promptfoo 0.125.0 → 0.125.1

package/dist/src/scanner-DGjIiTZ1.js

@@ -1,1971 +0,0 @@
-#!/usr/bin/env node
-import { W as loadYaml, c as logger, lt as state, r as getLogLevel, u as setLogLevel } from "./logger-pCNnmVuz.js";
-import { U as TERMINAL_MAX_WIDTH, Y as VERSION } from "./fetch-BhfUnKen.js";
-import { r as sleepWithAbort } from "./time-Ct6CnABs.js";
-import { t as printBorder } from "./util-BD1R_PsR.js";
-import { n as sha256 } from "./createHash-DqA6GWxE.js";
-import { t as formatDuration } from "./formatDuration-22XOO9FJ.js";
-import { t as runCommand } from "./runCommand-sU-vcN5n.js";
-import chalk from "chalk";
-import { z as z$1 } from "zod";
-import fs, { existsSync, realpathSync } from "fs";
-import path, { dirname, isAbsolute, join, relative, resolve, sep } from "path";
-import { promisify } from "util";
-import { execFile, spawn } from "child_process";
-import crypto from "crypto";
-import async from "async";
-import { pathToFileURL } from "url";
-import ora from "ora";
-import { io } from "socket.io-client";
-import binaryExtensions from "binary-extensions";
-import { isText } from "istextorbinary";
-import textExtensions from "text-extensions";
-import { minimatch } from "minimatch";
-import { simpleGit } from "simple-git";
-import { createRequire } from "module";
-//#region src/types/codeScan.ts
-const CodeScanSeverity = {
-	CRITICAL: "critical",
-	HIGH: "high",
-	MEDIUM: "medium",
-	LOW: "low",
-	NONE: "none"
-};
-const CodeScanSeveritySchema = z$1.enum([
-	"critical",
-	"high",
-	"medium",
-	"low",
-	"none"
-]);
-const CodeScanOutputFormat = {
-	TEXT: "text",
-	JSON: "json",
-	SARIF: "sarif"
-};
-const CodeScanOutputFormatSchema = z$1.enum([
-	"text",
-	"json",
-	"sarif"
-]);
-function getSeverityValues(severity) {
-	switch (severity) {
-		case CodeScanSeverity.CRITICAL: return ["🔴", 4];
-		case CodeScanSeverity.HIGH: return ["🟠", 3];
-		case CodeScanSeverity.MEDIUM: return ["🟡", 2];
-		case CodeScanSeverity.LOW: return ["🔵", 1];
-		case CodeScanSeverity.NONE: return ["👍", -1];
-	}
-}
-/**
-* Get emoji representation for a severity level
-* @param severity - The severity level
-* @returns Emoji string representing the severity
-*/
-function getSeverityEmoji(severity) {
-	return getSeverityValues(severity)?.[0];
-}
-/**
-* Get numeric rank for a severity level (used for sorting)
-* @param severity - The severity level
-* @returns Numeric rank (higher = more severe)
-*/
-function getSeverityRank(severity) {
-	return getSeverityValues(severity)?.[1];
-}
-/**
-* Format severity level for display
-* @param severity - The severity level (optional, returns empty string if undefined)
-* @param style - Display style ('plain' or 'markdown')
-* @returns Formatted severity string
-*/
-function formatSeverity(severity, style = "plain") {
-	if (!severity) return "";
-	const emoji = getSeverityEmoji(severity);
-	const displayText = severity === CodeScanSeverity.NONE ? "All Clear" : capitalize(severity);
-	if (style === "markdown") return `_${emoji} ${displayText}_\n\n`;
-	return `${emoji} ${displayText}`;
-}
-function filterBySeverity(comments) {
-	const validSeverities = [
-		CodeScanSeverity.CRITICAL,
-		CodeScanSeverity.HIGH,
-		CodeScanSeverity.MEDIUM,
-		CodeScanSeverity.LOW
-	];
-	return comments.filter((c) => c.severity && validSeverities.includes(c.severity));
-}
-/**
-* Count comments by severity level
-* @param comments - Array of comments with severity property (optional severity)
-* @returns Object with counts for each severity level
-*/
-function countBySeverity(comments) {
-	const issuesOnly = filterBySeverity(comments);
-	return {
-		total: issuesOnly.length,
-		critical: issuesOnly.filter((c) => c.severity === CodeScanSeverity.CRITICAL).length,
-		high: issuesOnly.filter((c) => c.severity === CodeScanSeverity.HIGH).length,
-		medium: issuesOnly.filter((c) => c.severity === CodeScanSeverity.MEDIUM).length,
-		low: issuesOnly.filter((c) => c.severity === CodeScanSeverity.LOW).length
-	};
-}
-/**
-* Helper function to capitalize the first letter of a string
-*/
-function capitalize(str) {
-	return str.charAt(0).toUpperCase() + str.slice(1);
-}
-/**
-* Validates and parses a severity string into CodeScanSeverity enum
-* Normalizes input by trimming whitespace and converting to lowercase
-* @param severity - String input to validate (e.g., "high", "CRITICAL", " medium ")
-* @returns Validated CodeScanSeverity enum value
-* @throws {z.ZodError} if severity is not a valid CodeScanSeverity value
-* @example
-* validateSeverity('high') // Returns CodeScanSeverity.HIGH
-* validateSeverity('CRITICAL') // Returns CodeScanSeverity.CRITICAL
-* validateSeverity('invalid') // Throws ZodError
-*/
-function validateSeverity(severity) {
-	const normalized = severity.trim().toLowerCase();
-	return CodeScanSeveritySchema.parse(normalized);
-}
-/**
-* Schema for a valid line range in a file's diff.
-* Used for validating PR comment line numbers.
-*/
-const LineRangeSchema = z$1.object({
-	start: z$1.number(),
-	end: z$1.number()
-});
-const FileRecordSchema = z$1.object({
-	path: z$1.string(),
-	status: z$1.string(),
-	shaA: z$1.string().nullable(),
-	shaB: z$1.string().nullable(),
-	linesAdded: z$1.number().optional(),
-	linesRemoved: z$1.number().optional(),
-	beforeSizeBytes: z$1.number().optional(),
-	afterSizeBytes: z$1.number().optional(),
-	isText: z$1.boolean().optional(),
-	skipReason: z$1.string().optional(),
-	patch: z$1.string().optional(),
-	/** Valid line ranges in the NEW file (for PR comment validation) */
-	lineRanges: z$1.array(LineRangeSchema).optional()
-});
-const GitMetadataSchema = z$1.object({
-	branch: z$1.string(),
-	baseBranch: z$1.string(),
-	baseRef: z$1.string(),
-	baseSha: z$1.string(),
-	compareRef: z$1.string(),
-	compareSha: z$1.string(),
-	commitMessages: z$1.array(z$1.string()),
-	author: z$1.string(),
-	timestamp: z$1.string()
-});
-const ScanConfigSchema = z$1.object({
-	minimumSeverity: CodeScanSeveritySchema,
-	diffsOnly: z$1.boolean(),
-	guidance: z$1.string().optional()
-});
-const PullRequestContextSchema = z$1.object({
-	owner: z$1.string(),
-	repo: z$1.string(),
-	number: z$1.number(),
-	sha: z$1.string()
-});
-z$1.object({
-	files: z$1.array(FileRecordSchema).min(1, "Files array cannot be empty"),
-	metadata: GitMetadataSchema,
-	config: ScanConfigSchema,
-	sessionId: z$1.string(),
-	pullRequest: PullRequestContextSchema.optional()
-});
-const CommentSchema = z$1.object({
-	file: z$1.string().nullable(),
-	startLine: z$1.number().nullable().optional(),
-	line: z$1.number().nullable(),
-	finding: z$1.string(),
-	fix: z$1.string().nullable().optional(),
-	severity: CodeScanSeveritySchema.optional(),
-	aiAgentPrompt: z$1.string().nullable().optional()
-});
-z$1.object({
-	inventory: z$1.string(),
-	tracing: z$1.string(),
-	analysis: z$1.string(),
-	filtering: z$1.string(),
-	fixes: z$1.string(),
-	comments: z$1.string()
-});
-z$1.object({
-	success: z$1.boolean(),
-	review: z$1.string().optional(),
-	comments: z$1.array(CommentSchema),
-	commentsPosted: z$1.boolean().optional(),
-	batchCount: z$1.number().optional(),
-	error: z$1.string().optional(),
-	skipReason: z$1.string().optional()
-});
-/**
-* Error thrown when git operations fail
-*/
-var GitError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "GitError";
-	}
-};
-/**
-* Error thrown when git metadata extraction fails
-*/
-var GitMetadataError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "GitMetadataError";
-	}
-};
-/**
-* Error thrown when diff processing fails
-*/
-var DiffProcessorError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "DiffProcessorError";
-	}
-};
-/**
-* Error thrown when MCP filesystem server startup fails
-*/
-var FilesystemMcpError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "FilesystemMcpError";
-	}
-};
-/**
-* Error thrown when Socket.io MCP bridge connection fails
-*/
-var SocketIoMcpBridgeError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "SocketIoMcpBridgeError";
-	}
-};
-/**
-* Error thrown when config file loading or parsing fails
-*/
-var ConfigLoadError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ConfigLoadError";
-	}
-};
-//#endregion
-//#region src/util/agent/agentAuth.ts
-/**
-* Shared auth credential resolution for agent clients.
-*
-* Common waterfall: CLI arg → PROMPTFOO_API_KEY env var → cloud config stored key.
-* Agent-specific auth (e.g., OIDC, fork PR) wraps this function and adds extra strategies.
-*/
-let cloudConfig$1;
-try {
-	cloudConfig$1 = (await import("./cloud-B02qcpjf.js")).cloudConfig;
-} catch (error) {
-	if (error instanceof Error && "code" in error && error.code === "MODULE_NOT_FOUND") {} else logger.debug(`Unexpected error loading cloud config: ${error}`);
-}
-/**
-* Resolve base authentication credentials using waterfall approach:
-* 1. API key from argument (CLI --api-key or config file)
-* 2. PROMPTFOO_API_KEY environment variable
-* 3. API key from promptfoo auth (cloudConfig)
-*
-* @param opts - Optional overrides
-* @returns Resolved auth credentials (may be empty if no auth found)
-*/
-function resolveBaseAuthCredentials(opts) {
-	if (opts?.apiKey) {
-		logger.debug("Using API key from CLI/config");
-		return { apiKey: opts.apiKey };
-	}
-	const envApiKey = process.env.PROMPTFOO_API_KEY;
-	if (envApiKey) {
-		logger.debug("Using API key from PROMPTFOO_API_KEY env var");
-		return { apiKey: envApiKey };
-	}
-	if (cloudConfig$1) {
-		const storedApiKey = cloudConfig$1.getApiKey();
-		if (storedApiKey) {
-			logger.debug("Using API key from promptfoo auth");
-			return { apiKey: storedApiKey };
-		}
-	}
-	return {};
-}
-//#endregion
-//#region src/util/agent/agentClient.ts
-/**
-* Client-side agent connection utility.
-*
-* Creates a Socket.IO client pre-configured for the agent protocol:
-* - Connects with agent name in handshake
-* - Joins a session room
-* - Provides typed lifecycle methods (start, cancel, onComplete, onError)
-* - Passes through domain-specific events via on()/emit()
-*/
-let cloudConfig;
-try {
-	cloudConfig = (await import("./cloud-B02qcpjf.js")).cloudConfig;
-} catch (error) {
-	if (error instanceof Error && "code" in error && error.code === "MODULE_NOT_FOUND") {} else logger.debug(`Unexpected error loading cloud config: ${error}`);
-}
-/**
-* Create an agent client that connects to the shared Socket.IO server.
-*
-* Only `agent` is required. Host, auth, and sessionId are resolved automatically
-* but can be overridden for agents with custom needs.
-*
-* @returns Promise that resolves to an AgentClient once connected and joined to a room.
-* @throws Error if connection fails or times out.
-*/
-async function createAgentClient(opts) {
-	const { agent, timeoutMs = 5e3 } = opts;
-	const host = opts.host ?? cloudConfig?.getApiHost();
-	if (!host) throw new Error("No API host available. Set PROMPTFOO_CLOUD_API_URL or pass host explicitly.");
-	const auth = opts.auth ?? resolveBaseAuthCredentials();
-	const sessionId = opts.sessionId ?? crypto.randomUUID();
-	return new Promise((resolve, reject) => {
-		let settled = false;
-		const cleanup = () => {
-			clearTimeout(timeoutId);
-			socket.io.reconnection(false);
-			socket.removeAllListeners();
-			socket.close();
-		};
-		const socket = io(host, {
-			transports: ["websocket"],
-			reconnection: true,
-			reconnectionDelay: 500,
-			reconnectionDelayMax: 1e4,
-			reconnectionAttempts: 5,
-			auth: {
-				agent,
-				...auth
-			}
-		});
-		socket.on("connect", () => {
-			logger.debug(`Agent client connected (agent: ${agent}, id: ${socket.id})`);
-			socket.emit("agent:join", { sessionId });
-			if (settled) return;
-			settled = true;
-			clearTimeout(timeoutId);
-			resolve({
-				sessionId,
-				start(payload) {
-					socket.emit("agent:start", payload);
-				},
-				cancel() {
-					socket.emit("agent:cancel");
-				},
-				onComplete(cb) {
-					socket.once("agent:complete", cb);
-				},
-				onError(cb) {
-					socket.once("agent:error", cb);
-				},
-				onCancelled(cb) {
-					socket.once("agent:cancelled", cb);
-				},
-				on(event, handler) {
-					socket.on(event, handler);
-				},
-				emit(event, ...args) {
-					socket.emit(event, ...args);
-				},
-				disconnect() {
-					socket.disconnect();
-				},
-				socket
-			});
-		});
-		socket.on("connect_error", (error) => {
-			if (settled) return;
-			settled = true;
-			logger.debug(`Agent client connection error: ${error.message}`);
-			cleanup();
-			reject(/* @__PURE__ */ new Error(`Failed to connect to server: ${error.message}`));
-		});
-		socket.on("disconnect", (reason) => {
-			logger.debug(`Agent client disconnected: ${reason}`);
-		});
-		socket.on("error", (error) => {
-			logger.debug(`Agent client error: ${String(error)}`);
-		});
-		socket.io.on("reconnect_failed", () => {
-			logger.error(`Agent client reconnection failed after all attempts (agent: ${agent})`);
-		});
-		const timeoutId = setTimeout(() => {
-			if (!socket.connected && !settled) {
-				settled = true;
-				cleanup();
-				reject(/* @__PURE__ */ new Error(`Connection timeout after ${timeoutMs}ms`));
-			}
-		}, timeoutMs);
-	});
-}
-//#endregion
-//#region src/codeScan/config/schema.ts
-/**
-* Configuration Schema
-*
-* Zod schema for validating YAML configuration files.
-*/
-const ConfigSchema = z$1.object({
-	minSeverity: CodeScanSeveritySchema.optional().describe("Minimum severity level for reporting vulnerabilities"),
-	minimumSeverity: CodeScanSeveritySchema.optional().describe("Alias for minSeverity"),
-	diffsOnly: z$1.boolean().prefault(false).describe("Only scan PR diffs, skip filesystem exploration (default: explore full repo)"),
-	apiHost: z$1.string().optional().describe("Scan server URL (default: https://api.promptfoo.app)"),
-	guidance: z$1.string().optional().describe("Custom guidance for the security scan"),
-	guidanceFile: z$1.string().optional().describe("Path to file containing custom guidance")
-}).refine((data) => !(data.guidance && data.guidanceFile), { message: "Cannot specify both guidance and guidanceFile" }).transform((data) => {
-	const minimumSeverity = data.minSeverity ?? data.minimumSeverity ?? CodeScanSeverity.MEDIUM;
-	const { minimumSeverity: _, ...rest } = data;
-	return {
-		...rest,
-		minimumSeverity
-	};
-});
-const DEFAULT_CONFIG = {
-	minimumSeverity: CodeScanSeverity.MEDIUM,
-	diffsOnly: false
-};
-//#endregion
-//#region src/codeScan/config/loader.ts
-/**
-* Configuration Loader
-*
-* Loads and validates configuration from YAML files.
-*/
-/**
-* Load configuration from a YAML file
-* @param configPath Path to the configuration file
-* @returns Validated configuration object
-* @throws ConfigLoadError if file cannot be read or parsed
-*/
-function loadConfig(configPath) {
-	if (!fs.existsSync(configPath)) throw new ConfigLoadError(`Configuration file not found: ${configPath}`);
-	let fileContents;
-	try {
-		fileContents = fs.readFileSync(configPath, "utf8");
-	} catch (error) {
-		throw new ConfigLoadError(`Failed to read configuration file: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	let rawConfig;
-	try {
-		rawConfig = loadYaml(fileContents);
-	} catch (error) {
-		throw new ConfigLoadError(`Failed to parse YAML: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	const result = ConfigSchema.safeParse(rawConfig);
-	if (!result.success) throw new ConfigLoadError(`Invalid configuration: ${result.error.issues.map((err) => `${err.path.join(".")}: ${err.message}`).join(", ")}`);
-	const config = result.data;
-	if (config.guidanceFile) {
-		const guidanceFilePath = path.isAbsolute(config.guidanceFile) ? config.guidanceFile : path.resolve(path.dirname(configPath), config.guidanceFile);
-		try {
-			config.guidance = fs.readFileSync(guidanceFilePath, "utf-8");
-		} catch (error) {
-			throw new ConfigLoadError(`Failed to read guidance file "${guidanceFilePath}": ${error instanceof Error ? error.message : String(error)}`);
-		}
-	}
-	return config;
-}
-/**
-* Load configuration with defaults
-* If no config path provided, returns default configuration
-* Returns a clone to prevent mutation of the singleton default
-*/
-function loadConfigOrDefault(configPath) {
-	if (!configPath) return { ...DEFAULT_CONFIG };
-	return loadConfig(configPath);
-}
-/**
-* Merge CLI options with configuration
-*
-* CLI options take precedence over config file settings
-*
-* @param config - Base configuration
-* @param options - CLI options to merge
-* @returns Merged configuration
-*/
-function mergeConfigWithOptions(config, options) {
-	const merged = { ...config };
-	if (options.diffsOnly !== void 0) merged.diffsOnly = options.diffsOnly;
-	if (options.minSeverity || options.minimumSeverity) merged.minimumSeverity = validateSeverity(options.minSeverity || options.minimumSeverity);
-	if (options.apiHost) merged.apiHost = options.apiHost;
-	return merged;
-}
-/**
-* Resolve guidance from options or config
-*
-* CLI options take precedence over config file settings
-*
-* @param options - Options that may contain guidance
-* @param config - Configuration that may contain guidance
-* @returns Guidance string or undefined
-* @throws Error if both guidance and guidanceFile are specified
-*/
-function resolveGuidance(options, config) {
-	if (options.guidance && options.guidanceFile) throw new Error("Cannot specify both --guidance and --guidance-file options");
-	if (options.guidance) return options.guidance;
-	if (options.guidanceFile) {
-		const absoluteGuidancePath = path.resolve(options.guidanceFile);
-		try {
-			return fs.readFileSync(absoluteGuidancePath, "utf-8");
-		} catch (error) {
-			throw new Error(`Failed to read guidance file: ${absoluteGuidancePath} - ${error instanceof Error ? error.message : String(error)}`);
-		}
-	}
-	return config.guidance;
-}
-//#endregion
-//#region src/codeScan/git/diff.ts
-/**
-* Git Branch Validation
-*/
-/**
-* Validate that we're on a branch (not detached HEAD)
-* @param git Simple git instance
-* @throws GitError if not on a branch
-*/
-async function validateOnBranch(git) {
-	try {
-		const status = await git.status();
-		if (status.detached) throw new GitError("Not on a branch. Please checkout a branch before running the scan.");
-		if (!status.current) throw new GitError("Could not determine current branch.");
-		return status.current;
-	} catch (error) {
-		if (error instanceof GitError) throw error;
-		throw new GitError(`Failed to validate branch: ${error instanceof Error ? error.message : String(error)}`);
-	}
-}
-//#endregion
-//#region src/codeScan/constants/filtering.ts
-/**
-* File Filtering Constants
-*
-* Shared constants for code scan file filtering used by both CLI and server.
-* Kept separate so server callers do not load the diff-processing pipeline.
-*/
-const DENYLIST_PATTERNS = [
-	"**/node_modules/**",
-	"**/dist/**",
-	"**/build/**",
-	"**/.next/**",
-	"**/.venv/**",
-	"**/__pycache__/**",
-	"**/*.lock",
-	"**/package-lock.json",
-	"**/yarn.lock",
-	"**/pnpm-lock.yaml",
-	"**/Cargo.lock",
-	"**/poetry.lock",
-	"**/composer.lock",
-	"**/Pipfile.lock",
-	"**/*.min.js",
-	"**/*.map",
-	"**/*.bin",
-	"**/*.exe",
-	"**/*.dll",
-	"**/*.so",
-	"**/*.dylib",
-	"**/*.zip",
-	"**/*.tar",
-	"**/*.gz",
-	"**/*.jpg",
-	"**/*.jpeg",
-	"**/*.png",
-	"**/*.gif",
-	"**/*.pdf",
-	"**/*.mp4",
-	"**/*.mov"
-];
-const MAX_PATCH_SIZE_BYTES = 204800;
-function isInDenylist(filePath) {
-	return DENYLIST_PATTERNS.some((pattern) => minimatch(filePath, pattern));
-}
-//#endregion
-//#region src/codeScan/util/diffHunkParser.ts
-/**
-* Regular expression to match unified diff hunk headers.
-*
-* Format: @@ -oldStart[,oldCount] +newStart[,newCount] @@
-* The count is optional and defaults to 1 if not present.
-*
-* Examples:
-* - @@ -10,7 +20,8 @@ -> old: 10,7  new: 20,8
-* - @@ -1 +1 @@        -> old: 1,1  new: 1,1
-* - @@ -0,0 +1,5 @@    -> old: 0,0  new: 1,5 (new file)
-*/
-const HUNK_HEADER_REGEX = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
-/**
-* Parse a unified diff hunk header line.
-*
-* @param line - A line that may be a hunk header
-* @returns Parsed hunk information, or null if not a hunk header
-*
-* @example
-* ```typescript
-* parseHunkHeader('@@ -10,7 +20,8 @@ function foo() {')
-* // Returns: { oldStart: 10, oldCount: 7, newStart: 20, newCount: 8 }
-*
-* parseHunkHeader('regular code line')
-* // Returns: null
-* ```
-*/
-function parseHunkHeader(line) {
-	const match = line.match(HUNK_HEADER_REGEX);
-	if (!match) return null;
-	return {
-		oldStart: parseInt(match[1], 10),
-		oldCount: match[2] ? parseInt(match[2], 10) : 1,
-		newStart: parseInt(match[3], 10),
-		newCount: match[4] ? parseInt(match[4], 10) : 1
-	};
-}
-//#endregion
-//#region src/codeScan/git/diffAnnotator.ts
-/**
-* Diff Annotator
-*
-* Adds absolute line numbers to unified diff format for easier LLM processing.
-* This eliminates the need for LLMs to manually calculate line numbers from hunk headers.
-*
-* Also extracts valid line ranges for each file, which can be used to validate
-* and clamp comment line numbers for GitHub PR reviews.
-*/
-/**
-* Annotate a unified diff patch with absolute line numbers and extract valid line ranges.
-*/
-function annotateDiffWithLineRanges(patch) {
-	if (!patch || patch.trim() === "") return {
-		annotatedDiff: patch,
-		lineRanges: []
-	};
-	const lines = patch.split("\n");
-	const result = [];
-	const lineRanges = [];
-	let currentNewLine = 0;
-	let inHunk = false;
-	let hunkStartLine = 0;
-	for (let i = 0; i < lines.length; i++) {
-		const line = lines[i];
-		const isLastLine = i === lines.length - 1;
-		const hunkHeader = parseHunkHeader(line);
-		if (hunkHeader) {
-			if (hunkStartLine > 0 && currentNewLine > hunkStartLine) lineRanges.push({
-				start: hunkStartLine,
-				end: currentNewLine - 1
-			});
-			currentNewLine = hunkHeader.newStart;
-			inHunk = true;
-			hunkStartLine = hunkHeader.newCount === 0 ? 0 : hunkHeader.newStart;
-			result.push(line);
-			continue;
-		}
-		if (!inHunk) {
-			result.push(line);
-			continue;
-		}
-		if (line.startsWith("-") || line.startsWith("\\") || line === "" && isLastLine) result.push(line);
-		else {
-			result.push(`L${currentNewLine}: ${line}`);
-			currentNewLine++;
-		}
-	}
-	if (hunkStartLine > 0 && currentNewLine > hunkStartLine) lineRanges.push({
-		start: hunkStartLine,
-		end: currentNewLine - 1
-	});
-	return {
-		annotatedDiff: result.join("\n"),
-		lineRanges
-	};
-}
-//#endregion
-//#region src/codeScan/git/rawDiffParser.ts
-/**
-* Parse git diff --raw -z output
-*
-* Format for normal operations (M, A, D):
-*   :oldmode newmode oldsha newsha status\0path\0
-*
-* Format for renames/copies (R, C):
-*   :oldmode newmode oldsha newsha status\0oldpath\0newpath\0
-*
-* Note: Rename/Copy status includes similarity (e.g., R100, R90, C100)
-*/
-function parseRawDiff(rawOutput) {
-	const entries = rawOutput.split("\0").filter(Boolean);
-	const results = [];
-	let i = 0;
-	while (i < entries.length) {
-		const metaLine = entries[i];
-		i++;
-		if (!metaLine || i >= entries.length) break;
-		const parts = metaLine.trim().split(/\s+/);
-		if (parts.length < 5) continue;
-		const shaA = parts[2] === "0000000000000000000000000000000000000000" ? null : parts[2];
-		const shaB = parts[3] === "0000000000000000000000000000000000000000" ? null : parts[3];
-		const status = parts[4];
-		if (status.startsWith("R") || status.startsWith("C")) i++;
-		const filePath = entries[i];
-		i++;
-		if (!filePath) continue;
-		results.push({
-			path: filePath,
-			status,
-			shaA,
-			shaB
-		});
-	}
-	return results;
-}
-//#endregion
-//#region src/codeScan/git/diffProcessor.ts
-/**
-* Diff Processor
-*
-* Focused pipeline for processing git diffs:
-* 1. Discover changed files
-* 2. Filter denylist (early exit)
-* 3. Collect blob sizes and filter large files
-* 4. Determine text/binary status
-* 5. Generate per-file patches
-*/
-const PATCH_CONCURRENCY = 8;
-const TEXT_DETECTION_CONCURRENCY = 16;
-/**
-* Parse git diff --numstat -z output.
-* Normal entries: added\tremoved\tpath\0
-* Renames/copies: added\tremoved\t\0oldpath\0newpath\0
-*/
-function parseNumstat(numstatOutput) {
-	const map = /* @__PURE__ */ new Map();
-	const records = numstatOutput.split("\0");
-	for (let i = 0; i < records.length; i++) {
-		const record = records[i];
-		const firstTab = record.indexOf("	");
-		const secondTab = record.indexOf("	", firstTab + 1);
-		if (firstTab === -1 || secondTab === -1) continue;
-		const added = record.slice(0, firstTab);
-		const removed = record.slice(firstTab + 1, secondTab);
-		let filePath = record.slice(secondTab + 1);
-		if (!filePath) {
-			i += 2;
-			filePath = records[i];
-		}
-		if (!filePath) continue;
-		map.set(filePath, {
-			linesAdded: added === "-" ? 0 : Number.parseInt(added, 10),
-			linesRemoved: removed === "-" ? 0 : Number.parseInt(removed, 10)
-		});
-	}
-	return map;
-}
-async function discoverChangedFiles(repoPath, base, compare) {
-	const [rawResult, numstatResult] = await Promise.all([runCommand("git", [
-		"diff",
-		"--raw",
-		"-z",
-		"--no-color",
-		"--no-ext-diff",
-		"--no-abbrev",
-		`${base}...${compare}`
-	], { cwd: repoPath }), runCommand("git", [
-		"diff",
-		"--numstat",
-		"-z",
-		`${base}...${compare}`
-	], { cwd: repoPath })]);
-	const rawFiles = parseRawDiff(rawResult.stdout);
-	const numstatMap = parseNumstat(numstatResult.stdout);
-	return rawFiles.map((file) => {
-		const stats = numstatMap.get(file.path);
-		return {
-			path: file.path,
-			status: file.status,
-			shaA: file.shaA,
-			shaB: file.shaB,
-			linesAdded: stats?.linesAdded,
-			linesRemoved: stats?.linesRemoved
-		};
-	});
-}
-function filterDenylist(files) {
-	return files.map((file) => {
-		if (isInDenylist(file.path)) return {
-			...file,
-			skipReason: "denylist"
-		};
-		return file;
-	});
-}
-async function collectBlobSizes(repoPath, files) {
-	const shas = /* @__PURE__ */ new Set();
-	for (const file of files) {
-		if (file.skipReason) continue;
-		if (file.shaA) shas.add(file.shaA);
-		if (file.shaB) shas.add(file.shaB);
-	}
-	if (shas.size === 0) return /* @__PURE__ */ new Map();
-	const shaList = Array.from(shas).join("\n");
-	const result = await runCommand("git", ["cat-file", "--batch-check=%(objectname) %(objecttype) %(objectsize)"], {
-		cwd: repoPath,
-		input: shaList
-	});
-	const sizeMap = /* @__PURE__ */ new Map();
-	for (const line of result.stdout.split("\n")) {
-		if (!line.trim()) continue;
-		const parts = line.split(/\s+/);
-		if (parts.length < 3) continue;
-		const sha = parts[0];
-		const size = Number.parseInt(parts[2], 10);
-		sizeMap.set(sha, size);
-	}
-	return sizeMap;
-}
-function attachBlobSizesAndFilter(files, sizeMap) {
-	return files.map((file) => {
-		if (file.skipReason) return file;
-		const beforeSize = file.shaA ? sizeMap.get(file.shaA) : void 0;
-		const afterSize = file.shaB ? sizeMap.get(file.shaB) : void 0;
-		const tooLarge = beforeSize !== void 0 && beforeSize > 512e3 || afterSize !== void 0 && afterSize > 512e3;
-		return {
-			...file,
-			beforeSizeBytes: beforeSize,
-			afterSizeBytes: afterSize,
-			...tooLarge && { skipReason: "too large" }
-		};
-	});
-}
-async function isBlobText(repoPath, sha) {
-	try {
-		const result = await runCommand("git", [
-			"cat-file",
-			"blob",
-			sha
-		], {
-			cwd: repoPath,
-			encoding: "buffer"
-		});
-		return isText(null, result.stdout) === true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Check file extension against known text and binary extension lists
-* @returns 'text' if known text extension, 'binary' if known binary extension, 'unknown' otherwise
-*/
-function getExtensionType(filePath) {
-	const ext = path.extname(filePath).toLowerCase().slice(1);
-	if (textExtensions.includes(ext)) return "text";
-	if (binaryExtensions.includes(ext)) return "binary";
-	return "unknown";
-}
-/**
-* Determine text/binary status for a single file
-* Uses 2-tier approach: extension lists first, then blob content analysis for unknown extensions
-*/
-async function determineTextStatusForFile(repoPath, file) {
-	if (file.skipReason) return file;
-	const extensionType = getExtensionType(file.path);
-	let textStatus = extensionType === "text";
-	if (extensionType === "unknown") {
-		const checkSha = file.shaB || file.shaA;
-		textStatus = checkSha ? await isBlobText(repoPath, checkSha) : false;
-	}
-	return {
-		...file,
-		isText: textStatus,
-		...!textStatus && { skipReason: "binary" }
-	};
-}
-async function determineTextStatus(repoPath, files) {
-	return async.mapLimit(files, TEXT_DETECTION_CONCURRENCY, async (file) => determineTextStatusForFile(repoPath, file));
-}
-async function generatePatchForFile(repoPath, base, compare, file) {
-	const filePath = file.path;
-	try {
-		const patch = (await runCommand("git", [
-			"diff",
-			"--patch",
-			"--unified=3",
-			"--no-color",
-			"--no-ext-diff",
-			`${base}...${compare}`,
-			"--",
-			filePath
-		], {
-			cwd: repoPath,
-			maxBuffer: MAX_PATCH_SIZE_BYTES
-		})).stdout;
-		if (Buffer.byteLength(patch, "utf8") > 204800) return {
-			...file,
-			skipReason: "patch too large"
-		};
-		const { annotatedDiff, lineRanges } = annotateDiffWithLineRanges(patch);
-		return {
-			...file,
-			patch: annotatedDiff,
-			lineRanges
-		};
-	} catch (err) {
-		const errorMessage = err instanceof Error ? err.message : String(err);
-		if (errorMessage.includes("maxBuffer") || errorMessage.includes("stdout maxBuffer")) {
-			logger.debug(`git diff --patch ${filePath} exceeded maxBuffer (${MAX_PATCH_SIZE_BYTES} bytes) - patch too large`);
-			return {
-				...file,
-				skipReason: "patch too large"
-			};
-		}
-		logger.debug(`git diff --patch ${filePath} failed: ${errorMessage} - skipping file`);
-		return {
-			...file,
-			skipReason: "diff error"
-		};
-	}
-}
-async function generatePatches(repoPath, base, compare, files) {
-	return async.mapLimit(files, PATCH_CONCURRENCY, async (file) => {
-		if (file.skipReason) return file;
-		return await generatePatchForFile(repoPath, base, compare, file);
-	});
-}
-async function processDiff(repoPath, base, compare = "HEAD") {
-	try {
-		let files = await discoverChangedFiles(repoPath, base, compare);
-		if (files.length === 0) return files;
-		files = filterDenylist(files);
-		if (!files.some((file) => !file.skipReason)) return files;
-		const sizeMap = await collectBlobSizes(repoPath, files);
-		files = attachBlobSizesAndFilter(files, sizeMap);
-		if (!files.some((file) => !file.skipReason)) return files;
-		files = await determineTextStatus(repoPath, files);
-		if (!files.some((file) => !file.skipReason)) return files;
-		return await generatePatches(repoPath, base, compare, files);
-	} catch (error) {
-		if (error instanceof DiffProcessorError) throw error;
-		throw new DiffProcessorError(`Failed to process diff: ${error instanceof Error ? error.message : String(error)}`);
-	}
-}
-//#endregion
-//#region src/codeScan/git/metadata.ts
-/**
-* Git Metadata Extraction
-*
-* Extracts metadata about the current branch and commits.
-*/
-/**
-* Extract git metadata for the comparison
-* @param repoPath Path to the git repository
-* @param baseBranch Base branch or commit
-* @param compareRef Compare branch or commit
-* @returns Git metadata object
-*/
-async function extractMetadata(repoPath, baseBranch, compareRef) {
-	const git = simpleGit(repoPath);
-	try {
-		const baseSha = (await git.revparse([baseBranch])).trim();
-		const compareSha = (await git.revparse([compareRef])).trim();
-		const log = await git.log({
-			from: baseBranch,
-			to: compareRef
-		});
-		return {
-			branch: compareRef,
-			baseBranch,
-			baseRef: baseBranch,
-			baseSha,
-			compareRef,
-			compareSha,
-			commitMessages: log.all.map((commit) => {
-				return `${commit.hash.substring(0, 7)}: ${commit.message}`;
-			}),
-			author: log.latest?.author_name || "Unknown",
-			timestamp: log.latest?.date || (/* @__PURE__ */ new Date()).toISOString()
-		};
-	} catch (error) {
-		throw new GitMetadataError(`Failed to extract git metadata: ${error instanceof Error ? error.message : String(error)}`);
-	}
-}
-//#endregion
-//#region src/codeScan/mcp/filesystem.ts
-/**
-* Filesystem MCP Server Management
-*
-* Spawns and manages the @modelcontextprotocol/server-filesystem child process.
-*/
-const require = createRequire(import.meta.url);
-const execFileAsync = promisify(execFile);
-const FILESYSTEM_MCP_READY_MARKER = "running on stdio";
-const FILESYSTEM_MCP_READY_TIMEOUT_MS = 3e4;
-function formatFilesystemMcpExitReason(code, signal) {
-	return code === null ? signal ? `signal ${signal}` : "unknown reason" : `code ${code}`;
-}
-const FILESYSTEM_MCP_ENV_KEYS = /* @__PURE__ */ new Set([
-	"HOME",
-	"PATH",
-	"SYSTEMROOT",
-	"TEMP",
-	"TMP",
-	"TMPDIR",
-	"USERPROFILE"
-]);
-function createFilesystemMcpEnv() {
-	return Object.fromEntries(Object.entries(process.env).filter(([key]) => FILESYSTEM_MCP_ENV_KEYS.has(key.toUpperCase())));
-}
-function resolveFilesystemMcpServerEntry() {
-	try {
-		return require.resolve("@modelcontextprotocol/server-filesystem/dist/index.js");
-	} catch {
-		throw new Error("The @modelcontextprotocol/server-filesystem package is required to scan beyond the diff. Reinstall promptfoo with optional dependencies or use --diffs-only.");
-	}
-}
-function getFilesystemMcpLaunch(rootDir) {
-	const heapLimit = [...(process.env.NODE_OPTIONS ?? "").matchAll(/(?:^|\s)--max[-_]old[-_]space[-_]size(?:=|\s+)([1-9]\d*)(?=\s|$)/g)].at(-1)?.[1];
-	const nodeArgs = heapLimit ? [`--max-old-space-size=${heapLimit}`] : [];
-	const canonicalRoot = realpathSync(rootDir);
-	const outsideRoot = (file) => {
-		const canonicalFile = realpathSync(file);
-		const relativePath = relative(canonicalRoot, canonicalFile);
-		if (relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath)) throw new Error("The filesystem MCP launcher must be installed outside the scanned repository. Use an external promptfoo installation or --diffs-only.");
-		return canonicalFile;
-	};
-	const entry = outsideRoot(resolveFilesystemMcpServerEntry());
-	if (!process.versions.pnp) return {
-		args: [
-			...nodeArgs,
-			entry,
-			canonicalRoot
-		],
-		cwd: dirname(entry)
-	};
-	const pnpLoader = outsideRoot(require.resolve("pnpapi"));
-	const esmLoader = join(dirname(pnpLoader), ".pnp.loader.mjs");
-	if (!existsSync(esmLoader)) throw new Error("The filesystem MCP server needs Yarn ESM support. Enable pnpEnableEsmLoader and reinstall, use nodeLinker: node-modules, or use --diffs-only.");
-	return {
-		args: [
-			...nodeArgs,
-			"--require",
-			pnpLoader,
-			"--experimental-loader",
-			pathToFileURL(outsideRoot(esmLoader)).href,
-			entry,
-			canonicalRoot
-		],
-		cwd: dirname(pnpLoader)
-	};
-}
-/**
-* Start the filesystem MCP server as a child process
-* @param rootDir Absolute path to root directory for filesystem access
-* @returns Child process handle
-*/
-function startFilesystemMcpServer(rootDir) {
-	if (!isAbsolute(rootDir)) throw new FilesystemMcpError(`Root directory must be an absolute path, got: ${rootDir}`);
-	const absoluteRootDir = resolve(rootDir);
-	logger.debug("Starting filesystem MCP server...");
-	logger.debug(`Root directory: ${absoluteRootDir}`);
-	try {
-		const { args, cwd } = getFilesystemMcpLaunch(absoluteRootDir);
-		const mcpProcess = spawn(process.execPath, args, {
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			],
-			cwd,
-			env: createFilesystemMcpEnv()
-		});
-		mcpProcess.stderr?.on("data", (chunk) => {
-			const message = chunk.toString("utf8");
-			if (message.includes("Failed to request initial roots from client")) return;
-			logger.debug(`MCP server stderr: ${message.trim()}`);
-		});
-		mcpProcess.on("error", (error) => {
-			logger.error(`MCP server process error: ${error.message}`);
-		});
-		mcpProcess.on("exit", (code, signal) => {
-			if (code !== null && code !== 0) logger.debug(`MCP server exited with code ${code}`);
-			else if (signal) logger.debug(`MCP server terminated by signal ${signal}`);
-		});
-		logger.debug(`MCP server started (pid: ${mcpProcess.pid})`);
-		return mcpProcess;
-	} catch (error) {
-		throw new FilesystemMcpError(`Failed to start filesystem MCP server: ${error instanceof Error ? error.message : String(error)}`);
-	}
-}
-/**
-* Wait until the filesystem MCP server is ready to accept JSON-RPC messages.
-*
-* The server starts reading stdin only after it validates its root directory.
-* Announcing the runner before that point lets the cloud side send initialize too early.
-*/
-function waitForFilesystemMcpServerReady(mcpProcess, timeoutMs = FILESYSTEM_MCP_READY_TIMEOUT_MS) {
-	if (mcpProcess.exitCode !== null || mcpProcess.signalCode !== null || mcpProcess.killed) return Promise.reject(new FilesystemMcpError(`Filesystem MCP server exited before ready: ${formatFilesystemMcpExitReason(mcpProcess.exitCode, mcpProcess.signalCode)}`));
-	const stderr = mcpProcess.stderr;
-	if (!stderr) return Promise.reject(new FilesystemMcpError("Filesystem MCP server stderr pipe unavailable"));
-	return new Promise((resolve, reject) => {
-		let stderrBuffer = "";
-		let settled = false;
-		const cleanup = () => {
-			clearTimeout(timeout);
-			stderr.off("data", onStderr);
-			mcpProcess.off("error", onError);
-			mcpProcess.off("exit", onExit);
-		};
-		const settle = (callback) => {
-			if (!settled) {
-				settled = true;
-				cleanup();
-				callback();
-			}
-		};
-		const onStderr = (chunk) => {
-			stderrBuffer += chunk.toString("utf8");
-			if (stderrBuffer.includes(FILESYSTEM_MCP_READY_MARKER)) {
-				settle(resolve);
-				return;
-			}
-			if (stderrBuffer.length > 4096) stderrBuffer = stderrBuffer.slice(-4096);
-		};
-		const onError = (error) => {
-			settle(() => {
-				reject(new FilesystemMcpError(`Filesystem MCP server error before ready: ${error.message}`));
-			});
-		};
-		const onExit = (code, signal) => {
-			settle(() => {
-				reject(new FilesystemMcpError(`Filesystem MCP server exited before ready: ${formatFilesystemMcpExitReason(code, signal)}`));
-			});
-		};
-		const timeout = setTimeout(() => {
-			settle(() => {
-				reject(new FilesystemMcpError(`Timed out waiting for filesystem MCP server to be ready after ${timeoutMs}ms`));
-			});
-		}, timeoutMs);
-		stderr.on("data", onStderr);
-		mcpProcess.once("error", onError);
-		mcpProcess.once("exit", onExit);
-	});
-}
-/**
-* Stop the filesystem MCP server process
-* @param mcpProcess Child process to terminate
-*/
-async function stopFilesystemMcpServer(mcpProcess) {
-	if (!mcpProcess.pid || mcpProcess.exitCode !== null || mcpProcess.signalCode !== null) {
-		logger.debug("MCP server already stopped");
-		return;
-	}
-	logger.debug(`Stopping MCP server (pid: ${mcpProcess.pid})...`);
-	if (process.platform === "win32") {
-		const windowsDir = process.env.SystemRoot;
-		if (!windowsDir || !isAbsolute(windowsDir)) throw new FilesystemMcpError("Cannot locate the Windows system directory for MCP cleanup");
-		try {
-			await execFileAsync(join(windowsDir, "System32", "taskkill.exe"), [
-				"/PID",
-				String(mcpProcess.pid),
-				"/T",
-				"/F"
-			], {
-				windowsHide: true,
-				timeout: 5e3
-			});
-		} catch (error) {
-			throw new FilesystemMcpError(`Failed to stop filesystem MCP process tree: ${error instanceof Error ? error.message : String(error)}`);
-		}
-		return;
-	}
-	return new Promise((resolve, reject) => {
-		let settled = false;
-		let exitTimeout;
-		const cleanup = () => {
-			clearTimeout(timeout);
-			clearTimeout(exitTimeout);
-			mcpProcess.off("exit", onExit);
-			mcpProcess.off("error", onError);
-		};
-		const onExit = () => {
-			if (!settled) {
-				settled = true;
-				cleanup();
-				logger.debug("MCP server stopped");
-				resolve();
-			}
-		};
-		const onError = (error) => {
-			if (!settled) {
-				settled = true;
-				cleanup();
-				reject(new FilesystemMcpError(`Failed to stop filesystem MCP server: ${error.message}`));
-			}
-		};
-		const sendSignal = (signal) => {
-			try {
-				mcpProcess.kill(signal);
-			} catch (error) {
-				onError(error instanceof Error ? error : new Error(String(error)));
-			}
-		};
-		const timeout = setTimeout(() => {
-			logger.debug("MCP server did not exit gracefully, force killing...");
-			sendSignal("SIGKILL");
-			if (!settled) exitTimeout = setTimeout(() => {
-				onError(/* @__PURE__ */ new Error(`Timed out waiting for process ${mcpProcess.pid} to exit`));
-			}, 5e3);
-		}, 5e3);
-		mcpProcess.once("exit", onExit);
-		mcpProcess.once("error", onError);
-		sendSignal("SIGTERM");
-	});
-}
-//#endregion
-//#region src/codeScan/mcp/transport.ts
-/**
-* Bridge between MCP stdio and socket.io
-*/
-var SocketIoMcpBridge = class {
-	mcpProcess;
-	socket;
-	sessionId;
-	readBuffer = "";
-	wireIdSeq = 0;
-	wireIdMap = /* @__PURE__ */ new Map();
-	constructor(mcpProcess, socket, sessionId) {
-		this.mcpProcess = mcpProcess;
-		this.socket = socket;
-		this.sessionId = sessionId;
-	}
-	/**
-	* Start bridging MCP stdio with the provided socket
-	*/
-	async connect() {
-		if (!this.socket.connected) throw new SocketIoMcpBridgeError("Socket must be connected before starting bridge");
-		logger.debug(`Using existing socket connection (id: ${this.socket.id})`);
-		this.startBridging();
-	}
-	/**
-	* Start bridging MCP stdio and socket.io
-	*/
-	startBridging() {
-		if (!this.socket) throw new SocketIoMcpBridgeError("Socket not initialized");
-		this.mcpProcess.stdout?.on("data", (chunk) => {
-			this.readBuffer += chunk.toString("utf8");
-			while (true) {
-				const newlineIndex = this.readBuffer.indexOf("\n");
-				if (newlineIndex === -1) break;
-				const line = this.readBuffer.slice(0, newlineIndex);
-				this.readBuffer = this.readBuffer.slice(newlineIndex + 1);
-				if (!line.trim()) continue;
-				try {
-					const message = JSON.parse(line);
-					const isResponse = "result" in message || "error" in message;
-					const isRequest = "method" in message && !isResponse;
-					let batchId;
-					let restoredMessage = message;
-					if (isResponse && message.id !== void 0) {
-						const wireId = String(message.id);
-						const mapping = this.wireIdMap.get(wireId);
-						if (mapping) {
-							batchId = mapping.batchId;
-							restoredMessage = {
-								...message,
-								id: mapping.originalId
-							};
-							this.wireIdMap.delete(wireId);
-						} else batchId = 0;
-					}
-					const eventName = isResponse ? "mcp:response" : isRequest ? "mcp:server-request" : "mcp:server-notification";
-					this.socket?.emit(eventName, {
-						session_id: this.sessionId,
-						batch_id: batchId ?? 0,
-						message: restoredMessage
-					});
-				} catch (_error) {
-					logger.debug(`Failed to parse MCP output: ${line}`);
-				}
-			}
-		});
-		this.socket.on("mcp:request", (message) => {
-			try {
-				const batchId = message._batch_id ?? 0;
-				const { _batch_id, ...cleanMessage } = message;
-				let messageToSend = cleanMessage;
-				if (cleanMessage.id !== void 0 && cleanMessage.id !== null) {
-					const seq = this.wireIdSeq++;
-					const wireId = `b${batchId}:${String(cleanMessage.id)}:${seq}`;
-					this.wireIdMap.set(wireId, {
-						batchId,
-						originalId: cleanMessage.id
-					});
-					messageToSend = {
-						...cleanMessage,
-						id: wireId
-					};
-				}
-				const jsonLine = JSON.stringify(messageToSend) + "\n";
-				this.mcpProcess.stdin?.write(jsonLine);
-			} catch (error) {
-				logger.error(`Failed to write to MCP stdin: ${error instanceof Error ? error.message : String(error)}`);
-			}
-		});
-		logger.debug("MCP ↔ Socket.io bridge active");
-	}
-	/**
-	* Stop bridging (socket lifecycle managed externally)
-	*/
-	async disconnect() {
-		logger.debug("Stopping MCP bridge...");
-		this.wireIdMap.clear();
-		this.wireIdSeq = 0;
-		logger.debug("MCP bridge stopped");
-	}
-	/**
-	* Get socket ID (if connected)
-	*/
-	get socketId() {
-		return this.socket?.id || null;
-	}
-	/**
-	* Check if currently connected
-	*/
-	get connected() {
-		return this.socket?.connected === true;
-	}
-};
-//#endregion
-//#region src/codeScan/util/auth.ts
-/**
-* Code scan authentication utilities.
-*
-* Wraps the shared agent auth resolution and adds code-scan-specific
-* strategies: GitHub OIDC token and fork PR context.
-*/
-/**
-* Resolve authentication credentials using waterfall approach:
-* 1. API key from CLI argument or config file (passed as parameter)
-* 2. PROMPTFOO_API_KEY environment variable
-* 3. API key from promptfoo auth (cloudConfig)
-* 4. GitHub OIDC token (environment variable)
-* 5. Fork PR context (for fork PRs where OIDC is unavailable)
-*
-* @param apiKey Optional API key from CLI arg or config file
-* @param forkPR Optional fork PR context for authentication
-* @returns Resolved auth credentials
-*/
-function resolveAuthCredentials(apiKey, forkPR) {
-	const baseAuth = resolveBaseAuthCredentials({ apiKey });
-	if (baseAuth.apiKey) return baseAuth;
-	const oidcToken = process.env.GITHUB_OIDC_TOKEN;
-	if (oidcToken) {
-		logger.debug("Using GitHub OIDC token");
-		return { oidcToken };
-	}
-	if (forkPR) {
-		logger.debug("Using fork PR context for authentication");
-		return { forkPR };
-	}
-	return {};
-}
-//#endregion
-//#region src/codeScan/util/github.ts
-/**
-* Parse GitHub PR string
-*
-* @param prString - GitHub PR string in format: owner/repo#number (e.g., promptfoo/promptfoo#123)
-* @returns Parsed PR object or null if invalid format
-*/
-function parseGitHubPr(prString) {
-	const match = prString.match(/^([^/]+)\/([^#]+)#(\d+)$/);
-	if (!match) return null;
-	const [, owner, repo, prNumber] = match;
-	return {
-		owner,
-		repo,
-		number: parseInt(prNumber, 10)
-	};
-}
-//#endregion
-//#region src/codeScan/scanner/cleanup.ts
-/**
-* Cleanup and Signal Handling
-*
-* Manages graceful shutdown and resource cleanup for scan operations.
-*/
-/**
-* Register cleanup handlers for process signals
-*
-* Handles SIGINT (Ctrl+C), SIGTERM, and SIGQUIT signals by aborting the scan.
-* The scanner's catch/finally blocks perform resource cleanup.
-*
-* @param abortController - Controller for the in-flight scan
-*/
-function registerCleanupHandlers(abortController) {
-	const cleanup = (signal) => {
-		logger.debug(`Received ${signal}, aborting scan...`);
-		abortController.abort();
-	};
-	process.once("SIGINT", () => cleanup("SIGINT"));
-	process.once("SIGTERM", () => cleanup("SIGTERM"));
-	process.once("SIGQUIT", () => cleanup("SIGQUIT"));
-}
-//#endregion
-//#region src/codeScan/util/sarif.ts
-const SARIF_SCHEMA_URL = "https://json.schemastore.org/sarif-2.1.0.json";
-const SARIF_VERSION = "2.1.0";
-const TOOL_INFORMATION_URI = "https://www.promptfoo.dev/docs/code-scanning/cli/";
-const GENERIC_RULE_ID = "promptfoo/code-scan-finding";
-const RULE_HELP_TEXT = "Review the finding and suggested fix, then validate the affected code path before merging.";
-const FINGERPRINT_FINDING_MAX_CHARS = 160;
-const SARIF_RULE = {
-	id: GENERIC_RULE_ID,
-	name: "Promptfoo Code Scan Finding",
-	shortDescription: { text: "Potential LLM security issue identified by Promptfoo Code Scan." },
-	fullDescription: { text: "Promptfoo Code Scan reviews code changes for LLM-related security risks such as prompt injection, unsafe tool use, and sensitive data exposure." },
-	defaultConfiguration: { level: "warning" },
-	help: {
-		text: RULE_HELP_TEXT,
-		markdown: RULE_HELP_TEXT
-	},
-	properties: {
-		tags: ["security", "llm-security"],
-		precision: "medium"
-	}
-};
-function isSarifReportableFinding(comment) {
-	return comment.file != null && comment.file !== "" && comment.severity !== CodeScanSeverity.NONE;
-}
-function toSarifLevel(severity) {
-	if (severity === void 0) return "note";
-	switch (severity) {
-		case CodeScanSeverity.CRITICAL:
-		case CodeScanSeverity.HIGH: return "error";
-		case CodeScanSeverity.MEDIUM: return "warning";
-		case CodeScanSeverity.LOW:
-		case CodeScanSeverity.NONE: return "note";
-		default: return severity;
-	}
-}
-function normalizeFindingForFingerprint(finding) {
-	return finding.toLowerCase().replace(/\s+/g, " ").trim().slice(0, FINGERPRINT_FINDING_MAX_CHARS);
-}
-function toArtifactUri(filePath) {
-	return filePath.replace(/\\/g, "/").split("/").map(encodeURIComponent).join("/");
-}
-function toSarifLocation(comment) {
-	if (!comment.file) return;
-	const physicalLocation = { artifactLocation: { uri: toArtifactUri(comment.file) } };
-	if (comment.line) {
-		const startLine = comment.startLine ?? comment.line;
-		const endLine = comment.line;
-		const region = { startLine };
-		if (endLine > startLine) region.endLine = endLine;
-		physicalLocation.region = region;
-	}
-	return [{ physicalLocation }];
-}
-function toSarifResult(comment) {
-	return {
-		ruleId: GENERIC_RULE_ID,
-		level: toSarifLevel(comment.severity),
-		message: { text: comment.finding },
-		locations: toSarifLocation(comment),
-		partialFingerprints: { promptfooFindingHash: sha256([
-			comment.file ?? "",
-			GENERIC_RULE_ID,
-			comment.severity ?? "",
-			normalizeFindingForFingerprint(comment.finding)
-		].join(" ")) },
-		properties: {
-			severity: comment.severity,
-			fix: comment.fix,
-			aiAgentPrompt: comment.aiAgentPrompt
-		}
-	};
-}
-function scanResponseToSarif(response) {
-	const results = response.comments.filter(isSarifReportableFinding).map(toSarifResult);
-	const driver = {
-		name: "Promptfoo Code Scan",
-		informationUri: TOOL_INFORMATION_URI,
-		rules: results.length > 0 ? [SARIF_RULE] : []
-	};
-	driver.semanticVersion = VERSION;
-	const run = {
-		tool: { driver },
-		results
-	};
-	if (response.review) run.properties = { promptfoo: { review: response.review } };
-	return {
-		$schema: SARIF_SCHEMA_URL,
-		version: SARIF_VERSION,
-		runs: [run]
-	};
-}
-//#endregion
-//#region src/codeScan/scanner/output.ts
-/**
-* Output Formatting and Display
-*
-* Handles formatting and displaying scan results in various formats (JSON, pretty-print).
-*/
-/**
-* Create spinner if appropriate for the current environment
-*
-* @param options - Options for spinner creation
-* @returns Spinner instance or undefined if spinner should not be shown
-*/
-function createSpinner(options) {
-	if (!options.isWebUI && options.format === CodeScanOutputFormat.TEXT && options.logLevel !== "debug") return ora({
-		text: "",
-		color: "green"
-	}).start();
-}
-/**
-* Display scan results in the appropriate format
-*
-* @param response - Scan response from server
-* @param duration - Duration of scan in milliseconds
-* @param options - Output options
-*/
-function displayScanResults(response, duration, options) {
-	if (options.format === CodeScanOutputFormat.JSON) console.log(JSON.stringify(response, null, 2));
-	else if (options.format === CodeScanOutputFormat.SARIF) console.log(JSON.stringify(scanResponseToSarif(response), null, 2));
-	else {
-		const { comments, review } = response;
-		const severityCounts = countBySeverity(comments || []);
-		printBorder();
-		logger.info(`${chalk.green("✓")} Scan complete (${formatDuration(duration / 1e3)})`);
-		if (severityCounts.total > 0) logger.info(chalk.yellow(`⚠ Found ${severityCounts.total} issue${severityCounts.total === 1 ? "" : "s"}`));
-		printBorder();
-		let reviewText = review;
-		if (!reviewText && comments && comments.length > 0) {
-			const noneComment = comments.find((c) => c.severity === CodeScanSeverity.NONE);
-			if (noneComment) reviewText = noneComment.finding;
-		}
-		if (reviewText) {
-			logger.info("");
-			logger.info(reviewText);
-			logger.info("");
-			printBorder();
-		}
-		if (severityCounts.total > 0) {
-			const sortedComments = [...filterBySeverity(comments || [])].sort((a, b) => {
-				const rankA = a.severity ? getSeverityRank(a.severity) : 0;
-				return (b.severity ? getSeverityRank(b.severity) : 0) - rankA;
-			});
-			logger.info("");
-			for (let i = 0; i < sortedComments.length; i++) {
-				const comment = sortedComments[i];
-				const severity = formatSeverity(comment.severity);
-				const location = comment.line ? `${comment.file}:${comment.line}` : comment.file || "";
-				logger.info(`${severity} ${chalk.gray(location)}`);
-				logger.info("");
-				logger.info(comment.finding);
-				if (comment.fix) {
-					logger.info("");
-					logger.info(chalk.bold("Suggested Fix:"));
-					logger.info(comment.fix);
-				}
-				if (comment.aiAgentPrompt) {
-					logger.info("");
-					logger.info(chalk.bold("AI Agent Prompt:"));
-					logger.info(comment.aiAgentPrompt);
-				}
-				if (i < sortedComments.length - 1) {
-					logger.info("");
-					logger.info(chalk.gray("─".repeat(TERMINAL_MAX_WIDTH)));
-					logger.info("");
-				}
-			}
-			printBorder();
-			if (options.githubPr) {
-				logger.info(`» Comments posted to PR: ${chalk.cyan(options.githubPr)}`);
-				printBorder();
-			}
-		}
-	}
-}
-//#endregion
-//#region src/codeScan/scanner/request.ts
-/**
-* Scan Request Building and Execution
-*
-* Handles building scan requests and executing them via the agent client.
-*/
-const CAPACITY_ERROR_MESSAGE = "Server at capacity";
-const MCP_REQUEST_TIMEOUT_ERROR_MESSAGE = "MCP error -32001: Request timed out";
-const MAX_CAPACITY_ATTEMPTS = 7;
-const MAX_MCP_TIMEOUT_ATTEMPTS = 2;
-const BASE_DELAY_MS = 1e3;
-/**
-* Build scan request from inputs
-*
-* @param files - Files to scan
-* @param metadata - Git metadata
-* @param config - Scan configuration
-* @param sessionId - Session ID for scan tracking and cancellation
-* @param pullRequest - Optional PR context
-* @param guidance - Optional custom guidance
-* @returns Scan request object
-*/
-function buildScanRequest(files, metadata, config, sessionId, pullRequest, guidance) {
-	return {
-		files,
-		metadata,
-		config: {
-			minimumSeverity: config.minimumSeverity,
-			diffsOnly: config.diffsOnly,
-			guidance
-		},
-		sessionId,
-		pullRequest
-	};
-}
-/**
-* Execute scan request via agent client
-*
-* Uses the agent lifecycle protocol:
-* - client.start(request) → emits agent:start
-* - client.onComplete(cb) → listens agent:complete
-* - client.onError(cb) → listens agent:error
-* - client.cancel() → emits agent:cancel
-*
-* @param client - Connected agent client
-* @param request - Scan request to send
-* @param options - Execution options
-* @returns Promise resolving to scan response
-* @throws Error if scan fails, connection lost, or user cancels
-*/
-async function executeScanRequest(client, request, options) {
-	const { spinner, abortController } = options;
-	if (spinner) spinner.text = "Scanning...";
-	let heartbeatInterval;
-	let firstPulseTimeout;
-	if (spinner) {
-		const pulse = () => {
-			spinner.text = "Still scanning...";
-			setTimeout(() => {
-				if (spinner?.isSpinning) spinner.text = "Scanning...";
-			}, 4e3);
-		};
-		firstPulseTimeout = setTimeout(() => {
-			pulse();
-			heartbeatInterval = setInterval(pulse, 12e3);
-		}, 8e3);
-	}
-	return await new Promise((resolve, reject) => {
-		const cleanupTimers = () => {
-			clearTimeout(firstPulseTimeout);
-			clearInterval(heartbeatInterval);
-		};
-		client.onComplete((response) => {
-			cleanupTimers();
-			abortController.signal.removeEventListener("abort", onAbort);
-			client.socket.io.off("reconnect_failed", onReconnectFailed);
-			resolve(response);
-		});
-		client.onError((error) => {
-			cleanupTimers();
-			abortController.signal.removeEventListener("abort", onAbort);
-			client.socket.io.off("reconnect_failed", onReconnectFailed);
-			reject(new Error(error.message || error.type));
-		});
-		client.onCancelled(() => {
-			cleanupTimers();
-			abortController.signal.removeEventListener("abort", onAbort);
-			client.socket.io.off("reconnect_failed", onReconnectFailed);
-			reject(/* @__PURE__ */ new Error("Scan cancelled by server"));
-		});
-		const onReconnectFailed = () => {
-			cleanupTimers();
-			abortController.signal.removeEventListener("abort", onAbort);
-			reject(/* @__PURE__ */ new Error("Lost connection to server during scan"));
-		};
-		const onAbort = () => {
-			client.cancel();
-			cleanupTimers();
-			client.socket.io.off("reconnect_failed", onReconnectFailed);
-			abortController.signal.removeEventListener("abort", onAbort);
-			reject(/* @__PURE__ */ new Error("cancelled by user"));
-		};
-		client.socket.io.once("reconnect_failed", onReconnectFailed);
-		abortController.signal.addEventListener("abort", onAbort);
-		client.start(request);
-	});
-}
-/**
-* Execute scan request with retry for transient scanner errors
-*
-* When the server is at capacity, it returns "Server at capacity. Please retry."
-* This wrapper retries with exponential backoff + jitter to spread load. Remote
-* MCP request timeouts get one retry because each failed attempt already waited
-* on the server-side request timeout.
-*
-* Capacity backoff schedule: ~1s, ~2s, ~4s, ~8s, ~16s, ~32s (up to 7 attempts, ~63s max)
-* MCP timeout backoff: ~1s (up to 2 attempts)
-*
-* @param client - Connected agent client
-* @param request - Scan request to send
-* @param options - Execution options
-* @returns Promise resolving to scan response
-* @throws Error if scan fails after all retries
-*/
-async function executeScanRequestWithRetry(client, request, options) {
-	const { spinner } = options;
-	const attemptsByPolicy = /* @__PURE__ */ new Map();
-	while (true) try {
-		return await executeScanRequest(client, request, options);
-	} catch (error) {
-		const getRetryPolicy = () => {
-			if (error instanceof Error && error.message.includes(CAPACITY_ERROR_MESSAGE)) return {
-				key: "capacity",
-				maxAttempts: MAX_CAPACITY_ATTEMPTS,
-				status: "Server busy",
-				waitStatus: "Server busy"
-			};
-			if (error instanceof Error && error.message.includes(MCP_REQUEST_TIMEOUT_ERROR_MESSAGE)) return {
-				key: "mcp_timeout",
-				maxAttempts: MAX_MCP_TIMEOUT_ATTEMPTS,
-				status: "Code scan timed out waiting for repository access",
-				waitStatus: "Repository access timed out"
-			};
-		};
-		const retryPolicy = getRetryPolicy();
-		if (!retryPolicy) throw error;
-		const policyAttempts = (attemptsByPolicy.get(retryPolicy.key) ?? 0) + 1;
-		attemptsByPolicy.set(retryPolicy.key, policyAttempts);
-		if (policyAttempts >= retryPolicy.maxAttempts) throw error;
-		const delay = BASE_DELAY_MS * Math.pow(2, policyAttempts - 1) * (.7 + .6 * Math.random());
-		logger.debug(`${retryPolicy.status}, retrying in ${Math.round(delay / 1e3)}s (attempt ${policyAttempts}/${retryPolicy.maxAttempts})`);
-		if (spinner) {
-			const originalText = spinner.text;
-			spinner.text = `${retryPolicy.waitStatus}, retrying in ${Math.round(delay / 1e3)}s...`;
-			await sleepWithAbort(delay, options.abortController.signal);
-			spinner.text = originalText;
-		} else await sleepWithAbort(delay, options.abortController.signal);
-	}
-}
-//#endregion
-//#region src/codeScan/scanner/index.ts
-/**
-* Core Scan Execution Logic
-*
-* Main entry point for scanner module - orchestrates the complete scan process.
-*/
-async function describeEmptyScan(git, files, baseBranch, compareRef) {
-	const details = [`No files to scan in ${baseBranch}...${compareRef}.`];
-	const skipped = files.filter((file) => file.skipReason);
-	const reasons = [...new Set(skipped.map((file) => file.skipReason))].join(", ");
-	details.push(files.length === 0 ? "There are no net file changes in this range." : `${files.length} changed file(s) contain no scannable patches.`);
-	if (skipped.length) details.push(`${skipped.length} file(s) skipped: ${reasons}.`);
-	try {
-		const dirtyCount = (await git.status()).files.length;
-		if (dirtyCount) details.push(`${dirtyCount} uncommitted file(s) are not part of the scan.`);
-	} catch {}
-	details.push("Commit relevant changes, or use --base/--compare to select another range.");
-	return details.join(" ");
-}
-function resolveOutputFormat(options) {
-	const parsed = CodeScanOutputFormatSchema.safeParse(options.format ?? CodeScanOutputFormat.TEXT);
-	if (!parsed.success) throw new Error(`Invalid output format "${options.format}". Expected one of: text, json, sarif`);
-	if (options.json && parsed.data === CodeScanOutputFormat.SARIF) throw new Error("Cannot combine --json with --format sarif");
-	return options.json ? CodeScanOutputFormat.JSON : parsed.data;
-}
-const createFlushCallback = (exitCode) => async () => {
-	await new Promise((resolve) => setTimeout(resolve, 100));
-	process.exitCode = exitCode;
-};
-/**
-* Execute a complete security scan
-*
-* This is the main entry point for the scanner - it orchestrates:
-* - Configuration loading
-* - Agent client connection (shared Socket.IO layer)
-* - MCP bridge setup (if not diffs-only)
-* - Git diff processing
-* - Scan request execution
-* - Result display
-* - Cleanup
-*
-* @param repoPath - Path to repository to scan
-* @param options - Scan options from CLI
-*/
-async function executeScan(repoPath, options) {
-	let client = null;
-	let mcpProcess = null;
-	let mcpBridge = null;
-	let sessionId = void 0;
-	const abortController = new AbortController();
-	const originalLogLevel = getLogLevel();
-	const structuredOutputRequested = options.json === true || options.format === CodeScanOutputFormat.JSON || options.format === CodeScanOutputFormat.SARIF;
-	const absoluteRepoPath = path.resolve(repoPath);
-	let outputFormat = null;
-	let spinner;
-	const startTime = Date.now();
-	const displayResults = (response, format) => displayScanResults(response, Date.now() - startTime, {
-		format,
-		githubPr: options.githubPr
-	});
-	try {
-		outputFormat = resolveOutputFormat(options);
-		if (outputFormat !== CodeScanOutputFormat.TEXT) setLogLevel("error");
-		const config = mergeConfigWithOptions(loadConfigOrDefault(options.config), options);
-		const guidance = resolveGuidance(options, config);
-		if (outputFormat === CodeScanOutputFormat.TEXT) {
-			logger.info("Beginning scan for LLM-related vulnerabilities in your code.");
-			logger.info(`  Minimum severity: ${config.minimumSeverity}`);
-			if (config.diffsOnly) logger.info(`  Mode: diffs only`);
-			else logger.info(`  Mode: diffs + tracing into repo`);
-			logger.info("");
-		}
-		logger.debug(`Repository: ${absoluteRepoPath}`);
-		registerCleanupHandlers(abortController);
-		spinner = createSpinner({
-			format: outputFormat,
-			isWebUI: Boolean(state.webUI),
-			logLevel: getLogLevel()
-		});
-		let parsedPR;
-		if (options.githubPr) {
-			const parsed = parseGitHubPr(options.githubPr);
-			if (!parsed) throw new Error(`Invalid --github-pr format: "${options.githubPr}". Expected format: owner/repo#number (e.g., promptfoo/promptfoo#123)`);
-			parsedPR = parsed;
-		}
-		if (!spinner) logger.debug("Connecting to server...");
-		client = await createAgentClient({
-			agent: "code-scan",
-			host: config.apiHost || "https://api.promptfoo.app",
-			auth: resolveAuthCredentials(options.apiKey, parsedPR)
-		});
-		sessionId = client.sessionId;
-		if (!config.diffsOnly) {
-			logger.debug("Setting up repo MCP access...");
-			logger.debug(`Using session ID: ${sessionId}`);
-			const startedMcpProcess = startFilesystemMcpServer(absoluteRepoPath);
-			try {
-				await waitForFilesystemMcpServerReady(startedMcpProcess);
-				logger.debug("Filesystem MCP server ready");
-				const connectedMcpBridge = new SocketIoMcpBridge(startedMcpProcess, client.socket, sessionId);
-				await connectedMcpBridge.connect();
-				client.socket.emit("runner:hello", {
-					session_id: sessionId,
-					repo_root: absoluteRepoPath
-				});
-				mcpProcess = startedMcpProcess;
-				mcpBridge = connectedMcpBridge;
-			} catch (error) {
-				await stopFilesystemMcpServer(startedMcpProcess);
-				throw error;
-			}
-		}
-		logger.debug("Processing git diff...");
-		const { simpleGit } = await import("simple-git");
-		const git = simpleGit(absoluteRepoPath);
-		if (!options.compare) await validateOnBranch(git);
-		let baseBranch;
-		if (options.base) baseBranch = options.base;
-		else {
-			const branches = await git.branch();
-			baseBranch = branches.all.includes("main") || branches.all.includes("origin/main") ? "main" : branches.all.includes("master") || branches.all.includes("origin/master") ? "master" : "main";
-		}
-		const compareRef = options.compare || "HEAD";
-		logger.debug(`Comparing: ${baseBranch}...${compareRef}`);
-		const files = await processDiff(absoluteRepoPath, baseBranch, compareRef);
-		const includedFiles = files.filter((f) => !f.skipReason && f.patch);
-		logger.debug(`Files changed: ${files.length} (${includedFiles.length} included, ${files.filter((f) => f.skipReason).length} skipped)`);
-		if (includedFiles.length === 0) {
-			if (outputFormat === CodeScanOutputFormat.TEXT) {
-				const msg = await describeEmptyScan(git, files, baseBranch, compareRef);
-				if (spinner) spinner.succeed(msg);
-				else logger.info(msg);
-			} else displayResults({
-				success: true,
-				comments: [],
-				review: "No files to scan"
-			}, outputFormat);
-			state.postActionCallback = createFlushCallback(0);
-			return;
-		}
-		const metadata = await extractMetadata(absoluteRepoPath, baseBranch, compareRef);
-		logger.debug(`Compare ref: ${metadata.branch}`);
-		logger.debug(`Commits: ${metadata.commitMessages.length}`);
-		let pullRequest = void 0;
-		if (parsedPR) {
-			const currentCommit = await git.revparse(["HEAD"]);
-			pullRequest = {
-				owner: parsedPR.owner,
-				repo: parsedPR.repo,
-				number: parsedPR.number,
-				sha: currentCommit.trim()
-			};
-			logger.debug(`GitHub PR context: ${parsedPR.owner}/${parsedPR.repo}#${parsedPR.number} (${pullRequest.sha.substring(0, 7)})`);
-		}
-		if (!spinner) logger.debug("Scanning code...");
-		const scanRequest = buildScanRequest(files, metadata, config, sessionId, pullRequest, guidance);
-		const scanResponse = await executeScanRequestWithRetry(client, scanRequest, {
-			spinner,
-			abortController
-		});
-		if (spinner) spinner.stop();
-		displayResults(scanResponse, outputFormat);
-	} catch (error) {
-		const errorMessage = error instanceof Error ? error.message : String(error);
-		if (errorMessage.includes("Fork PR scanning not authorized")) {
-			const msg = "Fork PR scanning requires maintainer approval. See PR comment for options.";
-			if (outputFormat === CodeScanOutputFormat.JSON) displayResults({
-				success: true,
-				comments: [],
-				skipReason: msg
-			}, outputFormat);
-			else if (outputFormat === CodeScanOutputFormat.SARIF) {
-				console.error(`Scan skipped: ${msg} SARIF output was not generated because the scan did not complete.`);
-				state.postActionCallback = createFlushCallback(1);
-				return;
-			} else if (spinner) spinner.succeed(msg);
-			else logger.info(msg);
-			state.postActionCallback = createFlushCallback(0);
-			return;
-		}
-		const msg = `Scan failed: ${errorMessage}`;
-		if (spinner) spinner.fail(msg);
-		else if (structuredOutputRequested) console.error(msg);
-		else logger.error(msg);
-		state.postActionCallback = async () => {
-			await new Promise((resolve) => setTimeout(resolve, 100));
-			if (error instanceof Error && error.message === "cancelled by user") process.exitCode = 130;
-			else process.exitCode = 1;
-		};
-	} finally {
-		if (mcpBridge) await mcpBridge.disconnect().catch(() => {
-			logger.debug("MCP bridge cleanup completed");
-		});
-		if (mcpProcess) await stopFilesystemMcpServer(mcpProcess).catch(() => {
-			logger.debug("MCP server cleanup completed");
-		});
-		if (client) {
-			client.disconnect();
-			logger.debug("Agent client disconnected");
-		}
-		if (outputFormat !== null && outputFormat !== CodeScanOutputFormat.TEXT && getLogLevel() !== originalLogLevel) setLogLevel(originalLogLevel);
-	}
-}
-//#endregion
-export { executeScan };
-
-//# sourceMappingURL=scanner-DGjIiTZ1.js.map