The highest tagged major version is
Documentation
¶
Overview ¶
-- internal/cli/audit.go --
-- internal/cli/check.go --
-- internal/cli/diff_logic.go --
-- internal/cli/index.go --
-- internal/cli/interfaces.go --
-- internal/cli/migrate.go --
-- internal/cli/sandbox_adapter.go --
-- internal/cli/scan.go --
-- internal/cli/stats.go --
-- internal/cli/utils.go --
Index ¶
- Constants
- func CollectFiles(fsys FileSystem, target string) ([]string, error)
- func ConfigureTypeCache()
- func ExitError(err error)
- func GetPathSize(fsys FileSystem, path string) (int64, error)
- func HumanizeBytes(bytes int64) string
- func IsJSON(path string) bool
- func LoadAndFingerprint(fsys FileSystem, filename string) ([]diff.FingerprintResult, error)
- func PrepareSandboxDB(originalPath string) (string, func(), error)
- func ProcessFile(fsys FileSystem, filename string, strictMode bool, scanner SignatureScanner) models.FileOutput
- func ProcessFilesParallel(fsys FileSystem, files []string, strictMode bool, scanner SignatureScanner) ([]models.FileOutput, bool, error)
- func ReadDiffPairs(fsys FileSystem, pairsFile string) ([]api.DiffPair, error)
- func ResolveDBPath(path string) string
- func RunAudit(w io.Writer, oldFile, newFile, commitMsg, apiKey, model, apiBase string, ...) (int, error)
- func RunCheck(target string, strictMode bool, enableScan bool, dbPath string, noSandbox bool) error
- func RunCheckLogic(fsys FileSystem, target string, strictMode bool, enableScan bool, ...) error
- func RunDepsDiff(oldDir, newDir string, noSandbox bool) error
- func RunDepsDiffLogic(w io.Writer, oldDir, newDir string) error
- func RunDiff(oldFile, newFile string, noSandbox bool) error
- func RunDiffBatch(pairsFile string, noSandbox bool) error
- func RunDiffBatchLogic(fsys FileSystem, w io.Writer, pairsFile string) error
- func RunDiffLogic(fsys FileSystem, w io.Writer, oldFile, newFile string) error
- func RunIndex(target, name, severity, category, dbPath string) error
- func RunIndexJSON(target string, results []diff.FingerprintResult, ...) ([]detection.Signature, int, error)
- func RunIndexPebble(target string, results []diff.FingerprintResult, ...) ([]detection.Signature, int, error)
- func RunMigrate(fromPath, toPath string) error
- func RunScan(target string, opts models.ScanOptions, noSandbox bool) error
- func RunScanDeps(pkgLoader PackageLoader, target string, opts models.ScanOptions, ...) ([]detection.ScanResult, int, []string, error)
- func RunScanLogic(fsys FileSystem, pkgLoader PackageLoader, target string, ...) error
- func RunScanParallel(fsys FileSystem, files []string, scanner SignatureScanner, exactOnly bool) ([]detection.ScanResult, int, error)
- func RunStats(dbPath string) error
- func SandboxExec(sb Sandboxer, stdout, stderr io.Writer, command string, args []string, ...) error
- func ShortFunctionName(fullName string) string
- func SuggestCommand(cmd string) string
- type FileSystem
- type PackageLoader
- type RealFileSystem
- type RealPackageLoader
- type RealSandboxer
- type Sandboxer
- type SignatureScanner
Constants ¶
const (
MaxSourceFileSize = 10 * 1024 * 1024
)
Variables ¶
This section is empty.
Functions ¶
func CollectFiles ¶
func CollectFiles(fsys FileSystem, target string) ([]string, error)
Recursively finds Go files using the provided FileSystem.
func ConfigureTypeCache ¶
func ConfigureTypeCache()
ConfigureTypeCache decides, once at startup, whether this run uses the persistent type cache (see diff.TypeCacheEnvVar), and records the decision in the environment, where the analysis and any worker it starts read it. SFW_TYPE_CACHE=on or off decides, and "rw:DIR" or "ro:DIR" names a cache directly. Unset, the cache is on only for a person at a terminal: stderr is a terminal and CI is unset. An automated run, where a pull request's code may have run earlier under the same account, starts clean. The cache lives under sfw/types in the user cache directory; a sandboxed worker only reads it (see internal/sandbox).
func GetPathSize ¶
func GetPathSize(fsys FileSystem, path string) (int64, error)
Calculates the size of a file or recursively sums the size of a directory.
func HumanizeBytes ¶
func LoadAndFingerprint ¶
func LoadAndFingerprint(fsys FileSystem, filename string) ([]diff.FingerprintResult, error)
This reads a file and generates semantic fingerprints using the provided FS.
func PrepareSandboxDB ¶
PrepareSandboxDB ensures a database is usable inside the sandbox. If running sandboxed (where mounts are typically ReadOnly), PebbleDB fails to lock. This copies the DB to a secure, writable temp directory. Returns: newPath, cleanupFunc, error
func ProcessFile ¶
func ProcessFile(fsys FileSystem, filename string, strictMode bool, scanner SignatureScanner) models.FileOutput
func ProcessFilesParallel ¶
func ProcessFilesParallel(fsys FileSystem, files []string, strictMode bool, scanner SignatureScanner) ([]models.FileOutput, bool, error)
func ReadDiffPairs ¶
func ReadDiffPairs(fsys FileSystem, pairsFile string) ([]api.DiffPair, error)
ReadDiffPairs reads a pairs file: NUL-terminated paths, alternately the old and the new version of each file ("old1\x00new1\x00old2\x00new2\x00"). An empty path stands for an absent side.
func ResolveDBPath ¶
func RunCheckLogic ¶
func RunDepsDiff ¶
RunDepsDiff compares the third-party code compiled into two trees of a module, inside the sandbox unless noSandbox is set.
func RunDepsDiffLogic ¶
RunDepsDiffLogic is the CLI shim around api.DepsDiff.
func RunDiffBatch ¶
RunDiffBatch diffs the file pairs listed in pairsFile (see ReadDiffPairs), inside the sandbox unless noSandbox is set.
func RunDiffBatchLogic ¶
func RunDiffBatchLogic(fsys FileSystem, w io.Writer, pairsFile string) error
RunDiffBatchLogic prints the JSON array of api.DiffBatch results for the pairs in pairsFile, in order. It returns an error, after printing, when a pair could not be diffed; that pair's entry carries the reason in "error".
func RunDiffLogic ¶
func RunDiffLogic(fsys FileSystem, w io.Writer, oldFile, newFile string) error
RunDiffLogic is the CLI shim around api.DiffWithFS. The diff computation itself lives in pkg/api so external integrations (the MCP server, third-party Go callers) can invoke it without importing internal/cli.
func RunIndexJSON ¶
func RunIndexPebble ¶
func RunMigrate ¶
func RunScanDeps ¶
func RunScanDeps(pkgLoader PackageLoader, target string, opts models.ScanOptions, scanner SignatureScanner) ([]detection.ScanResult, int, []string, error)
func RunScanLogic ¶
func RunScanLogic(fsys FileSystem, pkgLoader PackageLoader, target string, opts models.ScanOptions) error
func RunScanParallel ¶
func RunScanParallel(fsys FileSystem, files []string, scanner SignatureScanner, exactOnly bool) ([]detection.ScanResult, int, error)
func SandboxExec ¶
func SandboxExec(sb Sandboxer, stdout, stderr io.Writer, command string, args []string, inputs ...string) error
elegates the current command to the sandbox with explicit mount points.
func ShortFunctionName ¶
ShortFunctionName delegates to pkg/api so the CLI and external integrations share a single implementation. Kept as a wrapper rather than a re-export to avoid forcing every internal/cli caller to import pkg/api directly.
func SuggestCommand ¶
Types ¶
type FileSystem ¶
type FileSystem = api.FileSystem
FileSystem is re-exported from pkg/api so external integrations (e.g. the MCP server) and internal callers see the same type.
type PackageLoader ¶
type PackageLoader interface {
Load(cfg *packages.Config, patterns ...string) ([]*packages.Package, error)
}
PackageLoader abstracts the go/packages loading for dependency scanning.
type RealFileSystem ¶
type RealFileSystem = api.RealFileSystem
RealFileSystem is re-exported from pkg/api so internal callers stay on the existing name while external integrations import the canonical version from pkg/api directly.
type RealSandboxer ¶
type RealSandboxer struct{}
Implements the Sandboxer interface using the internal sandbox package.
func (RealSandboxer) IsSandboxed ¶
func (rs RealSandboxer) IsSandboxed() bool
type Sandboxer ¶
type Sandboxer interface {
IsSandboxed() bool
Run(ctx context.Context, cfg sandbox.Config, stdout, stderr io.Writer) error
}
Sandboxer abstracts the process isolation mechanism.
type SignatureScanner ¶
type SignatureScanner interface {
ScanTopology(topo *topology.FunctionTopology, funcName string) ([]detection.ScanResult, error)
ScanTopologyExact(topo *topology.FunctionTopology, funcName string) (*detection.ScanResult, error)
Close() error
}
SignatureScanner abstracts the underlying database backend (PebbleDB or JSON).
Source Files