codebase-onboarder 0.6.0 → 1.0.0

package/server/tools/install.js

@@ -13,234 +13,225 @@
 // makes one codebase serve all three platforms — a Mac with Homebrew, a
 // Windows box with winget, and a bare Linux server with nothing but curl all
 // get a working path, and the log says plainly which one was taken.
-
 import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-
 import { findOnPath, onboarderBinDir, spawnArgv } from './platform.js';
 import { clearDetectionCache } from '../tools.js';
-
 // Gitleaks has no package-manager story on Linux, so the fallback is its
 // official release asset, fetched over TLS from GitHub and unpacked into
 // ~/.onboarder/bin — a directory `findOnPath` already checks. The version is
 // pinned on purpose: a moving "latest" URL is a supply-chain surprise.
 const GITLEAKS_VERSION = '8.24.3';
-
 function gitleaksAsset(platform, arch) {
-  const osPart = { darwin: 'darwin', linux: 'linux', win32: 'windows' }[platform];
-  const archPart = arch === 'arm64' ? 'arm64' : 'x64';
-  const ext = platform === 'win32' ? 'zip' : 'tar.gz';
-  return {
-    url: `https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${osPart}_${archPart}.${ext}`,
-    file: `gitleaks.${ext}`,
-    binary: platform === 'win32' ? 'gitleaks.exe' : 'gitleaks',
-  };
+    const osPart = { darwin: 'darwin', linux: 'linux', win32: 'windows' }[platform];
+    const archPart = arch === 'arm64' ? 'arm64' : 'x64';
+    const ext = platform === 'win32' ? 'zip' : 'tar.gz';
+    return {
+        url: `https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${osPart}_${archPart}.${ext}`,
+        file: `gitleaks.${ext}`,
+        binary: platform === 'win32' ? 'gitleaks.exe' : 'gitleaks',
+    };
 }
-
 // A plan step is `{ argv }`, built from a context so paths stay absolute.
 // `needs` is the launcher binary that must exist for the whole plan to run.
 const INSTALL_PLANS = {
-  semgrep: [
-    { id: 'brew', label: 'Homebrew', needs: 'brew', platforms: ['darwin'],
-      steps: (bin) => [[bin, ['install', 'semgrep']]] },
-    { id: 'pipx', label: 'pipx', needs: 'pipx',
-      steps: (bin) => [[bin, ['install', 'semgrep']]] },
-    { id: 'uv', label: 'uv', needs: 'uv',
-      steps: (bin) => [[bin, ['tool', 'install', 'semgrep']]] },
-    { id: 'pip', label: 'pip (user site)', needs: 'python3', platforms: ['darwin', 'linux'],
-      steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'semgrep']]] },
-    { id: 'pip', label: 'pip (user site)', needs: 'python', platforms: ['win32'],
-      steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'semgrep']]] },
-  ],
-  vulture: [
-    { id: 'brew', label: 'Homebrew', needs: 'brew', platforms: ['darwin'],
-      steps: (bin) => [[bin, ['install', 'vulture']]] },
-    { id: 'pipx', label: 'pipx', needs: 'pipx',
-      steps: (bin) => [[bin, ['install', 'vulture']]] },
-    { id: 'uv', label: 'uv', needs: 'uv',
-      steps: (bin) => [[bin, ['tool', 'install', 'vulture']]] },
-    { id: 'pip', label: 'pip (user site)', needs: 'python3', platforms: ['darwin', 'linux'],
-      steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'vulture']]] },
-    { id: 'pip', label: 'pip (user site)', needs: 'python', platforms: ['win32'],
-      steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'vulture']]] },
-  ],
-  knip: [
-    { id: 'npm', label: 'npm (global)', needs: 'npm',
-      steps: (bin) => [[bin, ['install', '-g', 'knip']]] },
-  ],
-  depcheck: [
-    { id: 'npm', label: 'npm (global)', needs: 'npm',
-      steps: (bin) => [[bin, ['install', '-g', 'depcheck']]] },
-  ],
-  gitleaks: [
-    { id: 'brew', label: 'Homebrew', needs: 'brew', platforms: ['darwin'],
-      steps: (bin) => [[bin, ['install', 'gitleaks']]] },
-    { id: 'winget', label: 'winget', needs: 'winget', platforms: ['win32'],
-      steps: (bin) => [[bin, ['install', '--id', 'Gitleaks.Gitleaks', '-e',
-        '--accept-package-agreements', '--accept-source-agreements']]] },
-    { id: 'download', label: 'GitHub release download', needs: 'curl',
-      steps: (bin, ctx) => {
-        const asset = gitleaksAsset(ctx.platform, ctx.arch);
-        const archive = path.join(ctx.tmpDir, asset.file);
-        return [
-          [bin, ['-fSL', '-o', archive, asset.url]],
-          // bsdtar ships with Windows 10+ and reads zip; GNU tar reads tar.gz.
-          // One command shape serves both.
-          ['tar', ['-xf', archive, '-C', ctx.binDir]],
-        ];
-      },
-      after: (ctx) => {
-        const asset = gitleaksAsset(ctx.platform, ctx.arch);
-        const binPath = path.join(ctx.binDir, asset.binary);
-        if (ctx.platform !== 'win32') fs.chmodSync(binPath, 0o755);
-        return binPath;
-      },
-    },
-  ],
+    semgrep: [
+        { id: 'brew', label: 'Homebrew', needs: 'brew', platforms: ['darwin'],
+            steps: (bin) => [[bin, ['install', 'semgrep']]] },
+        { id: 'pipx', label: 'pipx', needs: 'pipx',
+            steps: (bin) => [[bin, ['install', 'semgrep']]] },
+        { id: 'uv', label: 'uv', needs: 'uv',
+            steps: (bin) => [[bin, ['tool', 'install', 'semgrep']]] },
+        { id: 'pip', label: 'pip (user site)', needs: 'python3', platforms: ['darwin', 'linux'],
+            steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'semgrep']]] },
+        { id: 'pip', label: 'pip (user site)', needs: 'python', platforms: ['win32'],
+            steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'semgrep']]] },
+    ],
+    vulture: [
+        { id: 'brew', label: 'Homebrew', needs: 'brew', platforms: ['darwin'],
+            steps: (bin) => [[bin, ['install', 'vulture']]] },
+        { id: 'pipx', label: 'pipx', needs: 'pipx',
+            steps: (bin) => [[bin, ['install', 'vulture']]] },
+        { id: 'uv', label: 'uv', needs: 'uv',
+            steps: (bin) => [[bin, ['tool', 'install', 'vulture']]] },
+        { id: 'pip', label: 'pip (user site)', needs: 'python3', platforms: ['darwin', 'linux'],
+            steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'vulture']]] },
+        { id: 'pip', label: 'pip (user site)', needs: 'python', platforms: ['win32'],
+            steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'vulture']]] },
+    ],
+    knip: [
+        { id: 'npm', label: 'npm (global)', needs: 'npm',
+            steps: (bin) => [[bin, ['install', '-g', 'knip']]] },
+    ],
+    depcheck: [
+        { id: 'npm', label: 'npm (global)', needs: 'npm',
+            steps: (bin) => [[bin, ['install', '-g', 'depcheck']]] },
+    ],
+    gitleaks: [
+        { id: 'brew', label: 'Homebrew', needs: 'brew', platforms: ['darwin'],
+            steps: (bin) => [[bin, ['install', 'gitleaks']]] },
+        { id: 'winget', label: 'winget', needs: 'winget', platforms: ['win32'],
+            steps: (bin) => [[bin, ['install', '--id', 'Gitleaks.Gitleaks', '-e',
+                        '--accept-package-agreements', '--accept-source-agreements']]] },
+        { id: 'download', label: 'GitHub release download', needs: 'curl',
+            steps: (bin, ctx) => {
+                const asset = gitleaksAsset(ctx.platform, ctx.arch);
+                const archive = path.join(ctx.tmpDir, asset.file);
+                return [
+                    [bin, ['-fSL', '-o', archive, asset.url]],
+                    // bsdtar ships with Windows 10+ and reads zip; GNU tar reads tar.gz.
+                    // One command shape serves both.
+                    ['tar', ['-xf', archive, '-C', ctx.binDir]],
+                ];
+            },
+            after: (ctx) => {
+                const asset = gitleaksAsset(ctx.platform, ctx.arch);
+                const binPath = path.join(ctx.binDir, asset.binary);
+                if (ctx.platform !== 'win32')
+                    fs.chmodSync(binPath, 0o755);
+                return binPath;
+            },
+        },
+    ],
 };
 // The plans a tool can use on this platform, in preference order. Pure —
 // exported for the status endpoint and for tests.
 export function plansFor(toolId, platform = process.platform) {
-  return (INSTALL_PLANS[toolId] || [])
-    .filter((plan) => !plan.platforms || plan.platforms.includes(platform));
+    return (INSTALL_PLANS[toolId] || [])
+        .filter((plan) => !plan.platforms || plan.platforms.includes(platform));
 }
-
 // What the GUI's install dialog shows before the button is pressed: for each
 // plan, whether its launcher exists here. Injectable `find` keeps it testable.
 export function planAvailability(toolId, options = {}) {
-  const platform = options.platform || process.platform;
-  const find = options.find || ((bin) => findOnPath(bin));
-  return plansFor(toolId, platform).map((plan) => ({
-    id: plan.id,
-    label: plan.label,
-    needs: plan.needs,
-    ready: !!find(plan.needs),
-  }));
+    const platform = options.platform || process.platform;
+    const find = options.find || ((bin) => findOnPath(bin));
+    return plansFor(toolId, platform).map((plan) => ({
+        id: plan.id,
+        label: plan.label,
+        needs: plan.needs,
+        ready: !!find(plan.needs),
+    }));
 }
-
 // One install at a time per tool — two Install clicks must not run pip against
 // itself. Held here rather than in the handler so the rule survives a second
 // caller.
 const installing = new Set();
-
 export function isInstalling(toolId) {
-  return installing.has(toolId);
+    return installing.has(toolId);
 }
-
 const STEP_TIMEOUT_MS = 10 * 60 * 1000; // pip on a slow link is still finite
-
 // Spawn one step, forwarding output line by line. Resolves with the exit
 // status; never rejects — a failed plan is data for the next plan, and the
 // whole log goes to the GUI either way.
 function runStep(command, args, onLog) {
-  const { command: cmd, args: argv } = spawnArgv([command, ...args]);
-  return new Promise((resolve) => {
-    let child;
-    try {
-      child = spawn(cmd, argv, { stdio: ['ignore', 'pipe', 'pipe'] });
-    } catch (err) {
-      onLog(`could not start ${cmd}: ${err.message}`);
-      resolve(-1);
-      return;
-    }
-    let pending = '';
-    const feed = (chunk) => {
-      pending += chunk.toString();
-      const lines = pending.split(/\r?\n/);
-      pending = lines.pop();
-      for (const line of lines) if (line.trim()) onLog(line);
-    };
-    child.stdout.on('data', feed);
-    child.stderr.on('data', feed);
-    const timer = setTimeout(() => {
-      child.kill('SIGKILL');
-      onLog(`${cmd} took too long and was stopped.`);
-    }, STEP_TIMEOUT_MS);
-    child.on('error', (err) => {
-      clearTimeout(timer);
-      onLog(`could not run ${cmd}: ${err.message}`);
-      resolve(-1);
-    });
-    child.on('close', (code) => {
-      clearTimeout(timer);
-      if (pending.trim()) onLog(pending);
-      resolve(code ?? -1);
+    const { command: cmd, args: argv } = spawnArgv([command, ...args]);
+    return new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn(cmd, argv, { stdio: ['ignore', 'pipe', 'pipe'] });
+        }
+        catch (err) {
+            onLog(`could not start ${cmd}: ${err.message}`);
+            resolve(-1);
+            return;
+        }
+        let pending = '';
+        const feed = (chunk) => {
+            pending += chunk.toString();
+            const lines = pending.split(/\r?\n/);
+            pending = lines.pop();
+            for (const line of lines)
+                if (line.trim())
+                    onLog(line);
+        };
+        child.stdout.on('data', feed);
+        child.stderr.on('data', feed);
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            onLog(`${cmd} took too long and was stopped.`);
+        }, STEP_TIMEOUT_MS);
+        child.on('error', (err) => {
+            clearTimeout(timer);
+            onLog(`could not run ${cmd}: ${err.message}`);
+            resolve(-1);
+        });
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            if (pending.trim())
+                onLog(pending);
+            resolve(code ?? -1);
+        });
     });
-  });
 }
-
 // Install a tool, streaming progress through `onEvent({ type, ... })`:
 //   { type: 'log', line }         — one line of output from the installer
 //   { type: 'plan', id, label }   — which plan is being attempted
 //   { type: 'done', ok, error?, method? }
 // Resolves with the same shape as the final `done` event.
-export async function installTool(toolId, onEvent = () => {}) {
-  const log = (line) => onEvent({ type: 'log', line });
-  const finish = (result) => { onEvent({ type: 'done', ...result }); return result; };
-
-  const plans = plansFor(toolId);
-  if (!plans.length) {
-    return finish({ ok: false, error: `Onboarder does not know how to install "${toolId}".` });
-  }
-  if (installing.has(toolId)) {
-    return finish({ ok: false, error: `${toolId} is already being installed.` });
-  }
-  installing.add(toolId);
-
-  try {
-    const ctx = {
-      platform: process.platform,
-      arch: process.arch,
-      tmpDir: os.tmpdir(),
-      binDir: onboarderBinDir(),
-    };
-
-    let attempted = 0;
-    for (const plan of plans) {
-      const launcher = findOnPath(plan.needs);
-      if (!launcher) {
-        log(`— skipping ${plan.label}: no ${plan.needs} on this machine.`);
-        continue;
-      }
-      attempted += 1;
-      onEvent({ type: 'plan', id: plan.id, label: plan.label });
-      log(`Installing ${toolId} with ${plan.label}…`);
-
-      if (plan.id === 'download') fs.mkdirSync(ctx.binDir, { recursive: true });
-
-      let failed = false;
-      for (const [command, args] of plan.steps(launcher, ctx)) {
-        log(`$ ${command} ${args.join(' ')}`);
-        const status = await runStep(command, args, log);
-        if (status !== 0) {
-          log(`✗ that step exited ${status}.`);
-          failed = true;
-          break;
+export async function installTool(toolId, onEvent = (..._args) => { }) {
+    const log = (line) => onEvent({ type: 'log', line });
+    const finish = (result) => { onEvent({ type: 'done', ...result }); return result; };
+    const plans = plansFor(toolId);
+    if (!plans.length) {
+        return finish({ ok: false, error: `Onboarder does not know how to install "${toolId}".` });
+    }
+    if (installing.has(toolId)) {
+        return finish({ ok: false, error: `${toolId} is already being installed.` });
+    }
+    installing.add(toolId);
+    try {
+        const ctx = {
+            platform: process.platform,
+            arch: process.arch,
+            tmpDir: os.tmpdir(),
+            binDir: onboarderBinDir(),
+        };
+        let attempted = 0;
+        for (const plan of plans) {
+            const launcher = findOnPath(plan.needs);
+            if (!launcher) {
+                log(`— skipping ${plan.label}: no ${plan.needs} on this machine.`);
+                continue;
+            }
+            attempted += 1;
+            onEvent({ type: 'plan', id: plan.id, label: plan.label });
+            log(`Installing ${toolId} with ${plan.label}…`);
+            if (plan.id === 'download')
+                fs.mkdirSync(ctx.binDir, { recursive: true });
+            let failed = false;
+            for (const [command, args] of plan.steps(launcher, ctx)) {
+                log(`$ ${command} ${args.join(' ')}`);
+                const status = await runStep(command, args, log);
+                if (status !== 0) {
+                    log(`✗ that step exited ${status}.`);
+                    failed = true;
+                    break;
+                }
+            }
+            if (failed)
+                continue;
+            try {
+                const binPath = plan.after ? plan.after(ctx) : null;
+                if (binPath)
+                    log(`Installed to ${binPath}`);
+            }
+            catch (err) {
+                log(`✗ unpack failed: ${err.message}`);
+                continue;
+            }
+            clearDetectionCache();
+            log('✓ done. Re-checking the engine list…');
+            return finish({ ok: true, method: plan.label });
         }
-      }
-      if (failed) continue;
-
-      try {
-        const binPath = plan.after ? plan.after(ctx) : null;
-        if (binPath) log(`Installed to ${binPath}`);
-      } catch (err) {
-        log(`✗ unpack failed: ${err.message}`);
-        continue;
-      }
-
-      clearDetectionCache();
-      log('✓ done. Re-checking the engine list…');
-      return finish({ ok: true, method: plan.label });
+        const why = attempted
+            ? 'Every available installer failed — the log above says where.'
+            : 'No installer this machine has can install it. Try the manual command in the engine list.';
+        return finish({ ok: false, error: why });
+    }
+    finally {
+        installing.delete(toolId);
     }
-
-    const why = attempted
-      ? 'Every available installer failed — the log above says where.'
-      : 'No installer this machine has can install it. Try the manual command in the engine list.';
-    return finish({ ok: false, error: why });
-  } finally {
-    installing.delete(toolId);
-  }
 }
-
+//# sourceMappingURL=install.js.map

package/server/tools/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/server/tools/install.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,kEAAkE;AAClE,EAAE;AACF,uEAAuE;AACvE,8EAA8E;AAC9E,2EAA2E;AAC3E,wEAAwE;AACxE,6EAA6E;AAC7E,oEAAoE;AAEpE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,yEAAyE;AACzE,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,SAAS,aAAa,CAAC,QAAQ,EAAE,IAAI;IACnC,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpD,OAAO;QACL,GAAG,EAAE,2DAA2D,gBAAgB,aAAa,gBAAgB,IAAI,MAAM,IAAI,QAAQ,IAAI,GAAG,EAAE;QAC5I,IAAI,EAAE,YAAY,GAAG,EAAE;QACvB,MAAM,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU;KAC3D,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,aAAa,GAAG;IACpB,OAAO,EAAE;QACP,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC;YACnE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;QACnD,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;YACxC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;QACnD,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;YAClC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;QAC3D,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YACrF,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;QAC1E,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC;YAC1E,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;KAC3E;IACD,OAAO,EAAE;QACP,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC;YACnE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;QACnD,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;YACxC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;QACnD,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;YAClC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;QAC3D,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YACrF,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;QAC1E,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC;YAC1E,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;KAC3E;IACD,IAAI,EAAE;QACJ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK;YAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE;KACvD;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK;YAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE;KAC3D;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC;YACnE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE;QACpD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC;YACpE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI;wBAClE,6BAA6B,EAAE,4BAA4B,CAAC,CAAC,CAAC,EAAE;QACpE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM;YAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBAClB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClD,OAAO;oBACL,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;oBACzC,qEAAqE;oBACrE,iCAAiC;oBACjC,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;iBAC5C,CAAC;YACJ,CAAC;YACD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;gBACb,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;oBAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC3D,OAAO,OAAO,CAAC;YACjB,CAAC;SACF;KACF;CACF,CAAC;AACF,yEAAyE;AACzE,kDAAkD;AAClD,MAAM,UAAU,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAC1D,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SACjC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAwB,EAAE;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;KAC1B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,UAAU;AACV,MAAM,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;AAE7B,MAAM,UAAU,YAAY,CAAC,MAAM;IACjC,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,qCAAqC;AAE7E,yEAAyE;AACzE,2EAA2E;AAC3E,wCAAwC;AACxC,SAAS,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACnE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,mBAAmB,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE;YACrB,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,IAAI,CAAC,IAAI,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,KAAK,CAAC,GAAG,GAAG,iCAAiC,CAAC,CAAC;QACjD,CAAC,EAAE,eAAe,CAAC,CAAC;QACpB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,CAAC,iBAAiB,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO,CAAC,IAAI,EAAE;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,0EAA0E;AAC1E,kEAAkE;AAClE,0CAA0C;AAC1C,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAM,EAAE,OAAO,GAA6C,CAAC,GAAG,KAAgB,EAAE,EAAE,GAAE,CAAC;IACvH,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAEpF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,MAAM,IAAI,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,8BAA8B,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG;YACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE;YACnB,MAAM,EAAE,eAAe,EAAE;SAC1B,CAAC;QAEF,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,mBAAmB,CAAC,CAAC;gBACnE,SAAS;YACX,CAAC;YACD,SAAS,IAAI,CAAC,CAAC;YACf,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,cAAc,MAAM,SAAS,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;YAEhD,IAAI,IAAI,CAAC,EAAE,KAAK,UAAU;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE1E,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBACjD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;oBACjB,GAAG,CAAC,sBAAsB,MAAM,GAAG,CAAC,CAAC;oBACrC,MAAM,GAAG,IAAI,CAAC;oBACd,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,MAAM;gBAAE,SAAS;YAErB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpD,IAAI,OAAO;oBAAE,GAAG,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YAED,mBAAmB,EAAE,CAAC;YACtB,GAAG,CAAC,sCAAsC,CAAC,CAAC;YAC5C,OAAO,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,GAAG,GAAG,SAAS;YACnB,CAAC,CAAC,8DAA8D;YAChE,CAAC,CAAC,0FAA0F,CAAC;QAC/F,OAAO,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC","sourcesContent":["// Installing an engine from the GUI.\n//\n// The engine's founding rule was \"detect, never install\" — the person\n// self-hosting decides what goes on the machine. This module relaxes *who\n// runs the command*, not *what runs*: the install plans below are fixed data,\n// one per tool per way of installing, and the GUI's Install button is the\n// person deciding. No plan takes user input; every step is an argument array\n// spawned without a shell, exactly like the analyzers themselves.\n//\n// Plans are ordered by preference and each names the launcher it needs\n// (`brew`, `pip`, `npm`, `winget`, `curl`, …). At install time the first plan\n// whose launcher is found on PATH runs; the rest are skipped. That is what\n// makes one codebase serve all three platforms — a Mac with Homebrew, a\n// Windows box with winget, and a bare Linux server with nothing but curl all\n// get a working path, and the log says plainly which one was taken.\n\nimport { spawn } from 'node:child_process';\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport { findOnPath, onboarderBinDir, spawnArgv } from './platform.js';\nimport { clearDetectionCache } from '../tools.js';\n\n// Gitleaks has no package-manager story on Linux, so the fallback is its\n// official release asset, fetched over TLS from GitHub and unpacked into\n// ~/.onboarder/bin — a directory `findOnPath` already checks. The version is\n// pinned on purpose: a moving \"latest\" URL is a supply-chain surprise.\nconst GITLEAKS_VERSION = '8.24.3';\n\nfunction gitleaksAsset(platform, arch) {\n  const osPart = { darwin: 'darwin', linux: 'linux', win32: 'windows' }[platform];\n  const archPart = arch === 'arm64' ? 'arm64' : 'x64';\n  const ext = platform === 'win32' ? 'zip' : 'tar.gz';\n  return {\n    url: `https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${osPart}_${archPart}.${ext}`,\n    file: `gitleaks.${ext}`,\n    binary: platform === 'win32' ? 'gitleaks.exe' : 'gitleaks',\n  };\n}\n\n// A plan step is `{ argv }`, built from a context so paths stay absolute.\n// `needs` is the launcher binary that must exist for the whole plan to run.\nconst INSTALL_PLANS = {\n  semgrep: [\n    { id: 'brew', label: 'Homebrew', needs: 'brew', platforms: ['darwin'],\n      steps: (bin) => [[bin, ['install', 'semgrep']]] },\n    { id: 'pipx', label: 'pipx', needs: 'pipx',\n      steps: (bin) => [[bin, ['install', 'semgrep']]] },\n    { id: 'uv', label: 'uv', needs: 'uv',\n      steps: (bin) => [[bin, ['tool', 'install', 'semgrep']]] },\n    { id: 'pip', label: 'pip (user site)', needs: 'python3', platforms: ['darwin', 'linux'],\n      steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'semgrep']]] },\n    { id: 'pip', label: 'pip (user site)', needs: 'python', platforms: ['win32'],\n      steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'semgrep']]] },\n  ],\n  vulture: [\n    { id: 'brew', label: 'Homebrew', needs: 'brew', platforms: ['darwin'],\n      steps: (bin) => [[bin, ['install', 'vulture']]] },\n    { id: 'pipx', label: 'pipx', needs: 'pipx',\n      steps: (bin) => [[bin, ['install', 'vulture']]] },\n    { id: 'uv', label: 'uv', needs: 'uv',\n      steps: (bin) => [[bin, ['tool', 'install', 'vulture']]] },\n    { id: 'pip', label: 'pip (user site)', needs: 'python3', platforms: ['darwin', 'linux'],\n      steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'vulture']]] },\n    { id: 'pip', label: 'pip (user site)', needs: 'python', platforms: ['win32'],\n      steps: (bin) => [[bin, ['-m', 'pip', 'install', '--user', 'vulture']]] },\n  ],\n  knip: [\n    { id: 'npm', label: 'npm (global)', needs: 'npm',\n      steps: (bin) => [[bin, ['install', '-g', 'knip']]] },\n  ],\n  depcheck: [\n    { id: 'npm', label: 'npm (global)', needs: 'npm',\n      steps: (bin) => [[bin, ['install', '-g', 'depcheck']]] },\n  ],\n  gitleaks: [\n    { id: 'brew', label: 'Homebrew', needs: 'brew', platforms: ['darwin'],\n      steps: (bin) => [[bin, ['install', 'gitleaks']]] },\n    { id: 'winget', label: 'winget', needs: 'winget', platforms: ['win32'],\n      steps: (bin) => [[bin, ['install', '--id', 'Gitleaks.Gitleaks', '-e',\n        '--accept-package-agreements', '--accept-source-agreements']]] },\n    { id: 'download', label: 'GitHub release download', needs: 'curl',\n      steps: (bin, ctx) => {\n        const asset = gitleaksAsset(ctx.platform, ctx.arch);\n        const archive = path.join(ctx.tmpDir, asset.file);\n        return [\n          [bin, ['-fSL', '-o', archive, asset.url]],\n          // bsdtar ships with Windows 10+ and reads zip; GNU tar reads tar.gz.\n          // One command shape serves both.\n          ['tar', ['-xf', archive, '-C', ctx.binDir]],\n        ];\n      },\n      after: (ctx) => {\n        const asset = gitleaksAsset(ctx.platform, ctx.arch);\n        const binPath = path.join(ctx.binDir, asset.binary);\n        if (ctx.platform !== 'win32') fs.chmodSync(binPath, 0o755);\n        return binPath;\n      },\n    },\n  ],\n};\n// The plans a tool can use on this platform, in preference order. Pure —\n// exported for the status endpoint and for tests.\nexport function plansFor(toolId, platform = process.platform) {\n  return (INSTALL_PLANS[toolId] || [])\n    .filter((plan) => !plan.platforms || plan.platforms.includes(platform));\n}\n\n// What the GUI's install dialog shows before the button is pressed: for each\n// plan, whether its launcher exists here. Injectable `find` keeps it testable.\nexport function planAvailability(toolId, options: Record<string, any> = {}) {\n  const platform = options.platform || process.platform;\n  const find = options.find || ((bin) => findOnPath(bin));\n  return plansFor(toolId, platform).map((plan) => ({\n    id: plan.id,\n    label: plan.label,\n    needs: plan.needs,\n    ready: !!find(plan.needs),\n  }));\n}\n\n// One install at a time per tool — two Install clicks must not run pip against\n// itself. Held here rather than in the handler so the rule survives a second\n// caller.\nconst installing = new Set();\n\nexport function isInstalling(toolId) {\n  return installing.has(toolId);\n}\n\nconst STEP_TIMEOUT_MS = 10 * 60 * 1000; // pip on a slow link is still finite\n\n// Spawn one step, forwarding output line by line. Resolves with the exit\n// status; never rejects — a failed plan is data for the next plan, and the\n// whole log goes to the GUI either way.\nfunction runStep(command, args, onLog) {\n  const { command: cmd, args: argv } = spawnArgv([command, ...args]);\n  return new Promise((resolve) => {\n    let child;\n    try {\n      child = spawn(cmd, argv, { stdio: ['ignore', 'pipe', 'pipe'] });\n    } catch (err) {\n      onLog(`could not start ${cmd}: ${err.message}`);\n      resolve(-1);\n      return;\n    }\n    let pending = '';\n    const feed = (chunk) => {\n      pending += chunk.toString();\n      const lines = pending.split(/\\r?\\n/);\n      pending = lines.pop();\n      for (const line of lines) if (line.trim()) onLog(line);\n    };\n    child.stdout.on('data', feed);\n    child.stderr.on('data', feed);\n    const timer = setTimeout(() => {\n      child.kill('SIGKILL');\n      onLog(`${cmd} took too long and was stopped.`);\n    }, STEP_TIMEOUT_MS);\n    child.on('error', (err) => {\n      clearTimeout(timer);\n      onLog(`could not run ${cmd}: ${err.message}`);\n      resolve(-1);\n    });\n    child.on('close', (code) => {\n      clearTimeout(timer);\n      if (pending.trim()) onLog(pending);\n      resolve(code ?? -1);\n    });\n  });\n}\n\n// Install a tool, streaming progress through `onEvent({ type, ... })`:\n//   { type: 'log', line }         — one line of output from the installer\n//   { type: 'plan', id, label }   — which plan is being attempted\n//   { type: 'done', ok, error?, method? }\n// Resolves with the same shape as the final `done` event.\nexport async function installTool(toolId, onEvent: (event: Record<string, unknown>) => void = (..._args: unknown[]) => {}) {\n  const log = (line) => onEvent({ type: 'log', line });\n  const finish = (result) => { onEvent({ type: 'done', ...result }); return result; };\n\n  const plans = plansFor(toolId);\n  if (!plans.length) {\n    return finish({ ok: false, error: `Onboarder does not know how to install \"${toolId}\".` });\n  }\n  if (installing.has(toolId)) {\n    return finish({ ok: false, error: `${toolId} is already being installed.` });\n  }\n  installing.add(toolId);\n\n  try {\n    const ctx = {\n      platform: process.platform,\n      arch: process.arch,\n      tmpDir: os.tmpdir(),\n      binDir: onboarderBinDir(),\n    };\n\n    let attempted = 0;\n    for (const plan of plans) {\n      const launcher = findOnPath(plan.needs);\n      if (!launcher) {\n        log(`— skipping ${plan.label}: no ${plan.needs} on this machine.`);\n        continue;\n      }\n      attempted += 1;\n      onEvent({ type: 'plan', id: plan.id, label: plan.label });\n      log(`Installing ${toolId} with ${plan.label}…`);\n\n      if (plan.id === 'download') fs.mkdirSync(ctx.binDir, { recursive: true });\n\n      let failed = false;\n      for (const [command, args] of plan.steps(launcher, ctx)) {\n        log(`$ ${command} ${args.join(' ')}`);\n        const status = await runStep(command, args, log);\n        if (status !== 0) {\n          log(`✗ that step exited ${status}.`);\n          failed = true;\n          break;\n        }\n      }\n      if (failed) continue;\n\n      try {\n        const binPath = plan.after ? plan.after(ctx) : null;\n        if (binPath) log(`Installed to ${binPath}`);\n      } catch (err) {\n        log(`✗ unpack failed: ${err.message}`);\n        continue;\n      }\n\n      clearDetectionCache();\n      log('✓ done. Re-checking the engine list…');\n      return finish({ ok: true, method: plan.label });\n    }\n\n    const why = attempted\n      ? 'Every available installer failed — the log above says where.'\n      : 'No installer this machine has can install it. Try the manual command in the engine list.';\n    return finish({ ok: false, error: why });\n  } finally {\n    installing.delete(toolId);\n  }\n}\n\n"]}

package/server/tools/parse.d.ts

@@ -0,0 +1,8 @@
+export declare const SEVERITY_ORDER: string[];
+export declare function normalizeSeverity(raw: any): "critical" | "high" | "info" | "low" | "medium";
+export declare function parseSemgrep(json: any, rel: any): any[];
+export declare function parseGitleaks(json: any, rel: any): any[];
+export declare function parseKnip(json: any, rel: any): any[];
+export declare function parseVulture(text: any, rel: any): any[];
+export declare function parseDepcheck(json: any): any[];
+export declare function mergeFindings(...lists: any[]): any[];