\n  return {\n    total: rows.length,\n    bySeverity,\n    byTool,\n    byCategory,\n    external,\n    builtin: rows.length - external,\n    critical: bySeverity.critical || 0,\n    high: bySeverity.high || 0,\n    medium: bySeverity.medium || 0,\n    low: (bySeverity.low || 0) + (bySeverity.info || 0),\n  };\n}\n\n// The filter is one predicate over three independent axes. `all` on an axis\n// means \"do not filter on this\", which is why the default object is usable as-is.\nexport function filterFindings(rows, { severity = 'all', tool = 'all', q = '' }: Record<string, any> = {}) {\n  const needle = String(q || '').trim().toLowerCase();\n  return rows.filter((row) => {\n    if (severity !== 'all' && row.severity !== severity) return false;\n    if (tool !== 'all' && row.tool !== tool) return false;\n    if (!needle) return true;\n    return row.path.toLowerCase().includes(needle)\n      || row.message.toLowerCase().includes(needle)\n      || row.rule.toLowerCase().includes(needle)\n      || row.category.toLowerCase().includes(needle);\n  });\n}\n\n// The engine table: what each tool is, whether it is installed, and what it did\n// last time it ran. `status` comes from `GET /api/tools`, `report` from the last\n// `POST /api/tools/run` — they are joined here so the view has one list to draw\n// instead of two to reconcile.\nexport function engineRows(status, report) {\n  const passes = (report && report.passes) || [];\n  return Object.keys(status || {}).map((id) => {\n    const meta = status[id] || {};\n    const pass = passes.find((p) => p.id === id) || null;\n    return {\n      id,\n      label: meta.label || id,\n      kind: meta.kind || 'security',\n      purpose: meta.purpose || '',\n      available: !!meta.available,\n      how: meta.how || null,\n      reason: meta.reason || null,\n      // The option schema and its defaults, for the Configure form; `installable`\n      // is whether the server knows how to install this engine from the GUI.\n      options: Array.isArray(meta.options) ? meta.options : [],\n      defaults: meta.defaults || {},\n      installable: meta.installable !== false,\n      ran: !!(pass && pass.ok),\n      failed: !!(pass && !pass.ok && pass.available),\n      findings: pass && pass.ok ? (pass.findings || []).length : 0,\n      ms: pass && pass.ok ? pass.ms : null,\n      failure: pass && !pass.ok && pass.available ? pass.reason : null,\n    };\n  });\n}\n\n// The one-line verdict under the engine list. Written here rather than in the\n// view because \"nothing ran\" and \"nothing found\" must never be confused, and\n// that distinction is the whole point of the panel.\nexport function engineSummary(report, rows) {\n  if (!report) {\n    return { tone: 'idle', text: 'No run yet. The built-in scanner is the whole story until you run an engine.' };\n  }\n  const ran = rows.filter((r) => r.ran).length;\n  const missing = rows.filter((r) => !r.available).length;\n  const failed = rows.filter((r) => r.failed).length;\n\n  if (!ran) {\n    return {\n      tone: 'none',\n      text: missing === rows.length && rows.length\n        ? 'No engine is installed on this machine. Install any of the ones below and run again — the built-in scan still stands.'\n        : 'No engine managed to run. The reasons are listed above.',\n    };\n  }\n\n  const findings = (report.findings || []).length;\n  const parts = [`${ran} of ${rows.length} engines ran in ${report.ms}ms`];\n  parts.push(findings ? `${findings} finding${findings === 1 ? '' : 's'} came back` : 'none of them found anything');\n  if (failed) parts.push(`${failed} failed`);\n  if (missing) parts.push(`${missing} not installed`);\n  return { tone: findings ? 'found' : 'clean', text: parts.join(' · ') + '.' };\n}\n\n"]}

package/public/js/api.d.ts

@@ -0,0 +1,26 @@
+import type { ScanRequest } from '../../shared/contracts.js';
+export declare function scanOnServer(payload: ScanRequest, options?: {
+    signal?: AbortSignal;
+}): Promise<any>;
+export declare function cleanupClone(cloneId: any): Promise<void>;
+export declare function fetchFileText(scanId: any, path: any): Promise<string>;
+export declare function fetchToolsStatus(): Promise<any>;
+export declare function runAnalysisTools(scanId: any, options?: Record<string, any>): Promise<any>;
+export declare function streamToolInstall(tool: any, onEvent: any): Promise<any>;
+export declare function fetchMcpStatus(): Promise<any>;
+export declare function startMcpServer(): Promise<any>;
+export declare function stopMcpServer(): Promise<any>;
+export declare function fetchMcpCommand(): Promise<any>;
+export declare function streamExplain({ baseUrl, apiKey, model, messages, maxTokens, providerOptions, signal }: {
+    apiKey: any;
+    baseUrl: any;
+    maxTokens?: number;
+    messages: any;
+    model: any;
+    providerOptions?: {};
+    signal?: AbortSignal;
+}): AsyncGenerator<any, void, unknown>;
+export declare function fetchServerSettings(): Promise<any>;
+export declare function updateServerSettings(patch: any): Promise<any>;
+export declare function rotateServerAccessKey(): Promise<any>;
+export declare function logoutRemoteSession(): Promise<any>;