Documentation
¶
Overview ¶
-- internal/cli/audit.go --
-- internal/cli/check.go --
-- internal/cli/diff_logic.go --
-- internal/cli/index.go --
-- internal/cli/interfaces.go --
-- internal/cli/migrate.go --
-- internal/cli/sandbox_adapter.go --
-- internal/cli/scan.go --
-- internal/cli/stats.go --
-- internal/cli/utils.go --
Index ¶
- func CollectFiles(fsys FileSystem, target string) ([]string, error)
- func ConfigureTypeCache()
- func ExitError(err error)
- func GetPathSize(fsys FileSystem, path string) (int64, error)
- func HumanizeBytes(bytes int64) string
- func IsJSON(path string) bool
- func PrepareSandboxDB(originalPath string) (string, func(), error)
- func ProcessFilesParallel(fsys FileSystem, files []string, strictMode bool, scanner SignatureScanner) ([]models.FileOutput, bool)
- func ReadDiffPairs(fsys FileSystem, pairsFile string) ([]api.DiffPair, error)
- func ResolveDBPath(path string) string
- func RunAudit(w io.Writer, oldFile, newFile, commitMsg, apiKey, model, apiBase string, ...) (int, error)
- func RunCheck(target string, strictMode bool, enableScan bool, dbPath string, noSandbox bool) error
- func RunCheckLogic(fsys FileSystem, target string, strictMode bool, enableScan bool, ...) error
- func RunDepsDiff(oldDir, newDir string, noSandbox bool) error
- func RunDepsDiffLogic(w io.Writer, oldDir, newDir string) error
- func RunDiff(oldFile, newFile string, noSandbox bool) error
- func RunDiffBatch(pairsFile string, noSandbox, nonGo bool) error
- func RunDiffBatchLogic(fsys FileSystem, w io.Writer, pairsFile string, nonGo bool) error
- func RunDiffLogic(fsys FileSystem, w io.Writer, oldFile, newFile string) error
- func RunIndex(target, name, severity, category, dbPath string) error
- func RunIndexJSON(results []diff.FingerprintResult, name, severity, category, dbPath string) ([]detection.Signature, int, error)
- func RunIndexPebble(results []diff.FingerprintResult, name, severity, category, dbPath string) ([]detection.Signature, int, error)
- func RunMigrate(fromPath, toPath string) error
- func RunScan(target string, opts models.ScanOptions, noSandbox bool) error
- func RunScanDeps(pkgLoader PackageLoader, target string, opts models.ScanOptions, ...) ([]detection.ScanResult, int, []string, error)
- func RunScanLogic(fsys FileSystem, pkgLoader PackageLoader, target string, ...) error
- func RunScanParallel(fsys FileSystem, files []string, scanner SignatureScanner, exactOnly bool) ([]detection.ScanResult, int)
- func RunStats(dbPath string) error
- func SandboxExec(sb Sandboxer, stdout, stderr io.Writer, command string, args []string, ...) error
- func SuggestCommand(cmd string) string
- type FileSystem
- type PackageLoader
- type RealFileSystem
- type RealPackageLoader
- type RealSandboxer
- type Sandboxer
- type SignatureScanner
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CollectFiles ¶
func CollectFiles(fsys FileSystem, target string) ([]string, error)
Recursively finds Go files using the provided FileSystem.
func ConfigureTypeCache ¶
func ConfigureTypeCache()
ConfigureTypeCache decides, once at startup, whether this run uses the persistent type cache (see diff.TypeCacheEnvVar), and records the decision in the environment, where the analysis and any worker it starts read it. SFW_TYPE_CACHE=on or off decides, and "rw:DIR" or "ro:DIR" names a cache directly. Unset, the cache is on only for a person at a terminal: stderr is a terminal and CI is unset. An automated run, where a pull request's code may have run earlier under the same account, starts clean. The cache lives under sfw/types in the user cache directory; a sandboxed worker only reads it (see internal/sandbox).
func GetPathSize ¶
func GetPathSize(fsys FileSystem, path string) (int64, error)
Calculates the size of a file or recursively sums the size of a directory.
func HumanizeBytes ¶
func PrepareSandboxDB ¶
PrepareSandboxDB ensures a database is usable inside the sandbox. If running sandboxed (where mounts are typically ReadOnly), PebbleDB fails to lock. This copies the DB to a secure, writable temp directory. Returns: newPath, cleanupFunc, error
func ProcessFilesParallel ¶
func ProcessFilesParallel(fsys FileSystem, files []string, strictMode bool, scanner SignatureScanner) ([]models.FileOutput, bool)
ProcessFilesParallel fingerprints files (see api.FingerprintFiles) and, with a scanner, scans each function once: a function listed under several files (the package initializer) is scanned under the first. A file whose load fails, or whose scan panics, gets an ErrorMessage and sets hasErrors.
func ReadDiffPairs ¶
func ReadDiffPairs(fsys FileSystem, pairsFile string) ([]api.DiffPair, error)
ReadDiffPairs reads a pairs file: NUL-terminated paths, alternately the old and the new version of each file ("old1\x00new1\x00old2\x00new2\x00"). An empty path stands for an absent side.
func ResolveDBPath ¶
func RunCheckLogic ¶
func RunDepsDiff ¶
RunDepsDiff compares the third-party code compiled into two trees of a module, inside the sandbox unless noSandbox is set.
func RunDepsDiffLogic ¶
RunDepsDiffLogic is the CLI shim around api.DepsDiff.
func RunDiffBatch ¶
RunDiffBatch diffs the file pairs listed in pairsFile (see ReadDiffPairs), inside the sandbox unless noSandbox is set. With nonGo, a pair with no Go file is reported by what the build makes of it (see api.BatchOptions).
func RunDiffBatchLogic ¶
RunDiffBatchLogic prints the JSON array of api.DiffBatch results for the pairs in pairsFile, in order. It returns an error, after printing, when a pair could not be diffed; that pair's entry carries the reason in "error".
func RunDiffLogic ¶
func RunDiffLogic(fsys FileSystem, w io.Writer, oldFile, newFile string) error
RunDiffLogic is the CLI shim around api.DiffWithFS. The diff computation itself lives in pkg/api so external integrations (the MCP server, third-party Go callers) can invoke it without importing internal/cli.
func RunIndexJSON ¶
func RunIndexPebble ¶
func RunMigrate ¶
func RunScanDeps ¶
func RunScanDeps(pkgLoader PackageLoader, target string, opts models.ScanOptions, scanner SignatureScanner) ([]detection.ScanResult, int, []string, error)
func RunScanLogic ¶
func RunScanLogic(fsys FileSystem, pkgLoader PackageLoader, target string, opts models.ScanOptions) error
func RunScanParallel ¶
func RunScanParallel(fsys FileSystem, files []string, scanner SignatureScanner, exactOnly bool) ([]detection.ScanResult, int)
RunScanParallel scans every function of files once, GOMAXPROCS at a time, and returns the alerts and the number of functions scanned.
func SandboxExec ¶
func SandboxExec(sb Sandboxer, stdout, stderr io.Writer, command string, args []string, inputs ...string) error
elegates the current command to the sandbox with explicit mount points.
func SuggestCommand ¶
Types ¶
type FileSystem ¶
type FileSystem = api.FileSystem
FileSystem is re-exported from pkg/api so external integrations (e.g. the MCP server) and internal callers see the same type.
type PackageLoader ¶
type PackageLoader interface {
Load(cfg *packages.Config, patterns ...string) ([]*packages.Package, error)
}
PackageLoader abstracts the go/packages loading for dependency scanning.
type RealFileSystem ¶
type RealFileSystem = api.RealFileSystem
RealFileSystem is re-exported from pkg/api so internal callers stay on the existing name while external integrations import the canonical version from pkg/api directly.
type RealSandboxer ¶
type RealSandboxer struct{}
Implements the Sandboxer interface using the internal sandbox package.
func (RealSandboxer) IsSandboxed ¶
func (rs RealSandboxer) IsSandboxed() bool
type Sandboxer ¶
type Sandboxer interface {
IsSandboxed() bool
Run(ctx context.Context, cfg sandbox.Config, stdout, stderr io.Writer) error
}
Sandboxer abstracts the process isolation mechanism.
type SignatureScanner ¶
type SignatureScanner interface {
ScanTopology(topo *topology.FunctionTopology, funcName string) ([]detection.ScanResult, error)
ScanTopologyExact(topo *topology.FunctionTopology, funcName string) (*detection.ScanResult, error)
SetMatchThreshold(threshold float64) error
Close() error
}
SignatureScanner abstracts the underlying database backend (PebbleDB or JSON).
Source Files