fix(dashboard): Findings/SBOM filter by onboarded targets; accurate target findings_count

The Findings and SBOM pages populated their target dropdown from the legacy `repositories` collection, so onboarded targets never appeared and their findings/SBOM couldn't be filtered by name (the data was there, keyed by the target id). Point both dropdowns at `onboarded_targets` via `fetch_targets`. Also refresh `OnboardedTarget.findings_count` at the end of `run_target`: the shared pipeline (Stage 7) increments the legacy `repositories` doc, which the unified path has none of, so the Targets page always showed 0. Set the accurate total (count of findings keyed by the target id) on the target itself. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-13 09:52:09 +02:00
82 changed files with 2259 additions and 6501 deletions
@@ -679,7 +679,6 @@ dependencies = [
 "rand 0.9.2",
 "regex",
 "reqwest",
 "roxmltree",
 "secrecy",
 "serde",
 "serde_json",
@@ -694,8 +693,6 @@ dependencies = [
 "tracing",
 "tracing-subscriber",
 "tramiton-core",
 "tramiton-repro",
 "tramiton-sbom",
 "urlencoding",
 "uuid",
 "walkdir",
@@ -3770,15 +3767,6 @@ dependencies = [
 "syn",
 ]
 [[package]]
 name = "object"
 version = "0.36.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
 dependencies = [
 "memchr",
 ]
 [[package]]
 name = "octocrab"
 version = "0.44.1"
@@ -4629,12 +4617,6 @@ dependencies = [
 "syn",
 ]
 [[package]]
 name = "roxmltree"
 version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
 [[package]]
 name = "rust-stemmers"
 version = "1.2.0"
@@ -5222,7 +5204,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
 "proc-macro2",
 "quote",
 "syn",
@@ -6157,8 +6139,8 @@ dependencies = [
 [[package]]
 name = "tramiton-core"
-version = "0.4.1"
+version = "0.4.0"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
+source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.0#e3dc1bf7027a2f6d7b1fe43043d6dfa887ce4af3"
 dependencies = [
 "serde",
 "tempfile",
@@ -6167,34 +6149,6 @@ dependencies = [
 "walkdir",
 ]
 [[package]]
 name = "tramiton-repro"
 version = "0.4.1"
 source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
 dependencies = [
 "serde",
 "serde_json",
 "sha2",
 "tempfile",
 "thiserror 1.0.69",
 "toml",
 "tramiton-core",
 "walkdir",
 ]
 [[package]]
 name = "tramiton-sbom"
 version = "0.4.1"
 source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
 dependencies = [
 "object",
 "serde",
 "serde_json",
 "sha2",
 "tramiton-core",
 "tramiton-repro",
 ]
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"
@@ -23,7 +23,7 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 chrono = { version = "0.4", features = ["serde"] }
 mongodb = { version = "3", features = ["rustls-tls", "compat-3-0-0"] }
-reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart"], default-features = false }
+reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
 thiserror = "2"
 sha2 = "0.10"
 hex = "0.4"
@@ -13,12 +13,6 @@ RUN --mount=type=secret,id=tramiton_token \
    fi && \
    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
 # A throwaway stage that packs a real nix store (store paths + the validity DB)
 # into a compressed bootstrap tarball. Only the tarball is copied into the final
 # image, so we don't carry a raw /nix copy layer.
 FROM nixos/nix:latest AS nixseed
 RUN tar -C / -czf /nix-bootstrap.tar.gz nix
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*
@@ -46,30 +40,7 @@ RUN pip3 install --break-system-packages semgrep
 # Install ruff for Python linting
 RUN pip3 install --break-system-packages ruff
 # Real nix for the tramiton reproducible-build firmware SBOM.
 #
 # nix-portable's proot fallback can't run here: user namespaces are blocked by
 # the container's default seccomp/apparmor profile, and orca exposes no way to
 # relax it. So ship a *real* nix and disable its build sandbox
 # (`sandbox = false`) — a plain gcc/make firmware build needs no user namespace,
 # so it runs fine under the locked-down profile with no proot involved.
 #
 # The store is shipped as a bootstrap tarball and seeded onto /nix at first
 # start (see docker/agent-entrypoint.sh), so a persistent /nix volume survives
 # redeploys. A missing/broken nix just falls back to the analysis-only SBOM.
 COPY --from=nixseed /nix-bootstrap.tar.gz /opt/nix-bootstrap.tar.gz
 ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
 RUN mkdir -p /etc/nix && printf '%s\n' \
      'experimental-features = nix-command flakes' \
      'sandbox = false' \
      'build-users-group =' \
      'substituters = https://cache.nixos.org' \
      'trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' \
      > /etc/nix/nix.conf
 COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent
 COPY docker/agent-entrypoint.sh /usr/local/bin/agent-entrypoint.sh
 RUN chmod +x /usr/local/bin/agent-entrypoint.sh
 # Copy documentation for the help chat assistant
 COPY --from=builder /app/README.md /app/README.md
@@ -81,6 +52,5 @@ RUN mkdir -p /data/compliance-scanner/ssh
 EXPOSE 3001 3002
-# Seeds /nix (fresh volume) from the bootstrap tarball, then runs the agent.
+ENTRYPOINT ["compliance-agent"]
 ENTRYPOINT ["/usr/local/bin/agent-entrypoint.sh"]
@@ -14,12 +14,7 @@ compliance-dast = { path = "../compliance-dast" }
 # Same-company IP, used directly (not via CLI) so the whole tramiton suite is
 # available to the onboarding classifier. NOTE: CI must be able to fetch this
 # private repo (see the git-auth step in .gitea/workflows/ci.yml).
-tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
+tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
 # tramiton-repro drives the reproducible build (NixBackend seal_and_build) that
 # yields a sealed lock; `libraries_from_inputs` is the analysis-only fallback.
 tramiton-repro = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
 # tramiton-sbom renders the bill of materials from a sealed lock (+ binary SCA).
 tramiton-sbom = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
@@ -34,7 +29,7 @@ hex = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
 regex = { workspace = true }
-axum = { version = "0.8", features = ["multipart"] }
+axum = "0.8"
 tower-http = { version = "0.6", features = ["cors", "trace", "set-header"] }
 git2 = "0.20"
 octocrab = "0.44"
@@ -42,8 +37,6 @@ tokio-cron-scheduler = "0.13"
 dotenvy = "0.15"
 hmac = "0.12"
 walkdir = "2"
 # Read-only XML tree parsing for PLCopen project files (POU extraction).
 roxmltree = "0.20"
 base64 = "0.22"
 urlencoding = "2"
 futures-util = "0.3"
@@ -65,5 +58,5 @@ tokio = { workspace = true }
 mongodb = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
-axum = { version = "0.8", features = ["multipart"] }
+axum = "0.8"
 tower-http = { version = "0.6", features = ["cors"] }
@@ -63,12 +63,21 @@ impl ComplianceAgent {
        let db = self.db_pool.for_tenant_id(tenant_id).await?;
        let orchestrator =
            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
        if self.config.unified_pipeline {
            orchestrator.run_target(repo_id, trigger).await
        } else {
            orchestrator.run(repo_id, trigger).await
        }
    }
-    /// Alias for [`Self::run_scan`] — every scan runs the unified onboarded-target
+    /// Run a scan for an onboarded target through the unified pipeline,
-    /// pipeline. Kept as a distinct name for the `/targets/{id}/scan` endpoint's
+    /// unconditionally.
-    /// intent.
+    ///
    /// Unlike [`Self::run_scan`], this does *not* consult the
    /// `unified_pipeline` transition flag: the caller (the `/targets/{id}/scan`
    /// endpoint) operates on `onboarded_targets` by construction, so it must
    /// always dispatch to `run_target` regardless of how the legacy paths
    /// (scheduler, webhooks, `/repositories/{id}/scan`) are configured.
    pub async fn run_target_scan(
        &self,
        tenant_id: &str,
@@ -91,19 +100,16 @@ impl ComplianceAgent {
        head_sha: &str,
    ) -> Result<(), crate::error::AgentError> {
        let db = self.db_pool.for_tenant_id(tenant_id).await?;
-        let oid = mongodb::bson::oid::ObjectId::parse_str(repo_id)
+        let repo = db
-            .map_err(|e| crate::error::AgentError::Other(e.to_string()))?;
+            .repositories()
-        let target = db
+            .find_one(mongodb::bson::doc! {
-            .onboarded_targets()
+                "_id": mongodb::bson::oid::ObjectId::parse_str(repo_id)
-            .find_one(mongodb::bson::doc! { "_id": oid })
+                    .map_err(|e| crate::error::AgentError::Other(e.to_string()))?
            })
            .await?
            .ok_or_else(|| {
-                crate::error::AgentError::Other(format!("Target {repo_id} not found"))
+                crate::error::AgentError::Other(format!("Repository {repo_id} not found"))
            })?;
        let code = target.code_artifact().ok_or_else(|| {
            crate::error::AgentError::Other(format!("Target {repo_id} has no code artifact"))
        })?;
        let repo = crate::pipeline::repo_view::RepoView::from_target(&target, code);
        let orchestrator =
            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
@@ -146,7 +146,7 @@ pub async fn build_embeddings(
    let agent_clone = (*agent).clone();
    tokio::spawn(async move {
        let repo = match db
-            .onboarded_targets()
+            .repositories()
            .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
            .await
        {
@@ -194,22 +194,14 @@ pub async fn build_embeddings(
                }
            };
        let code = match repo.code_artifact() {
            Some(c) => c,
            None => {
                tracing::error!("Target {repo_id} has no code artifact for embedding build");
                return;
            }
        };
        let view = crate::pipeline::repo_view::RepoView::from_target(&repo, code);
        let creds = crate::pipeline::git::RepoCredentials {
            ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
-            auth_token: view.auth_token.clone(),
+            auth_token: repo.auth_token.clone(),
-            auth_username: view.auth_username.clone(),
+            auth_username: repo.auth_username.clone(),
        };
        let git_ops =
            crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path, creds);
-        let repo_path = match git_ops.clone_or_fetch(&view.git_url, &view.name) {
+        let repo_path = match git_ops.clone_or_fetch(&repo.git_url, &repo.name) {
            Ok(p) => p,
            Err(e) => {
                tracing::error!("Failed to clone repo for embedding build: {e}");
@@ -255,7 +255,7 @@ pub async fn get_file_content(
    // Look up the repository to get repo name
    let repo = db
-        .onboarded_targets()
+        .repositories()
        .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
@@ -317,7 +317,7 @@ pub async fn trigger_build(
    let agent_clone = (*agent).clone();
    tokio::spawn(async move {
        let repo = match db
-            .onboarded_targets()
+            .repositories()
            .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
            .await
        {
@@ -328,22 +328,14 @@ pub async fn trigger_build(
            }
        };
        let code = match repo.code_artifact() {
            Some(c) => c,
            None => {
                tracing::error!("Target {repo_id} has no code artifact for graph build");
                return;
            }
        };
        let view = crate::pipeline::repo_view::RepoView::from_target(&repo, code);
        let creds = crate::pipeline::git::RepoCredentials {
            ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
-            auth_token: view.auth_token.clone(),
+            auth_token: repo.auth_token.clone(),
-            auth_username: view.auth_username.clone(),
+            auth_username: repo.auth_username.clone(),
        };
        let git_ops =
            crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path, creds);
-        let repo_path = match git_ops.clone_or_fetch(&view.git_url, &view.name) {
+        let repo_path = match git_ops.clone_or_fetch(&repo.git_url, &repo.name) {
            Ok(p) => p,
            Err(e) => {
                tracing::error!("Failed to clone repo for graph build: {e}");
@@ -10,18 +10,6 @@ pub async fn health() -> Json<serde_json::Value> {
    Json(serde_json::json!({ "status": "ok" }))
 }
 /// GET /api/v1/settings/ssh-public-key — the agent's SSH deploy public key,
 /// for adding as a read-only deploy key on private git targets.
 #[tracing::instrument(skip_all)]
 pub async fn get_ssh_public_key(
    axum::extract::Extension(agent): AgentExt,
 ) -> Result<Json<serde_json::Value>, axum::http::StatusCode> {
    let public_path = format!("{}.pub", agent.config.ssh_key_path);
    let public_key =
        std::fs::read_to_string(&public_path).map_err(|_| axum::http::StatusCode::NOT_FOUND)?;
    Ok(Json(serde_json::json!({ "public_key": public_key.trim() })))
 }
 #[tracing::instrument(skip_all)]
 pub async fn stats_overview(
    axum::extract::Extension(agent): AgentExt,
@@ -31,7 +19,7 @@ pub async fn stats_overview(
    let db = &db;
    let total_repositories = db
-        .onboarded_targets()
+        .repositories()
        .count_documents(doc! {})
        .await
        .unwrap_or(0);
@@ -12,6 +12,7 @@ pub mod notifications;
 pub mod onboarding;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod repos;
 pub mod sbom;
 pub mod scans;
@@ -20,5 +21,6 @@ pub use dto::*;
 pub use findings::*;
 pub use health::*;
 pub use issues::*;
 pub use repos::*;
 pub use sbom::*;
 pub use scans::*;
@@ -5,7 +5,7 @@
 use std::collections::HashMap;
 use std::sync::Arc;
-use axum::extract::{Extension, Multipart, Path, Query};
+use axum::extract::{Extension, Path, Query};
 use axum::http::StatusCode;
 use axum::Json;
 use mongodb::bson::{doc, oid::ObjectId, to_bson};
@@ -75,9 +75,6 @@ pub struct UpdateTargetRequest {
    pub scan_config: Option<TargetScanConfig>,
    pub compliance_profile: Option<ComplianceProfile>,
    pub scan_schedule: Option<String>,
    /// Replace the target's artifacts wholesale (used by the dashboard editor).
    #[serde(default)]
    pub artifacts: Option<Vec<ArtifactInput>>,
 }
 /// One applicable-scan option, serialized for the wizard.
@@ -217,13 +214,6 @@ pub async fn update_target(
    if let Some(ss) = req.scan_schedule {
        set.insert("scan_schedule", ss);
    }
    if let Some(arts) = req.artifacts {
        let built: Vec<Artifact> = arts.iter().map(ArtifactInput::build).collect();
        set.insert(
            "artifacts",
            to_bson(&built).map_err(|_| StatusCode::BAD_REQUEST)?,
        );
    }
    db.onboarded_targets()
        .update_one(doc! { "_id": oid }, doc! { "$set": set })
@@ -246,116 +236,15 @@ pub async fn delete_target(
        .delete_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    // Cascade all data keyed by repo_id == target id (best-effort).
+    // Cascade the collections keyed by repo_id == target id (best-effort).
-    let db = &db;
+    let by_repo = doc! { "repo_id": &id };
-    let _ = db.findings().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.findings().delete_many(by_repo.clone()).await;
-    let _ = db.sbom_entries().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.scan_runs().delete_many(by_repo.clone()).await;
-    let _ = db.scan_runs().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.sbom_entries().delete_many(by_repo.clone()).await;
-    let _ = db.cve_alerts().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.cve_alerts().delete_many(by_repo).await;
    let _ = db
        .tracker_issues()
        .delete_many(doc! { "repo_id": &id })
        .await;
    let _ = db.graph_nodes().delete_many(doc! { "repo_id": &id }).await;
    let _ = db.graph_edges().delete_many(doc! { "repo_id": &id }).await;
    let _ = db.graph_builds().delete_many(doc! { "repo_id": &id }).await;
    let _ = db
        .impact_analyses()
        .delete_many(doc! { "repo_id": &id })
        .await;
    let _ = db
        .code_embeddings()
        .delete_many(doc! { "repo_id": &id })
        .await;
    let _ = db
        .embedding_builds()
        .delete_many(doc! { "repo_id": &id })
        .await;
    // DAST targets linked to this target, and all their downstream data.
    if let Ok(mut cursor) = db.dast_targets().find(doc! { "repo_id": &id }).await {
        use futures_util::StreamExt;
        while let Some(Ok(dt)) = cursor.next().await {
            let dast_target_id = dt.id.map(|oid| oid.to_hex()).unwrap_or_default();
            if !dast_target_id.is_empty() {
                cascade_delete_dast_target(db, &dast_target_id).await;
            }
        }
    }
    // Pentest sessions linked directly to this target (not via a DAST target).
    if let Ok(mut cursor) = db.pentest_sessions().find(doc! { "repo_id": &id }).await {
        use futures_util::StreamExt;
        while let Some(Ok(session)) = cursor.next().await {
            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
            if !session_id.is_empty() {
                let _ = db
                    .attack_chain_nodes()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
                let _ = db
                    .pentest_messages()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
                let _ = db
                    .dast_findings()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
            }
        }
    }
    let _ = db
        .pentest_sessions()
        .delete_many(doc! { "repo_id": &id })
        .await;
    Ok(Json(serde_json::json!({ "status": "deleted" })))
 }
 /// Delete a DAST target and everything downstream of it (pentest sessions +
 /// their attack chains / messages / findings, DAST scan runs + findings).
 async fn cascade_delete_dast_target(db: &crate::database::Database, target_id: &str) {
    use futures_util::StreamExt;
    if let Ok(mut cursor) = db
        .pentest_sessions()
        .find(doc! { "target_id": target_id })
        .await
    {
        while let Some(Ok(session)) = cursor.next().await {
            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
            if !session_id.is_empty() {
                let _ = db
                    .attack_chain_nodes()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
                let _ = db
                    .pentest_messages()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
                let _ = db
                    .dast_findings()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
            }
        }
    }
    let _ = db
        .pentest_sessions()
        .delete_many(doc! { "target_id": target_id })
        .await;
    let _ = db
        .dast_findings()
        .delete_many(doc! { "target_id": target_id })
        .await;
    let _ = db
        .dast_scan_runs()
        .delete_many(doc! { "target_id": target_id })
        .await;
    if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(target_id) {
        let _ = db.dast_targets().delete_one(doc! { "_id": oid }).await;
    }
 }
 /// POST /api/v1/targets/{id}/artifacts — attach an artifact (by reference).
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn add_artifact(
@@ -377,116 +266,6 @@ pub async fn add_artifact(
    get_target(Extension(agent), tenant, Path(id)).await
 }
 /// POST /api/v1/targets/{id}/artifacts/upload — attach an artifact by uploading
 /// its file (PLC project, firmware image, source archive, mobile package). The
 /// bytes are written to the artifact blob store and referenced by `stored_path`,
 /// so ingest resolves them locally (no URL fetch).
 ///
 /// Multipart fields: `file` (required), `kind` (required, snake_case
 /// `ArtifactKind`), `plc_format` (optional, for PLC projects).
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn upload_artifact(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
    mut multipart: Multipart,
 ) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    if db
        .onboarded_targets()
        .find_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .is_none()
    {
        return Err(StatusCode::NOT_FOUND);
    }
    let mut kind: Option<ArtifactKind> = None;
    let mut plc_format: Option<PlcFormat> = None;
    let mut filename = String::from("upload.bin");
    let mut bytes: Option<axum::body::Bytes> = None;
    while let Some(field) = multipart
        .next_field()
        .await
        .map_err(|_| StatusCode::BAD_REQUEST)?
    {
        match field.name().unwrap_or("") {
            "kind" => {
                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
                kind = parse_enum(&v);
            }
            "plc_format" => {
                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
                plc_format = parse_enum(&v);
            }
            "file" => {
                if let Some(fname) = field.file_name() {
                    filename = fname.to_string();
                }
                bytes = Some(field.bytes().await.map_err(|_| StatusCode::BAD_REQUEST)?);
            }
            _ => {}
        }
    }
    let (Some(kind), Some(bytes)) = (kind, bytes) else {
        return Err(StatusCode::BAD_REQUEST);
    };
    // Store the uploaded bytes under the artifact blob store.
    let safe_name: String = filename
        .chars()
        .map(|c| {
            if c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_') {
                c
            } else {
                '_'
            }
        })
        .collect();
    let dir = std::path::Path::new(&agent.config.artifact_store_base_path)
        .join("uploads")
        .join(&id);
    std::fs::create_dir_all(&dir).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    let dest = dir.join(format!("{}_{safe_name}", uuid::Uuid::new_v4()));
    std::fs::write(&dest, bytes.as_ref()).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    // Build the artifact for this kind, referencing the stored file.
    let mut artifact = match kind {
        ArtifactKind::PlcProject => Artifact::plc_project(
            filename.clone(),
            plc_format.unwrap_or(PlcFormat::PlcopenXml),
        ),
        ArtifactKind::FirmwareImage => Artifact::firmware_image(filename.clone()),
        ArtifactKind::SourceArchive => Artifact::source_archive(filename.clone()),
        ArtifactKind::MobilePackage => Artifact::mobile_package(filename.clone()),
        // Non-file kinds (git repo, live URL, container ref, text) use the JSON
        // add-artifact endpoint, not upload.
        _ => return Err(StatusCode::BAD_REQUEST),
    };
    artifact.stored_path = Some(dest.to_string_lossy().to_string());
    artifact.size_bytes = Some(bytes.len() as u64);
    let artifact_bson = to_bson(&artifact).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    db.onboarded_targets()
        .update_one(
            doc! { "_id": oid },
            doc! { "$push": { "artifacts": artifact_bson }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
        )
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    get_target(Extension(agent), tenant, Path(id)).await
 }
 /// Deserialize a snake_case enum value from a plain string.
 fn parse_enum<T: for<'de> Deserialize<'de>>(s: &str) -> Option<T> {
    serde_json::from_value(serde_json::Value::String(s.to_string())).ok()
 }
 /// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn applicable_scans_for_target(
@@ -113,14 +113,14 @@ pub async fn create_session(
        session.config = Some(config.clone());
        session.repo_id = target.repo_id.clone();
-        // Resolve repo_id (target id) from git_repo_url if provided
+        // Resolve repo_id from git_repo_url if provided
        if let Some(ref git_url) = config.git_repo_url {
-            if let Ok(Some(target)) = db
+            if let Ok(Some(repo)) = db
-                .onboarded_targets()
+                .repositories()
-                .find_one(doc! { "artifacts.source_ref": git_url })
+                .find_one(doc! { "git_url": git_url })
                .await
            {
-                session.repo_id = target.id.map(|oid| oid.to_hex());
+                session.repo_id = repo.id.map(|oid| oid.to_hex());
            }
        }
@@ -380,20 +380,17 @@ pub async fn lookup_repo(
 ) -> Result<Json<ApiResponse<serde_json::Value>>, StatusCode> {
    let db = tenant_db(&agent, &tenant).await?;
    let repo = db
-        .onboarded_targets()
+        .repositories()
-        .find_one(doc! { "artifacts.source_ref": &params.url })
+        .find_one(doc! { "git_url": &params.url })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    let data = match repo {
-        Some(r) => {
+        Some(r) => serde_json::json!({
            let git = r.code_artifact().and_then(|c| c.git.as_ref());
            serde_json::json!({
            "name": r.name,
-                "default_branch": git.map(|g| g.default_branch.clone()),
+            "default_branch": r.default_branch,
-                "last_scanned_commit": git.and_then(|g| g.last_scanned_commit.clone()),
+            "last_scanned_commit": r.last_scanned_commit,
-            })
+        }),
        }
        None => serde_json::Value::Null,
    };
@@ -0,0 +1,339 @@
 use axum::extract::{Extension, Path, Query};
 use axum::http::StatusCode;
 use axum::Json;
 use mongodb::bson::doc;
 use super::dto::*;
 use compliance_core::models::*;
 use compliance_core::tenant_ctx::TenantCtx;
 #[tracing::instrument(skip_all)]
 pub async fn list_repositories(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Query(params): Query<PaginationParams>,
 ) -> ApiResult<Vec<TrackedRepository>> {
    let db = tenant_db(&agent, &tenant).await?;
    let db = &db;
    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
    let total = db
        .repositories()
        .count_documents(doc! {})
        .await
        .unwrap_or(0);
    let repos = match db
        .repositories()
        .find(doc! {})
        .skip(skip)
        .limit(params.limit)
        .await
    {
        Ok(cursor) => collect_cursor_async(cursor).await,
        Err(e) => {
            tracing::warn!("Failed to fetch repositories: {e}");
            Vec::new()
        }
    };
    Ok(Json(ApiResponse {
        data: repos,
        total: Some(total),
        page: Some(params.page),
    }))
 }
 #[tracing::instrument(skip_all)]
 pub async fn add_repository(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Json(req): Json<AddRepositoryRequest>,
 ) -> Result<Json<ApiResponse<TrackedRepository>>, (StatusCode, String)> {
    // Validate repository access before saving
    let creds = crate::pipeline::git::RepoCredentials {
        ssh_key_path: Some(agent.config.ssh_key_path.clone()),
        auth_token: req.auth_token.clone(),
        auth_username: req.auth_username.clone(),
    };
    if let Err(e) = crate::pipeline::git::GitOps::test_access(&req.git_url, &creds) {
        return Err((
            StatusCode::BAD_REQUEST,
            format!("Cannot access repository: {e}"),
        ));
    }
    let mut repo = TrackedRepository::new(req.name, req.git_url);
    repo.default_branch = req.default_branch;
    repo.auth_token = req.auth_token;
    repo.auth_username = req.auth_username;
    repo.tracker_type = req.tracker_type;
    repo.tracker_owner = req.tracker_owner;
    repo.tracker_repo = req.tracker_repo;
    repo.tracker_token = req.tracker_token;
    repo.scan_schedule = req.scan_schedule;
    let db = tenant_db(&agent, &tenant)
        .await
        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
    db.repositories().insert_one(&repo).await.map_err(|_| {
        (
            StatusCode::CONFLICT,
            "Repository already exists".to_string(),
        )
    })?;
    Ok(Json(ApiResponse {
        data: repo,
        total: None,
        page: None,
    }))
 }
 #[tracing::instrument(skip_all, fields(repo_id = %id))]
 pub async fn update_repository(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
    Json(req): Json<UpdateRepositoryRequest>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
    let db = tenant_db(&agent, &tenant).await?;
    let mut set_doc = doc! { "updated_at": mongodb::bson::DateTime::now() };
    if let Some(name) = &req.name {
        set_doc.insert("name", name);
    }
    if let Some(branch) = &req.default_branch {
        set_doc.insert("default_branch", branch);
    }
    if let Some(token) = &req.auth_token {
        set_doc.insert("auth_token", token);
    }
    if let Some(username) = &req.auth_username {
        set_doc.insert("auth_username", username);
    }
    if let Some(tracker_type) = &req.tracker_type {
        set_doc.insert("tracker_type", tracker_type.to_string());
    }
    if let Some(owner) = &req.tracker_owner {
        set_doc.insert("tracker_owner", owner);
    }
    if let Some(repo) = &req.tracker_repo {
        set_doc.insert("tracker_repo", repo);
    }
    if let Some(token) = &req.tracker_token {
        set_doc.insert("tracker_token", token);
    }
    if let Some(schedule) = &req.scan_schedule {
        set_doc.insert("scan_schedule", schedule);
    }
    let result = db
        .repositories()
        .update_one(doc! { "_id": oid }, doc! { "$set": set_doc })
        .await
        .map_err(|e| {
            tracing::warn!("Failed to update repository: {e}");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;
    if result.matched_count == 0 {
        return Err(StatusCode::NOT_FOUND);
    }
    Ok(Json(serde_json::json!({ "status": "updated" })))
 }
 #[tracing::instrument(skip_all)]
 pub async fn get_ssh_public_key(
    Extension(agent): AgentExt,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
    let public_path = format!("{}.pub", agent.config.ssh_key_path);
    let public_key = std::fs::read_to_string(&public_path).map_err(|_| StatusCode::NOT_FOUND)?;
    Ok(Json(serde_json::json!({ "public_key": public_key.trim() })))
 }
 #[tracing::instrument(skip_all, fields(repo_id = %id))]
 pub async fn trigger_scan(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
    let agent_clone = (*agent).clone();
    let tenant_id = tenant.0.tenant_id.clone();
    tokio::spawn(async move {
        if let Err(e) = agent_clone
            .run_scan(&tenant_id, &id, ScanTrigger::Manual)
            .await
        {
            tracing::error!("Manual scan failed for {id}: {e}");
        }
    });
    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
 }
 /// Return the webhook secret for a repository (used by dashboard to display it)
 pub async fn get_webhook_config(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
    let db = tenant_db(&agent, &tenant).await?;
    let repo = db
        .repositories()
        .find_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .ok_or(StatusCode::NOT_FOUND)?;
    let tracker_type = repo
        .tracker_type
        .as_ref()
        .map(|t| t.to_string())
        .unwrap_or_else(|| "gitea".to_string());
    Ok(Json(serde_json::json!({
        "webhook_secret": repo.webhook_secret,
        "tracker_type": tracker_type,
    })))
 }
 #[tracing::instrument(skip_all, fields(repo_id = %id))]
 pub async fn delete_repository(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
    let db = tenant_db(&agent, &tenant).await?;
    let db = &db;
    // Delete the repository
    let result = db
        .repositories()
        .delete_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    if result.deleted_count == 0 {
        return Err(StatusCode::NOT_FOUND);
    }
    // Cascade delete all related data
    let _ = db.findings().delete_many(doc! { "repo_id": &id }).await;
    let _ = db.sbom_entries().delete_many(doc! { "repo_id": &id }).await;
    let _ = db.scan_runs().delete_many(doc! { "repo_id": &id }).await;
    let _ = db.cve_alerts().delete_many(doc! { "repo_id": &id }).await;
    let _ = db
        .tracker_issues()
        .delete_many(doc! { "repo_id": &id })
        .await;
    let _ = db.graph_nodes().delete_many(doc! { "repo_id": &id }).await;
    let _ = db.graph_edges().delete_many(doc! { "repo_id": &id }).await;
    let _ = db.graph_builds().delete_many(doc! { "repo_id": &id }).await;
    let _ = db
        .impact_analyses()
        .delete_many(doc! { "repo_id": &id })
        .await;
    let _ = db
        .code_embeddings()
        .delete_many(doc! { "repo_id": &id })
        .await;
    let _ = db
        .embedding_builds()
        .delete_many(doc! { "repo_id": &id })
        .await;
    // Cascade delete DAST targets linked to this repo, and all their downstream data
    // (scan runs, findings, pentest sessions, attack chains, messages)
    if let Ok(mut cursor) = db.dast_targets().find(doc! { "repo_id": &id }).await {
        use futures_util::StreamExt;
        while let Some(Ok(target)) = cursor.next().await {
            let target_id = target.id.map(|oid| oid.to_hex()).unwrap_or_default();
            if !target_id.is_empty() {
                cascade_delete_dast_target(db, &target_id).await;
            }
        }
    }
    // Also delete pentest sessions linked directly to this repo (not via target)
    if let Ok(mut cursor) = db.pentest_sessions().find(doc! { "repo_id": &id }).await {
        use futures_util::StreamExt;
        while let Some(Ok(session)) = cursor.next().await {
            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
            if !session_id.is_empty() {
                let _ = db
                    .attack_chain_nodes()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
                let _ = db
                    .pentest_messages()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
                // Delete DAST findings produced by this session
                let _ = db
                    .dast_findings()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
            }
        }
    }
    let _ = db
        .pentest_sessions()
        .delete_many(doc! { "repo_id": &id })
        .await;
    Ok(Json(serde_json::json!({ "status": "deleted" })))
 }
 /// Cascade-delete a DAST target and all its downstream data.
 async fn cascade_delete_dast_target(db: &crate::database::Database, target_id: &str) {
    // Delete pentest sessions for this target (and their attack chains + messages)
    if let Ok(mut cursor) = db
        .pentest_sessions()
        .find(doc! { "target_id": target_id })
        .await
    {
        use futures_util::StreamExt;
        while let Some(Ok(session)) = cursor.next().await {
            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
            if !session_id.is_empty() {
                let _ = db
                    .attack_chain_nodes()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
                let _ = db
                    .pentest_messages()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
                let _ = db
                    .dast_findings()
                    .delete_many(doc! { "session_id": &session_id })
                    .await;
            }
        }
    }
    let _ = db
        .pentest_sessions()
        .delete_many(doc! { "target_id": target_id })
        .await;
    // Delete DAST scan runs and their findings
    let _ = db
        .dast_findings()
        .delete_many(doc! { "target_id": target_id })
        .await;
    let _ = db
        .dast_scan_runs()
        .delete_many(doc! { "target_id": target_id })
        .await;
    // Delete the target itself
    if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(target_id) {
        let _ = db.dast_targets().delete_one(doc! { "_id": oid }).await;
    }
 }
@@ -282,7 +282,7 @@ pub async fn license_summary(
            }
        })
        .collect();
-    summaries.sort_by_key(|s| std::cmp::Reverse(s.count));
+    summaries.sort_by(|a, b| b.count.cmp(&a.count));
    Ok(Json(ApiResponse {
        data: summaries,
@@ -11,6 +11,20 @@ pub fn build_router() -> Router {
            "/api/v1/settings/ssh-public-key",
            get(handlers::get_ssh_public_key),
        )
        .route("/api/v1/repositories", get(handlers::list_repositories))
        .route("/api/v1/repositories", post(handlers::add_repository))
        .route(
            "/api/v1/repositories/{id}/scan",
            post(handlers::trigger_scan),
        )
        .route(
            "/api/v1/repositories/{id}",
            delete(handlers::delete_repository).patch(handlers::update_repository),
        )
        .route(
            "/api/v1/repositories/{id}/webhook-config",
            get(handlers::get_webhook_config),
        )
        // Unified onboarding targets (#131).
        .route(
            "/api/v1/targets",
@@ -26,10 +40,6 @@ pub fn build_router() -> Router {
            "/api/v1/targets/{id}/artifacts",
            post(handlers::onboarding::add_artifact),
        )
        .route(
            "/api/v1/targets/{id}/artifacts/upload",
            post(handlers::onboarding::upload_artifact),
        )
        .route(
            "/api/v1/targets/{id}/applicable-scans",
            get(handlers::onboarding::applicable_scans_for_target),
@@ -1,6 +1,6 @@
 use std::sync::Arc;
-use axum::extract::{DefaultBodyLimit, Request};
+use axum::extract::Request;
 use axum::http::HeaderValue;
 use axum::middleware::Next;
 use axum::response::Response;
@@ -74,9 +74,6 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
    let mut app = routes::build_router()
        .merge(admin_router)
        // Allow large artifact uploads (PLC .projectarchive, firmware images,
        // mobile packages) — axum's default request-body limit is only 2 MiB.
        .layer(DefaultBodyLimit::max(512 * 1024 * 1024))
        .layer(Extension(Arc::new(agent.clone())))
        .layer(CorsLayer::permissive())
        .layer(TraceLayer::new_for_http())
@@ -47,6 +47,12 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
            .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
        artifact_store_base_path: env_var_opt("ARTIFACT_STORE_BASE_PATH")
            .unwrap_or_else(|| "/data/compliance-scanner/artifacts".to_string()),
        // Defaults ON: the unified onboarded-target pipeline is now the primary
        // path (no legacy `repositories` data in production). Set
        // `UNIFIED_PIPELINE=0` to fall back to the legacy repository pipeline.
        unified_pipeline: env_var_opt("UNIFIED_PIPELINE")
            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
            .unwrap_or(true),
        ssh_key_path: env_var_opt("SSH_KEY_PATH")
            .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
        keycloak_url: env_var_opt("KEYCLOAK_URL"),
@@ -249,6 +249,16 @@ impl Database {
    }
    pub async fn ensure_indexes(&self) -> Result<(), AgentError> {
        // repositories: unique git_url
        self.repositories()
            .create_index(
                IndexModel::builder()
                    .keys(doc! { "git_url": 1 })
                    .options(IndexOptions::builder().unique(true).build())
                    .build(),
            )
            .await?;
        // findings: unique fingerprint
        self.findings()
            .create_index(
@@ -469,6 +479,10 @@ impl Database {
        Ok(())
    }
    pub fn repositories(&self) -> Collection<TrackedRepository> {
        self.inner.collection("repositories")
    }
    pub fn findings(&self) -> Collection<Finding> {
        self.inner.collection("findings")
    }
@@ -162,29 +162,16 @@ fn ingest_blob(
        match blob::extract_zip(&stored, &dest) {
            Ok(()) => dest,
            Err(e) => {
-                // Not a zip container — this is a single uploaded file (e.g. a
+                // Not a zip (e.g. a tar.gz source archive) — keep the blob and
-                // `.st`/`.xml` PLC project or a `.tar.gz`). The content-addressed
+                // note it so later stages can decide what to do.
                // blob has no extension, so materialize it into a working dir
                // under its original name; extension-based scanners (PLC) can then
                // discover it and report a readable path.
                facts.push(DetectedFact::new(
                    "archive_unextracted",
                    e.to_string(),
                    "ingest",
                ));
                match materialize_single(&stored, &dest, &blob_file_name(artifact)) {
                    Ok(dir) => dir,
                    Err(copy_err) => {
                        facts.push(DetectedFact::new(
                            "materialize_failed",
                            copy_err.to_string(),
                            "ingest",
                        ));
                stored.clone()
            }
        }
            }
        }
    } else {
        stored.clone()
    };
@@ -199,27 +186,6 @@ fn ingest_blob(
    })
 }
 /// Copy a stored blob into `dest`/`name`, returning `dest`. Used when an
 /// "extractable" artifact turns out to be a single file rather than an archive.
 fn materialize_single(stored: &Path, dest: &Path, name: &str) -> Result<PathBuf, AgentError> {
    std::fs::create_dir_all(dest)?;
    std::fs::copy(stored, dest.join(name))?;
    Ok(dest.to_path_buf())
 }
 /// A safe, single-segment file name for an artifact, preserving the original
 /// extension so scanners can identify it. Derives from `source_ref` (the
 /// uploaded/original file name); `file_name` strips any directory components,
 /// so this is traversal-safe. Falls back to the artifact id.
 fn blob_file_name(artifact: &Artifact) -> String {
    Path::new(&artifact.source_ref)
        .file_name()
        .and_then(|n| n.to_str())
        .map(str::to_string)
        .filter(|s| !s.is_empty())
        .unwrap_or_else(|| format!("artifact-{}", artifact.id))
 }
 /// An artifact with no on-disk form: record a single fact, no hash/path.
 fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
    IngestedArtifact {
@@ -365,52 +331,4 @@ mod tests {
        assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
        assert!(creds.auth_token.is_none());
    }
    /// A single uploaded PLC file (not an archive) must land in a working dir
    /// under its original name so the PLC scanner can discover it by extension
    /// and report a readable path — the demo's upload → scan path.
    #[test]
    fn single_uploaded_plc_file_is_materialized_and_scannable() {
        use compliance_core::models::PlcFormat;
        let scratch = Scratch::new();
        let store = scratch.0.join("store");
        // Simulate the upload handler: bytes written to an `uploads/` path,
        // `source_ref` carrying the original (clean) file name.
        let uploads = scratch.0.join("uploads");
        std::fs::create_dir_all(&uploads).expect("mkdir uploads");
        let uploaded = uploads.join("a1b2c3_pump_station.st");
        std::fs::write(
            &uploaded,
            "PROGRAM P\nVAR\n  ApiKey : STRING := 'sk-live-1234';\nEND_VAR\nEND_PROGRAM\n",
        )
        .expect("write st");
        let mut artifact = Artifact::plc_project("pump_station.st", PlcFormat::StructuredText);
        artifact.stored_path = Some(uploaded.to_string_lossy().to_string());
        let ctx = ctx_for(&store, "t-plc");
        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
        // Working path is a directory (not the extensionless blob) holding the
        // file under its original name.
        let wp = out.working_path.expect("working path");
        assert!(wp.is_dir(), "expected a working dir, got {wp:?}");
        assert!(wp.join("pump_station.st").is_file());
        // The PLC scanner finds the hardcoded credential and reports a clean path.
        let findings = crate::pipeline::plc::analyze_tree(&wp, "t-plc");
        assert!(
            !findings.is_empty(),
            "scanner should flag the uploaded file"
        );
        assert!(findings
            .iter()
            .any(|f| f.rule_id.as_deref() == Some("plc-hardcoded-credential")));
        assert_eq!(
            findings[0].file_path.as_deref(),
            Some("pump_station.st"),
            "finding should reference the original file name"
        );
    }
 }
@@ -8,6 +8,7 @@ pub mod database;
 pub mod error;
 pub mod ingest;
 pub mod llm;
 pub mod migrate;
 pub mod pentest;
 pub mod pipeline;
 pub mod rag;
@@ -1,4 +1,50 @@
-use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};
+use compliance_agent::{agent, api, config, database, migrate, scheduler, ssh, webhooks};
 /// Run the `migrate onboarding` subcommand and exit. Backfills (or reverts) the
 /// unified `onboarded_targets` collection per tenant.
 ///
 /// Usage: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]`
 async fn run_migration(
    args: &[String],
    pool: &database::DatabasePool,
 ) -> Result<(), compliance_agent::error::AgentError> {
    if args.get(2).map(String::as_str) != Some("onboarding") {
        eprintln!(
            "usage: compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]"
        );
        std::process::exit(2);
    }
    let has = |flag: &str| args.iter().any(|a| a == flag);
    let dry_run = has("--dry-run");
    let revert = has("--revert");
    let tenant = args
        .iter()
        .position(|a| a == "--tenant")
        .and_then(|i| args.get(i + 1))
        .cloned();
    let tenants: Vec<String> = if has("--all") {
        pool.list_tenant_ids().await?
    } else if let Some(t) = tenant {
        vec![t]
    } else {
        eprintln!("specify --all or --tenant <id>");
        std::process::exit(2);
    };
    for tenant_id in tenants {
        let db = pool.for_tenant_id(&tenant_id).await?;
        if revert {
            migrate::onboarding::revert(&db).await?;
            println!("[{tenant_id}] reverted onboarding backfill");
        } else {
            let report = migrate::onboarding::backfill_onboarded_targets(&db, dry_run).await?;
            let prefix = if dry_run { "(dry-run) " } else { "" };
            println!("[{tenant_id}] {prefix}{report:?}");
        }
    }
    Ok(())
 }
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -31,6 +77,13 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let db_pool =
        database::DatabasePool::connect(&config.mongodb_uri, &config.mongodb_database).await?;
    // One-shot subcommands run and exit without starting the servers.
    let args: Vec<String> = std::env::args().collect();
    if args.get(1).map(String::as_str) == Some("migrate") {
        run_migration(&args, &db_pool).await?;
        return Ok(());
    }
    let agent = agent::ComplianceAgent::new(config.clone(), db_pool);
    tracing::info!("Starting scheduler...");
@@ -0,0 +1,8 @@
 //! One-time data migrations.
 //!
 //! Currently just the onboarding backfill ([`onboarding`]), which folds the
 //! legacy `repositories` and `dast_targets` collections into the unified
 //! `onboarded_targets` collection, preserving `_id` so every downstream record
 //! keyed by `repo_id` / `target_id` keeps resolving.
 pub mod onboarding;
@@ -0,0 +1,406 @@
 //! Backfill: legacy `repositories` + `dast_targets` → `onboarded_targets`.
 //!
 //! The transforms here are **id-preserving**: an [`OnboardedTarget`] keeps the
 //! same `_id` as the `TrackedRepository` / `DastTarget` it came from, so every
 //! downstream collection keyed by that hex id (findings, sbom, scan_runs,
 //! graph, dast_*, pentest_*) keeps resolving with zero row rewrites, and
 //! existing webhook URLs keep working. The mapping functions are pure and unit
 //! tested; the DB orchestration (idempotent per-tenant backfill + revert) is a
 //! thin driver over them.
 use compliance_core::models::{
    Artifact, ArtifactKind, DastTarget, DastTargetType, GitArtifactConfig, IssueTrackerConfig,
    OnboardedTarget, TargetType, TrackedRepository, WebArtifactConfig,
 };
 use futures_util::TryStreamExt;
 use mongodb::bson::{doc, Document};
 use crate::database::Database;
 use crate::error::AgentError;
 /// Marker id in `schema_migrations` recording that the backfill has run.
 const MIGRATION_MARKER: &str = "onboarding_backfill_v1";
 /// Summary of a backfill run.
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct MigrationReport {
    /// Repositories turned into onboarded targets.
    pub repos_migrated: u64,
    /// DAST targets folded into an existing (repo-linked) target as a LiveUrl.
    pub dast_targets_folded: u64,
    /// DAST targets with no repo link, migrated as standalone targets.
    pub dast_targets_standalone: u64,
    /// Records skipped because a target with that `_id` already existed.
    pub skipped_existing: u64,
 }
 /// Map a legacy `DastTargetType` to a unified [`TargetType`]. REST/GraphQL APIs
 /// are backend services; a browser app is a web app.
 fn target_type_for_dast(kind: &DastTargetType) -> TargetType {
    match kind {
        DastTargetType::WebApp => TargetType::WebApp,
        DastTargetType::RestApi | DastTargetType::GraphQl => TargetType::BackendService,
    }
 }
 /// Build the LiveUrl artifact for a DAST target (its base URL + crawl config +
 /// auth). Shared by fold-in and standalone migration.
 pub fn dast_to_artifact(dast: &DastTarget) -> Artifact {
    let mut artifact = Artifact::live_url(dast.base_url.clone());
    artifact.web = Some(WebArtifactConfig {
        target_kind: dast.target_type.clone(),
        excluded_paths: dast.excluded_paths.clone(),
        max_crawl_depth: dast.max_crawl_depth,
        rate_limit: dast.rate_limit,
        allow_destructive: dast.allow_destructive,
    });
    artifact.auth = dast.auth_config.clone().map(Into::into);
    artifact
 }
 /// Map a `TrackedRepository` to an onboarded target, preserving `_id`. The git
 /// remote becomes a `GitRepo` artifact carrying the repo's branch, watermark,
 /// and auth; tracker config folds into `scan_config`.
 ///
 /// `target_type` is a safe default (`BackendService`) — the classifier can
 /// refine it later; `classification` is left `None` (unconfirmed).
 pub fn repo_to_target(repo: &TrackedRepository) -> OnboardedTarget {
    let mut target = OnboardedTarget::new(repo.name.clone(), TargetType::BackendService);
    target.id = repo.id;
    let mut artifact = Artifact::git_repo(repo.git_url.clone(), repo.default_branch.clone());
    artifact.git = Some(GitArtifactConfig {
        default_branch: repo.default_branch.clone(),
        last_scanned_commit: repo.last_scanned_commit.clone(),
        local_path: repo.local_path.clone(),
    });
    if repo.auth_token.is_some() || repo.auth_username.is_some() {
        artifact.auth = Some(compliance_core::models::ArtifactAuth {
            method: "token".to_string(),
            username: repo.auth_username.clone(),
            secret: repo.auth_token.clone(),
            ..Default::default()
        });
    }
    target.artifacts.push(artifact);
    if repo.tracker_type.is_some() {
        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
            tracker_type: repo.tracker_type.clone(),
            owner: repo.tracker_owner.clone(),
            repo: repo.tracker_repo.clone(),
            token: repo.tracker_token.clone(),
        });
    }
    target.scan_schedule = repo.scan_schedule.clone();
    target.webhook_enabled = repo.webhook_enabled;
    target.webhook_secret = repo.webhook_secret.clone();
    target.findings_count = repo.findings_count;
    target.created_at = repo.created_at;
    target.updated_at = repo.updated_at;
    target
 }
 /// Append a DAST target's LiveUrl artifact onto an existing (repo-derived)
 /// target. If the repo default was `BackendService` but the DAST target is a
 /// browser web app, promote the type to `WebApp`.
 pub fn fold_dast_into_target(target: &mut OnboardedTarget, dast: &DastTarget) {
    if matches!(dast.target_type, DastTargetType::WebApp)
        && target.target_type == TargetType::BackendService
    {
        target.target_type = TargetType::WebApp;
    }
    if !target.has(ArtifactKind::LiveUrl) {
        target.artifacts.push(dast_to_artifact(dast));
    }
 }
 /// Map a repo-less DAST target to a standalone onboarded target, preserving `_id`.
 pub fn dast_to_standalone_target(dast: &DastTarget) -> OnboardedTarget {
    let mut target =
        OnboardedTarget::new(dast.name.clone(), target_type_for_dast(&dast.target_type));
    target.id = dast.id;
    target.artifacts.push(dast_to_artifact(dast));
    target.created_at = dast.created_at;
    target.updated_at = dast.updated_at;
    target
 }
 /// Whether the onboarding backfill has already been applied to this database.
 pub async fn already_applied(db: &Database) -> Result<bool, AgentError> {
    let found = db
        .collection_named::<Document>("schema_migrations")
        .find_one(doc! { "_id": MIGRATION_MARKER })
        .await?;
    Ok(found.is_some())
 }
 /// Backfill `onboarded_targets` from `repositories` + `dast_targets` for one
 /// tenant database.
 ///
 /// Id-preserving and **idempotent**: targets that already exist (by `_id`) are
 /// skipped, so re-running is safe. With `dry_run`, computes the report without
 /// writing. The legacy collections are never deleted; the only mutation outside
 /// `onboarded_targets` is the history relink of folded DAST targets, which is
 /// logged so [`revert`] can undo it.
 pub async fn backfill_onboarded_targets(
    db: &Database,
    dry_run: bool,
 ) -> Result<MigrationReport, AgentError> {
    let mut report = MigrationReport::default();
    // 1. repositories -> onboarded_targets (preserve _id, skip existing).
    let mut repos = db.repositories().find(doc! {}).await?;
    while let Some(repo) = repos.try_next().await? {
        let Some(id) = repo.id else { continue };
        if db
            .onboarded_targets()
            .find_one(doc! { "_id": id })
            .await?
            .is_some()
        {
            report.skipped_existing += 1;
            continue;
        }
        if !dry_run {
            db.onboarded_targets()
                .insert_one(repo_to_target(&repo))
                .await?;
        }
        report.repos_migrated += 1;
    }
    // 2. dast_targets -> fold into the linked repo target, or migrate standalone.
    let mut dasts = db.dast_targets().find(doc! {}).await?;
    while let Some(dast) = dasts.try_next().await? {
        let Some(dast_id) = dast.id else { continue };
        let repo_oid = dast
            .repo_id
            .as_deref()
            .and_then(|r| mongodb::bson::oid::ObjectId::parse_str(r).ok());
        let linked = match repo_oid {
            Some(oid) => db.onboarded_targets().find_one(doc! { "_id": oid }).await?,
            None => None,
        };
        match (linked, repo_oid) {
            // Fold into an existing repo-derived target.
            (Some(mut target), Some(oid)) => {
                if target.has(ArtifactKind::LiveUrl) {
                    report.skipped_existing += 1; // already folded on a prior run
                    continue;
                }
                fold_dast_into_target(&mut target, &dast);
                if !dry_run {
                    db.onboarded_targets()
                        .replace_one(doc! { "_id": oid }, &target)
                        .await?;
                    relink_history(db, &dast_id.to_hex(), &oid.to_hex()).await?;
                }
                report.dast_targets_folded += 1;
            }
            // No linked repo target: migrate as a standalone target (keeps _id).
            _ => {
                if db
                    .onboarded_targets()
                    .find_one(doc! { "_id": dast_id })
                    .await?
                    .is_some()
                {
                    report.skipped_existing += 1;
                    continue;
                }
                if !dry_run {
                    db.onboarded_targets()
                        .insert_one(dast_to_standalone_target(&dast))
                        .await?;
                }
                report.dast_targets_standalone += 1;
            }
        }
    }
    if !dry_run {
        db.collection_named::<Document>("schema_migrations")
            .update_one(
                doc! { "_id": MIGRATION_MARKER },
                doc! { "$set": { "applied_at": mongodb::bson::DateTime::now() } },
            )
            .upsert(true)
            .await?;
    }
    Ok(report)
 }
 /// Relink DAST scan runs and pentest sessions from the old DAST target id to the
 /// unified target id, logging each move so [`revert`] can undo it.
 ///
 /// Note: if multiple DAST targets fold into the same repo target, revert
 /// restores only the last-logged mapping — a rare edge. The source collections
 /// (`repositories`, `dast_targets`) are never deleted, so no data is lost.
 async fn relink_history(db: &Database, old_id: &str, new_id: &str) -> Result<(), AgentError> {
    db.dast_scan_runs()
        .update_many(
            doc! { "target_id": old_id },
            doc! { "$set": { "target_id": new_id } },
        )
        .await?;
    db.pentest_sessions()
        .update_many(
            doc! { "target_id": old_id },
            doc! { "$set": { "target_id": new_id } },
        )
        .await?;
    db.collection_named::<Document>("onboarding_migration_log")
        .insert_one(doc! { "old_target_id": old_id, "new_target_id": new_id })
        .await?;
    Ok(())
 }
 /// Undo the backfill: replay the relink log in reverse, drop `onboarded_targets`
 /// and the log, and clear the marker. The legacy collections are untouched, so
 /// this restores the pre-migration state.
 pub async fn revert(db: &Database) -> Result<(), AgentError> {
    let log = db.collection_named::<Document>("onboarding_migration_log");
    let mut cursor = log.find(doc! {}).await?;
    while let Some(entry) = cursor.try_next().await? {
        if let (Ok(old), Ok(new)) = (
            entry.get_str("old_target_id"),
            entry.get_str("new_target_id"),
        ) {
            db.dast_scan_runs()
                .update_many(
                    doc! { "target_id": new },
                    doc! { "$set": { "target_id": old } },
                )
                .await?;
            db.pentest_sessions()
                .update_many(
                    doc! { "target_id": new },
                    doc! { "$set": { "target_id": old } },
                )
                .await?;
        }
    }
    db.onboarded_targets().drop().await?;
    log.drop().await?;
    db.collection_named::<Document>("schema_migrations")
        .delete_one(doc! { "_id": MIGRATION_MARKER })
        .await?;
    Ok(())
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    use compliance_core::models::{DastAuthConfig, TrackerType};
    fn repo() -> TrackedRepository {
        let mut r = TrackedRepository::new("acme".to_string(), "https://git/acme.git".to_string());
        r.id = Some(mongodb::bson::oid::ObjectId::new());
        r.default_branch = "develop".to_string();
        r.last_scanned_commit = Some("abc123".to_string());
        r.auth_token = Some("pat".to_string());
        r.auth_username = Some("bob".to_string());
        r.tracker_type = Some(TrackerType::Gitea);
        r.tracker_owner = Some("acme".to_string());
        r.findings_count = 7;
        r
    }
    fn dast(repo_id: Option<String>, kind: DastTargetType) -> DastTarget {
        let mut d = DastTarget::new(
            "acme-web".to_string(),
            "https://acme.example.com".to_string(),
            kind,
        );
        d.id = Some(mongodb::bson::oid::ObjectId::new());
        d.repo_id = repo_id;
        d.max_crawl_depth = 5;
        d.auth_config = Some(DastAuthConfig {
            method: "bearer".to_string(),
            login_url: None,
            username: None,
            password: None,
            token: Some("tok".to_string()),
            headers: None,
        });
        d
    }
    #[test]
    fn repo_maps_preserving_id_and_git_artifact() {
        let r = repo();
        let t = repo_to_target(&r);
        assert_eq!(t.id, r.id); // id preserved
        assert_eq!(t.findings_count, 7);
        assert_eq!(t.scan_schedule, r.scan_schedule);
        let git = t.code_artifact().expect("git artifact");
        assert_eq!(git.kind, ArtifactKind::GitRepo);
        assert_eq!(git.source_ref, "https://git/acme.git");
        let gc = git.git.as_ref().expect("git config");
        assert_eq!(gc.default_branch, "develop");
        assert_eq!(gc.last_scanned_commit.as_deref(), Some("abc123"));
        let auth = git.auth.as_ref().expect("auth");
        assert_eq!(auth.secret.as_deref(), Some("pat"));
        assert_eq!(auth.username.as_deref(), Some("bob"));
        assert_eq!(
            t.scan_config
                .issue_tracker
                .as_ref()
                .and_then(|it| it.tracker_type.clone()),
            Some(TrackerType::Gitea)
        );
    }
    #[test]
    fn standalone_dast_maps_preserving_id_and_live_url() {
        let d = dast(None, DastTargetType::WebApp);
        let t = dast_to_standalone_target(&d);
        assert_eq!(t.id, d.id);
        assert_eq!(t.target_type, TargetType::WebApp);
        let url = t.live_url().expect("live url");
        assert_eq!(url.source_ref, "https://acme.example.com");
        let web = url.web.as_ref().expect("web config");
        assert_eq!(web.max_crawl_depth, 5);
        assert_eq!(
            url.auth.as_ref().and_then(|a| a.secret.clone()),
            Some("tok".to_string())
        );
    }
    #[test]
    fn rest_api_dast_maps_to_backend_service() {
        let d = dast(None, DastTargetType::RestApi);
        assert_eq!(
            dast_to_standalone_target(&d).target_type,
            TargetType::BackendService
        );
    }
    #[test]
    fn fold_adds_live_url_and_promotes_webapp() {
        let mut t = repo_to_target(&repo());
        assert_eq!(t.target_type, TargetType::BackendService);
        fold_dast_into_target(&mut t, &dast(Some("x".to_string()), DastTargetType::WebApp));
        assert_eq!(t.target_type, TargetType::WebApp); // promoted
        assert!(t.has(ArtifactKind::LiveUrl));
        assert!(t.has(ArtifactKind::GitRepo));
    }
    #[test]
    fn fold_is_idempotent_on_live_url() {
        let mut t = repo_to_target(&repo());
        let d = dast(Some("x".to_string()), DastTargetType::WebApp);
        fold_dast_into_target(&mut t, &d);
        fold_dast_into_target(&mut t, &d);
        let live_urls = t
            .artifacts
            .iter()
            .filter(|a| a.kind == ArtifactKind::LiveUrl)
            .count();
        assert_eq!(live_urls, 1);
    }
 }
@@ -342,6 +342,7 @@ mod tests {
            pentest_imap_password: None,
            admin_api_token: None,
            tenant_registry_url: None,
            unified_pipeline: false,
        }
    }
@@ -204,202 +204,6 @@ impl CveScanner {
        Ok(results)
    }
    /// Match the CODESYS **runtime** component against NVD by CPE.
    ///
    /// CODESYS advisories (the CoDe16 cluster and friends) are indexed in NVD by
    /// CPE (`cpe:2.3:a:codesys:control*`) keyed off the *runtime* version — not by
    /// the internal `Cmp*`/`Sys*` library names OSV-by-purl would look up. So we
    /// find the runtime SBOM entry, pull every `cpe:2.3:a:codesys:*` CVE from NVD,
    /// and keep the ones whose affected-version range covers our runtime version.
    /// Best-effort: returns empty without an NVD key, on a network error, or when
    /// no CODESYS runtime component is present.
    pub async fn scan_codesys(&self, repo_id: &str, entries: &mut [SbomEntry]) -> Vec<CveAlert> {
        let Some((name, version)) = codesys_runtime(entries) else {
            return Vec::new();
        };
        let url = "https://services.nvd.nist.gov/rest/json/cves/2.0\
                   ?virtualMatchString=cpe:2.3:a:codesys";
        let mut req = self.http.get(url);
        if let Some(key) = &self.nvd_api_key {
            req = req.header("apiKey", key.as_str());
        }
        let body: serde_json::Value = match req.send().await {
            Ok(r) if r.status().is_success() => match r.json().await {
                Ok(b) => b,
                Err(e) => {
                    tracing::warn!("CODESYS NVD parse failed: {e}");
                    return Vec::new();
                }
            },
            Ok(r) => {
                tracing::warn!("CODESYS NVD returned {}", r.status());
                return Vec::new();
            }
            Err(e) => {
                tracing::warn!("CODESYS NVD request failed: {e}");
                return Vec::new();
            }
        };
        let matched = parse_codesys_nvd(&body, &version);
        let mut alerts = Vec::new();
        for cve in matched {
            if let Some(e) = entries
                .iter_mut()
                .find(|e| e.name == name && e.version == version)
            {
                e.known_vulnerabilities.push(VulnRef {
                    id: cve.id.clone(),
                    source: "nvd".to_string(),
                    severity: None,
                    url: Some(format!("https://nvd.nist.gov/vuln/detail/{}", cve.id)),
                });
            }
            let mut alert = CveAlert::new(
                cve.id,
                repo_id.to_string(),
                name.clone(),
                version.clone(),
                CveSource::Nvd,
            );
            alert.summary = cve.summary;
            alert.cvss_score = cve.cvss;
            alerts.push(alert);
        }
        tracing::info!(runtime = %name, version = %version, cves = alerts.len(), "CODESYS CVE match");
        alerts
    }
 }
 /// The CODESYS runtime component (name + version) from an SBOM, if present. The
 /// runtime carries the version CODESYS advisories key off; the internal library
 /// components do not.
 fn codesys_runtime(entries: &[SbomEntry]) -> Option<(String, String)> {
    entries
        .iter()
        .find(|e| e.package_manager == "codesys" && e.name.starts_with("CODESYS Control"))
        .map(|e| (e.name.clone(), e.version.clone()))
 }
 /// A parsed NVD CVE that affects the CODESYS runtime.
 struct CodesysCve {
    id: String,
    summary: Option<String>,
    cvss: Option<f64>,
 }
 /// Version constraints from an NVD `cpeMatch` node.
 #[derive(Default)]
 struct CpeRange {
    exact: Option<String>,
    start_incl: Option<String>,
    start_excl: Option<String>,
    end_incl: Option<String>,
    end_excl: Option<String>,
 }
 /// Parse an NVD CVE-list response and keep the CVEs whose CODESYS CPE match covers
 /// `runtime_version`.
 fn parse_codesys_nvd(body: &serde_json::Value, runtime_version: &str) -> Vec<CodesysCve> {
    let mut out = Vec::new();
    let Some(vulns) = body["vulnerabilities"].as_array() else {
        return out;
    };
    for v in vulns {
        let cve = &v["cve"];
        let Some(id) = cve["id"].as_str() else {
            continue;
        };
        let covered = cve["configurations"]
            .as_array()
            .into_iter()
            .flatten()
            .flat_map(|c| c["nodes"].as_array().into_iter().flatten())
            .flat_map(|n| n["cpeMatch"].as_array().into_iter().flatten())
            .any(|cm| {
                cm["vulnerable"].as_bool() == Some(true)
                    && cm["criteria"]
                        .as_str()
                        .is_some_and(|c| c.contains(":codesys:"))
                    && version_matches(runtime_version, &cpe_range(cm))
            });
        if covered {
            let summary = cve["descriptions"]
                .as_array()
                .and_then(|d| d.iter().find(|x| x["lang"].as_str() == Some("en")))
                .and_then(|x| x["value"].as_str())
                .map(String::from);
            let cvss = cve["metrics"]["cvssMetricV31"]
                .as_array()
                .and_then(|m| m.first())
                .and_then(|m| m["cvssData"]["baseScore"].as_f64());
            out.push(CodesysCve {
                id: id.to_string(),
                summary,
                cvss,
            });
        }
    }
    out
 }
 /// Build a [`CpeRange`] from an NVD `cpeMatch` object.
 fn cpe_range(cm: &serde_json::Value) -> CpeRange {
    let exact = cm["criteria"]
        .as_str()
        .and_then(cpe_version)
        .filter(|v| v != "*" && v != "-" && !v.is_empty());
    CpeRange {
        exact,
        start_incl: cm["versionStartIncluding"].as_str().map(String::from),
        start_excl: cm["versionStartExcluding"].as_str().map(String::from),
        end_incl: cm["versionEndIncluding"].as_str().map(String::from),
        end_excl: cm["versionEndExcluding"].as_str().map(String::from),
    }
 }
 /// The version field (6th component) of a CPE 2.3 string.
 fn cpe_version(criteria: &str) -> Option<String> {
    criteria.split(':').nth(5).map(String::from)
 }
 /// Whether `v` satisfies a CPE version range.
 fn version_matches(v: &str, r: &CpeRange) -> bool {
    use std::cmp::Ordering::{Equal, Greater, Less};
    if let Some(exact) = &r.exact {
        return cmp_dotted(v, exact) == Equal;
    }
    let mut ok = true;
    if let Some(s) = &r.start_incl {
        ok &= cmp_dotted(v, s) != Less;
    }
    if let Some(s) = &r.start_excl {
        ok &= cmp_dotted(v, s) == Greater;
    }
    if let Some(e) = &r.end_incl {
        ok &= cmp_dotted(v, e) != Greater;
    }
    if let Some(e) = &r.end_excl {
        ok &= cmp_dotted(v, e) == Less;
    }
    ok
 }
 /// Compare two dotted numeric versions (`4.17.0.0` vs `4.9.0.0`); missing
 /// components count as 0, non-numeric components as 0.
 fn cmp_dotted(a: &str, b: &str) -> std::cmp::Ordering {
    let pa: Vec<u64> = a.split('.').map(|x| x.parse().unwrap_or(0)).collect();
    let pb: Vec<u64> = b.split('.').map(|x| x.parse().unwrap_or(0)).collect();
    for i in 0..pa.len().max(pb.len()) {
        let x = pa.get(i).copied().unwrap_or(0);
        let y = pb.get(i).copied().unwrap_or(0);
        match x.cmp(&y) {
            std::cmp::Ordering::Equal => continue,
            other => return other,
        }
    }
    std::cmp::Ordering::Equal
 }
 #[derive(serde::Deserialize)]
@@ -424,90 +228,3 @@ struct OsvVuln {
    summary: Option<String>,
    severity: Option<String>,
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use std::cmp::Ordering::{Equal, Greater, Less};
    fn entry(name: &str, ver: &str, pm: &str) -> SbomEntry {
        SbomEntry::new("t".into(), name.into(), ver.into(), pm.into())
    }
    #[test]
    fn finds_the_codesys_runtime_component() {
        let entries = vec![
            entry("Standard", "3.5.18.0", "codesys"),
            entry("CODESYS Control for Linux ARM SL", "4.17.0.0", "codesys"),
        ];
        assert_eq!(
            codesys_runtime(&entries),
            Some(("CODESYS Control for Linux ARM SL".into(), "4.17.0.0".into()))
        );
        // Internal library components are not the runtime.
        assert!(codesys_runtime(&[entry("Util", "3.5.21.0", "codesys")]).is_none());
    }
    #[test]
    fn dotted_version_comparison() {
        assert_eq!(cmp_dotted("4.17.0.0", "4.9.0.0"), Greater);
        assert_eq!(cmp_dotted("4.9.0.0", "4.17.0.0"), Less);
        assert_eq!(cmp_dotted("3.5.18.0", "3.5.18.0"), Equal);
        assert_eq!(cmp_dotted("4.2", "4.2.0.0"), Equal); // missing components = 0
    }
    #[test]
    fn version_range_matching() {
        let end_excl = CpeRange {
            end_excl: Some("4.9.0.0".into()),
            ..Default::default()
        };
        assert!(!version_matches("4.17.0.0", &end_excl)); // patched
        assert!(version_matches("4.5.0.0", &end_excl)); // affected
        let exact = CpeRange {
            exact: Some("3.5.16.0".into()),
            ..Default::default()
        };
        assert!(version_matches("3.5.16.0", &exact));
        assert!(!version_matches("3.5.17.0", &exact));
        let span = CpeRange {
            start_incl: Some("3.0.0.0".into()),
            end_incl: Some("3.5.16.0".into()),
            ..Default::default()
        };
        assert!(version_matches("3.5.16.0", &span));
        assert!(!version_matches("3.5.17.0", &span));
    }
    #[test]
    fn parses_nvd_and_matches_by_runtime_version() {
        // Two CODESYS CVEs: one affects < 4.9 (our 4.17 is patched), one affects
        // <= 4.20 (our 4.17 is affected). Only the latter should match.
        let body = serde_json::json!({
          "vulnerabilities": [
            {"cve": {"id":"CVE-2023-0001",
              "descriptions":[{"lang":"en","value":"old CmpBlkDrvTcp bug"}],
              "metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":7.5}}]},
              "configurations":[{"nodes":[{"cpeMatch":[
                {"vulnerable":true,
                 "criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
                 "versionEndExcluding":"4.9.0.0"}
              ]}]}]}},
            {"cve": {"id":"CVE-2024-0002",
              "descriptions":[{"lang":"en","value":"recent runtime bug"}],
              "metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":9.8}}]},
              "configurations":[{"nodes":[{"cpeMatch":[
                {"vulnerable":true,
                 "criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
                 "versionEndIncluding":"4.20.0.0"}
              ]}]}]}}
          ]
        });
        let matched = parse_codesys_nvd(&body, "4.17.0.0");
        let ids: Vec<&str> = matched.iter().map(|c| c.id.as_str()).collect();
        assert_eq!(ids, vec!["CVE-2024-0002"]);
        assert_eq!(matched[0].cvss, Some(9.8));
    }
 }
@@ -1,152 +0,0 @@
 //! Firmware SBOM via tramiton.
 //!
 //! Phase 2 (full, the default): drive a **reproducible build** with tramiton's
 //! `NixBackend` — `analyze` → `seal_and_build` → a sealed lock whose libraries
 //! are pinned and whose firmware artifact carries a content hash — then render
 //! the SBOM from the lock plus deep binary SCA of pre-compiled inputs. This is
 //! the complete bill of materials (toolchain + every fetched library + the
 //! firmware image), the same one `tramiton sbom` produces.
 //!
 //! Phase 1 fallback (analysis-only): when no nix backend is available or the
 //! build fails, fall back to the resolvable libraries + toolchain from the build
 //! plan alone (no build). A scan therefore always yields *something*, and a nix
 //! that can't run in the deployment never breaks a scan.
 use std::path::Path;
 use compliance_core::models::{SbomEntry, TargetType};
 use tramiton_repro::ReproBackend;
 use tramiton_sbom::ComponentKind;
 /// Whether firmware SBOM applies to this target family.
 pub fn is_firmware_target(target_type: TargetType) -> bool {
    matches!(
        target_type,
        TargetType::FirmwareBareMetal | TargetType::FirmwareRtos | TargetType::EmbeddedLinuxYocto
    )
 }
 /// Build SBOM entries for a firmware target from its source tree. Prefers a full
 /// reproducible build (sealed lock); falls back to analysis-only. Returns an
 /// empty vector when tramiton cannot even form a build plan.
 pub async fn firmware_sbom_entries(path: &Path, repo_id: &str) -> Vec<SbomEntry> {
    let p = path.to_path_buf();
    let repo = repo_id.to_string();
    // The whole analyze → seal → build → render sequence is blocking (it shells
    // out to nix), so keep it off the async runtime. Bound it: a firmware build
    // that hangs must not wedge the scan (the orphaned task is abandoned).
    let handle = tokio::task::spawn_blocking(move || build_sbom_blocking(&p, &repo));
    match tokio::time::timeout(std::time::Duration::from_secs(900), handle).await {
        Ok(Ok(entries)) => entries,
        Ok(Err(e)) => {
            tracing::warn!(repo_id, error = %e, "Firmware SBOM: task join error");
            Vec::new()
        }
        Err(_) => {
            tracing::warn!(repo_id, "Firmware SBOM: build exceeded 15m; skipping");
            Vec::new()
        }
    }
 }
 fn build_sbom_blocking(path: &Path, repo_id: &str) -> Vec<SbomEntry> {
    let repo = tramiton_core::Repo::new(path);
    let plan = match tramiton_core::provider::analyze(&repo) {
        Ok(Some(bp)) => bp,
        Ok(None) => return Vec::new(),
        Err(e) => {
            tracing::warn!(repo_id, error = %e, "Firmware SBOM: tramiton analyze failed");
            return Vec::new();
        }
    };
    // Phase 2: reproducible build → sealed lock → complete SBOM.
    if let Some(backend) = tramiton_repro::NixBackend::detect() {
        match tramiton_repro::seal_and_build(&backend, &plan, path) {
            Ok(lock) => {
                let mut sbom = tramiton_sbom::Sbom::from_lock(&lock, repo_id);
                // Deep binary SCA of any pre-compiled inputs in the tree.
                sbom.components.extend(tramiton_sbom::binary::scan(path));
                let entries = sbom_to_entries(&sbom, repo_id);
                tracing::info!(
                    repo_id,
                    backend = backend.name(),
                    count = entries.len(),
                    "Firmware SBOM: sealed reproducible build"
                );
                return entries;
            }
            Err(e) => {
                tracing::warn!(repo_id, error = %e, "Firmware SBOM: reproducible build failed; falling back to analysis-only")
            }
        }
    } else {
        tracing::info!(
            repo_id,
            "Firmware SBOM: no nix backend available; analysis-only SBOM"
        );
    }
    // Phase 1 fallback: analysis-only (toolchain + resolvable libraries).
    analysis_entries(&plan, repo_id)
 }
 /// Map a rendered [`tramiton_sbom::Sbom`] (primary firmware + components) into
 /// our [`SbomEntry`] rows. Source-file (`File`) components are dropped — they are
 /// build inputs, not a dependency inventory.
 fn sbom_to_entries(sbom: &tramiton_sbom::Sbom, repo_id: &str) -> Vec<SbomEntry> {
    let mut entries = Vec::new();
    if let Some(primary) = &sbom.primary {
        entries.push(component_to_entry(primary, repo_id));
    }
    for c in &sbom.components {
        if matches!(c.kind, ComponentKind::File) {
            continue;
        }
        entries.push(component_to_entry(c, repo_id));
    }
    entries
 }
 fn component_to_entry(c: &tramiton_sbom::Component, repo_id: &str) -> SbomEntry {
    let manager = match c.kind {
        ComponentKind::Firmware => "firmware",
        ComponentKind::Library => "library",
        ComponentKind::Toolchain => "toolchain",
        ComponentKind::File => "file",
    };
    let mut entry = SbomEntry::new(
        repo_id.to_string(),
        c.name.clone(),
        c.version.clone().unwrap_or_default(),
        manager.to_string(),
    );
    entry.purl = c.source.clone();
    entry
 }
 /// Analysis-only components from the build plan: the cross-toolchain plus the
 /// resolvable fetched libraries, without a build.
 fn analysis_entries(bp: &tramiton_core::BuildPlan, repo_id: &str) -> Vec<SbomEntry> {
    let mut entries = Vec::new();
    if let Some(id) = bp.toolchain.id.clone() {
        let version = bp.toolchain.version.clone().unwrap_or_default();
        entries.push(SbomEntry::new(
            repo_id.to_string(),
            id,
            version,
            "toolchain".to_string(),
        ));
    }
    for lib in tramiton_repro::lock::libraries_from_inputs(&bp.inputs) {
        let mut entry = SbomEntry::new(
            repo_id.to_string(),
            lib.name,
            lib.revision,
            "library".to_string(),
        );
        entry.purl = lib.source;
        entries.push(entry);
    }
    entries
 }
@@ -80,10 +80,7 @@ impl GitOps {
    #[tracing::instrument(skip_all, fields(repo_name = %repo_name))]
    pub fn clone_or_fetch(&self, git_url: &str, repo_name: &str) -> Result<PathBuf, AgentError> {
-        // Names can contain slashes or other path-hostile characters (a target
+        let repo_path = self.base_path.join(repo_name);
        // named after a repo path, say); collapse to one safe directory segment
        // so the clone path never nests or breaks.
        let repo_path = self.base_path.join(sanitize_repo_dir(repo_name));
        if repo_path.exists() {
            tracing::info!("fetching updates for existing repo");
@@ -138,7 +135,7 @@ impl GitOps {
    /// Build credentials from agent config + per-repo overrides
    pub fn make_repo_credentials(
        config: &compliance_core::AgentConfig,
-        repo: &crate::pipeline::repo_view::RepoView,
+        repo: &compliance_core::models::TrackedRepository,
    ) -> RepoCredentials {
        RepoCredentials {
            ssh_key_path: Some(config.ssh_key_path.clone()),
@@ -256,46 +253,3 @@ pub struct DiffFile {
    pub path: String,
    pub hunks: String,
 }
 /// Collapse a repository name into a single filesystem-safe directory segment.
 /// Names may carry slashes or other path-hostile characters (a target named
 /// after a repo path, for instance); those would otherwise nest or break the
 /// clone path, so map anything outside `[A-Za-z0-9._-]` to `_`.
 fn sanitize_repo_dir(name: &str) -> String {
    let mapped: String = name
        .chars()
        .map(|c| {
            if c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.' {
                c
            } else {
                '_'
            }
        })
        .collect();
    let trimmed = mapped.trim_matches(|c| c == '.' || c == '_');
    if trimmed.is_empty() {
        "repo".to_string()
    } else {
        trimmed.to_string()
    }
 }
 #[cfg(test)]
 mod tests {
    use super::sanitize_repo_dir;
    #[test]
    fn sanitizes_path_hostile_names() {
        assert_eq!(
            sanitize_repo_dir("zephyr-example-app"),
            "zephyr-example-app"
        );
        assert_eq!(
            sanitize_repo_dir("ChristianRinn/bare_metal_stm32f411xe"),
            "ChristianRinn_bare_metal_stm32f411xe"
        );
        assert_eq!(sanitize_repo_dir("../../etc/passwd"), "etc_passwd");
        assert_eq!(sanitize_repo_dir("a b:c"), "a_b_c");
        assert_eq!(sanitize_repo_dir("///"), "repo");
    }
 }
@@ -1,95 +0,0 @@
 //! Minimal EtherNet/IP (CIP) reachability probe.
 //!
 //! Sends an EtherNet/IP encapsulation **ListIdentity** command (0x0063) over TCP
 //! 44818 and checks for a valid encapsulation reply — confirming a CIP device
 //! without opening a session or writing anything.
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;
 use tokio::time::timeout;
 /// Outcome of an EtherNet/IP handshake probe.
 #[derive(Debug, Default, PartialEq, Eq)]
 pub struct EnipProbe {
    /// A TCP connection to the port was established.
    pub reachable: bool,
    /// The endpoint returned a valid EtherNet/IP encapsulation reply.
    pub is_enip: bool,
 }
 /// Probe an EtherNet/IP endpoint with a ListIdentity request. Read-only.
 pub async fn probe(host: &str, port: u16, budget: Duration) -> EnipProbe {
    let mut out = EnipProbe::default();
    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
        return out;
    };
    out.reachable = true;
    // Encapsulation header (24 bytes): command(2) length(2) session(4) status(4)
    // context(8) options(4). ListIdentity = command 0x0063, everything else zero.
    let mut req = vec![0u8; 24];
    req[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
    if timeout(budget, stream.write_all(&req))
        .await
        .ok()
        .and_then(Result::ok)
        .is_none()
    {
        return out;
    }
    let mut hdr = [0u8; 24];
    if timeout(budget, stream.read_exact(&mut hdr))
        .await
        .ok()
        .and_then(Result::ok)
        .is_none()
    {
        return out;
    }
    let command = u16::from_le_bytes([hdr[0], hdr[1]]);
    let status = u32::from_le_bytes([hdr[8], hdr[9], hdr[10], hdr[11]]);
    // Echoed command + success status = a valid EtherNet/IP encapsulation reply.
    if command == 0x0063 && status == 0 {
        out.is_enip = true;
    }
    out
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use tokio::net::TcpListener;
    async fn mock_server() -> std::net::SocketAddr {
        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
        let addr = listener.local_addr().expect("addr");
        tokio::spawn(async move {
            let (mut sock, _) = listener.accept().await.expect("accept");
            let mut req = [0u8; 24];
            if sock.read_exact(&mut req).await.is_err() {
                return;
            }
            // Reply: echo command 0x0063, status 0, no data.
            let mut hdr = vec![0u8; 24];
            hdr[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
            let _ = sock.write_all(&hdr).await;
        });
        addr
    }
    #[tokio::test]
    async fn probe_detects_an_ethernetip_device() {
        let addr = mock_server().await;
        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
        assert!(p.reachable && p.is_enip);
    }
    #[tokio::test]
    async fn probe_reports_unreachable_for_a_closed_port() {
        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
        assert!(!p.reachable && !p.is_enip);
    }
 }
@@ -1,273 +0,0 @@
 //! Dynamic ICS (industrial control system) probing for PLC/SPS targets.
 //!
 //! Where the control-logic scanner is static (over ST / PLCopen XML), this probes
 //! the *running* device over industrial protocols and reports exposed /
 //! unauthenticated control interfaces. It is read-only: it never writes to a live
 //! process. Modbus/TCP and OPC UA are implemented; EtherNet-IP is a follow-on.
 pub mod ethernetip;
 pub mod modbus;
 pub mod opcua;
 pub mod portscan;
 use std::time::Duration;
 use compliance_core::models::{Finding, ScanType, Severity};
 use crate::pipeline::dedup;
 /// Well-known deep-probe ports (each independent of any WebVisu HTTP port).
 const MODBUS_PORT: u16 = 502;
 const OPCUA_PORT: u16 = 4840;
 const ENIP_PORT: u16 = 44818;
 /// Probe a PLC/SPS device's industrial-protocol surface and return findings.
 /// Read-only. Deep-probes Modbus/TCP, OPC UA and EtherNet/IP, plus a service
 /// discovery scan of the remaining OT / insecure-management ports. `endpoint` is
 /// the target's live-URL / host reference.
 pub async fn probe_target(endpoint: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
    let (host, modbus_port) = parse_endpoint(endpoint);
    let mut findings = modbus_findings(&host, modbus_port, repo_id, budget).await;
    findings.extend(opcua_findings(&host, OPCUA_PORT, repo_id, budget).await);
    findings.extend(enip_findings(&host, ENIP_PORT, repo_id, budget).await);
    findings.extend(portscan_findings(&host, repo_id, budget).await);
    findings
 }
 /// Findings from probing the Modbus/TCP surface.
 async fn modbus_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
    let probe = modbus::probe(host, port, budget).await;
    let mut findings = Vec::new();
    if !probe.speaks_modbus {
        // Not reachable, or the port does not speak Modbus — nothing to report.
        return findings;
    }
    let target = format!("{host}:{port}");
    // Reachable Modbus/TCP = unauthenticated, cleartext control access by design.
    let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed", &target]);
    let mut f = Finding::new(
        repo_id.to_string(),
        fp,
        "ics-probe".to_string(),
        ScanType::IcsProbe,
        "Modbus/TCP control interface exposed without authentication".to_string(),
        format!(
            "The device at {target} answers Modbus/TCP requests. Modbus/TCP has no \
             authentication or encryption in the protocol, so any host that can reach this \
             port can read and write process variables (coils/registers) and disrupt the \
             controlled process."
        ),
        Severity::Critical,
    );
    f.rule_id = Some("ics-modbus-exposed".to_string());
    f.cwe = Some("CWE-306".to_string());
    f.remediation = Some(
        "Restrict the Modbus/TCP port to a trusted control network (segmentation / \
         firewall / VPN), never expose it to IT or the internet, and prefer an authenticated \
         transport (e.g. Modbus/TLS) or a secure protocol gateway where available."
            .to_string(),
    );
    findings.push(f);
    if let Some(dev) = &probe.device {
        let details = [
            dev.vendor.as_deref(),
            dev.product.as_deref(),
            dev.revision.as_deref(),
        ]
        .into_iter()
        .flatten()
        .collect::<Vec<_>>()
        .join(" / ");
        let fp = dedup::compute_fingerprint(&[repo_id, "ics-device-disclosure", &target]);
        let mut f = Finding::new(
            repo_id.to_string(),
            fp,
            "ics-probe".to_string(),
            ScanType::IcsProbe,
            "PLC device identity disclosed over Modbus".to_string(),
            format!(
                "The device at {target} discloses its identity via Modbus Read Device \
                 Identification: {details}. This aids fingerprinting and targeting of \
                 known-vulnerable firmware/runtime versions."
            ),
            Severity::Low,
        );
        f.rule_id = Some("ics-device-disclosure".to_string());
        f.cwe = Some("CWE-200".to_string());
        f.remediation = Some(
            "Limit network reach to the device; Modbus device identification cannot be \
             disabled, so exposure is bounded by network segmentation."
                .to_string(),
        );
        findings.push(f);
    }
    findings
 }
 /// Findings from probing the OPC UA surface (default port 4840). A reachability
 /// probe only: it flags an exposed OPC UA server for review of its security
 /// policy / authentication (deep SecurityPolicy analysis is a follow-on).
 async fn opcua_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
    let probe = opcua::probe(host, port, budget).await;
    let mut findings = Vec::new();
    if !probe.is_opcua {
        return findings;
    }
    let target = format!("{host}:{port}");
    let fp = dedup::compute_fingerprint(&[repo_id, "ics-opcua-exposed", &target]);
    let mut f = Finding::new(
        repo_id.to_string(),
        fp,
        "ics-probe".to_string(),
        ScanType::IcsProbe,
        "OPC UA server exposed on the network".to_string(),
        format!(
            "An OPC UA server answers at {target}. Verify it enforces message security \
             (a SecurityPolicy other than None) and rejects anonymous sessions — the common \
             default of SecurityPolicy None + an Anonymous user token allows unauthenticated, \
             unencrypted read/write of the server's address space."
        ),
        Severity::Medium,
    );
    f.rule_id = Some("ics-opcua-exposed".to_string());
    f.cwe = Some("CWE-319".to_string());
    f.remediation = Some(
        "Restrict OPC UA (4840) to a trusted network; require a signed & encrypted \
         SecurityPolicy (Basic256Sha256 or better) with certificate / username \
         authentication, and disable the Anonymous user token."
            .to_string(),
    );
    findings.push(f);
    findings
 }
 /// Findings from probing the EtherNet/IP (CIP) surface (default port 44818).
 async fn enip_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
    let probe = ethernetip::probe(host, port, budget).await;
    if !probe.is_enip {
        return Vec::new();
    }
    let target = format!("{host}:{port}");
    let fp = dedup::compute_fingerprint(&[repo_id, "ics-ethernetip-exposed", &target]);
    let mut f = Finding::new(
        repo_id.to_string(),
        fp,
        "ics-probe".to_string(),
        ScanType::IcsProbe,
        "EtherNet/IP (CIP) interface exposed on the network".to_string(),
        format!(
            "The device at {target} answers EtherNet/IP (CIP) requests. EtherNet/IP has no \
             authentication in the base protocol, so a host that can reach it can enumerate \
             and interact with the device's control objects."
        ),
        Severity::High,
    );
    f.rule_id = Some("ics-ethernetip-exposed".to_string());
    f.cwe = Some("CWE-306".to_string());
    f.remediation = Some(
        "Restrict EtherNet/IP (44818/2222) to a trusted control network; use CIP Security \
         (encryption + authentication) on devices that support it."
            .to_string(),
    );
    vec![f]
 }
 /// Findings from the service-discovery port scan of the remaining OT /
 /// insecure-management surface.
 async fn portscan_findings(host: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
    let open = portscan::scan(host, portscan::KNOWN_PORTS, budget).await;
    open.into_iter()
        .map(|kp| {
            let target = format!("{host}:{}", kp.port);
            let (title, severity, cwe, description) = match kp.kind {
                portscan::PortKind::Ics => (
                    format!("ICS service exposed: {}", kp.service),
                    Severity::High,
                    "CWE-306",
                    format!(
                        "{target} exposes {} ({}). Industrial protocols are typically \
                         unauthenticated, so network reach implies control access.",
                        kp.service, kp.note
                    ),
                ),
                portscan::PortKind::InsecureMgmt => (
                    format!("Cleartext service exposed: {}", kp.service),
                    Severity::Medium,
                    "CWE-319",
                    format!(
                        "{target} exposes {} ({}), which transmits credentials and data in \
                         cleartext.",
                        kp.service, kp.note
                    ),
                ),
            };
            let fp = dedup::compute_fingerprint(&[repo_id, "ics-service-exposed", &target]);
            let mut f = Finding::new(
                repo_id.to_string(),
                fp,
                "ics-probe".to_string(),
                ScanType::IcsProbe,
                title,
                description,
                severity,
            );
            f.rule_id = Some("ics-service-exposed".to_string());
            f.cwe = Some(cwe.to_string());
            f.remediation = Some(
                "Restrict the service to a trusted network segment; disable it if unused; \
                 replace cleartext protocols (Telnet/FTP) with SSH/SFTP."
                    .to_string(),
            );
            f
        })
        .collect()
 }
 /// Extract `(host, port)` from a target reference. Modbus lives on its own port
 /// (502 by default), independent of any HTTP/WebVisu URL, so unless the reference
 /// explicitly carries `modbus://host:port` or a bare `host:port`, we probe 502.
 fn parse_endpoint(endpoint: &str) -> (String, u16) {
    let s = endpoint.trim();
    let (scheme, rest) = match s.split_once("://") {
        Some((sch, r)) => (Some(sch.to_ascii_lowercase()), r),
        None => (None, s),
    };
    let hostport = rest.split(['/', '?']).next().unwrap_or(rest);
    let (host, port) = match hostport.rsplit_once(':') {
        Some((h, p)) => (h.to_string(), p.parse::<u16>().ok()),
        None => (hostport.to_string(), None),
    };
    let port = match (scheme.as_deref(), port) {
        // Explicit Modbus port, or a bare host:port the user chose.
        (Some("modbus"), Some(p)) | (None, Some(p)) => p,
        // An http(s)/WebVisu URL (or no port): Modbus is on its own port.
        _ => MODBUS_PORT,
    };
    (host, port)
 }
 #[cfg(test)]
 mod tests {
    use super::parse_endpoint;
    #[test]
    fn endpoint_parsing_picks_the_modbus_port() {
        assert_eq!(parse_endpoint("10.0.0.5"), ("10.0.0.5".into(), 502));
        assert_eq!(parse_endpoint("10.0.0.5:1502"), ("10.0.0.5".into(), 1502));
        assert_eq!(
            parse_endpoint("modbus://plc.local:5020"),
            ("plc.local".into(), 5020)
        );
        // A WebVisu URL: the http port is ignored; Modbus is on 502.
        assert_eq!(
            parse_endpoint("http://plc.local:8080/webvisu"),
            ("plc.local".into(), 502)
        );
        assert_eq!(
            parse_endpoint("https://plc.local/"),
            ("plc.local".into(), 502)
        );
    }
 }
@@ -1,205 +0,0 @@
 //! Minimal Modbus/TCP client for dynamic ICS probing.
 //!
 //! Modbus/TCP (port 502) has no authentication or encryption in the protocol, so
 //! an endpoint that answers requests is, by design, open to any host that can
 //! reach it. The probe only *reads* — a Read Holding Registers request and a Read
 //! Device Identification request — and never writes to the live process.
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;
 use tokio::time::timeout;
 /// Outcome of probing a Modbus/TCP endpoint.
 #[derive(Debug, Default, PartialEq, Eq)]
 pub struct ModbusProbe {
    /// A TCP connection to the port was established.
    pub reachable: bool,
    /// The endpoint answered a Modbus request (a normal reply or a Modbus
    /// exception) — i.e. it speaks Modbus, unauthenticated.
    pub speaks_modbus: bool,
    /// Device identity, if disclosed via Read Device Identification (FC 43 / 14).
    pub device: Option<DeviceId>,
 }
 /// Vendor / product / revision from Read Device Identification.
 #[derive(Debug, Default, PartialEq, Eq)]
 pub struct DeviceId {
    pub vendor: Option<String>,
    pub product: Option<String>,
    pub revision: Option<String>,
 }
 /// Probe a Modbus/TCP endpoint. Read-only: issues a Read Holding Registers and a
 /// Read Device Identification request; never writes to the device.
 pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
    let mut out = ModbusProbe::default();
    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
        return out; // unreachable
    };
    out.reachable = true;
    // Read Holding Registers (FC 0x03), unit 1, addr 0, qty 1 — a benign read.
    let rhr = [0x03u8, 0x00, 0x00, 0x00, 0x01];
    if let Some(resp) = txn(&mut stream, 1, &rhr, budget).await {
        // A normal reply (0x03) or an exception (0x83) both prove it speaks Modbus.
        if matches!(resp.first(), Some(0x03) | Some(0x83)) {
            out.speaks_modbus = true;
        }
    }
    // Read Device Identification (FC 0x2B / MEI 0x0E), basic (0x01), object 0.
    let rdi = [0x2Bu8, 0x0E, 0x01, 0x00];
    if let Some(resp) = txn(&mut stream, 1, &rdi, budget).await {
        if resp.first() == Some(&0x2B) {
            out.speaks_modbus = true;
            out.device = parse_device_id(&resp);
        }
    }
    out
 }
 /// Send one Modbus PDU and return the response PDU (function code + data), or
 /// `None` on timeout / malformed reply.
 async fn txn(stream: &mut TcpStream, unit: u8, pdu: &[u8], budget: Duration) -> Option<Vec<u8>> {
    // MBAP header: transaction id (2) + protocol id (2) = 0 + length (2) + unit (1),
    // then the PDU. `length` counts the unit byte plus the PDU.
    let len = (pdu.len() + 1) as u16;
    let mut frame = Vec::with_capacity(7 + pdu.len());
    frame.extend_from_slice(&[0x00, 0x01]); // transaction id
    frame.extend_from_slice(&[0x00, 0x00]); // protocol id
    frame.extend_from_slice(&len.to_be_bytes());
    frame.push(unit);
    frame.extend_from_slice(pdu);
    timeout(budget, stream.write_all(&frame)).await.ok()?.ok()?;
    let mut hdr = [0u8; 7];
    timeout(budget, stream.read_exact(&mut hdr))
        .await
        .ok()?
        .ok()?;
    // Reject non-Modbus replies (protocol id must be 0).
    if hdr[2] != 0 || hdr[3] != 0 {
        return None;
    }
    let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
    if !(2..=260).contains(&plen) {
        return None;
    }
    let mut body = vec![0u8; plen - 1]; // minus the unit id already in hdr[6]
    timeout(budget, stream.read_exact(&mut body))
        .await
        .ok()?
        .ok()?;
    Some(body)
 }
 /// Parse vendor / product / revision from a Read Device Identification PDU:
 /// `[0x2B, 0x0E, readDevIdCode, conformity, moreFollows, nextObjId, numObjects,
 /// (objId, len, bytes…)…]`.
 fn parse_device_id(pdu: &[u8]) -> Option<DeviceId> {
    if pdu.len() < 7 {
        return None;
    }
    let num = pdu[6] as usize;
    let mut i = 7;
    let mut dev = DeviceId::default();
    for _ in 0..num {
        if i + 2 > pdu.len() {
            break;
        }
        let id = pdu[i];
        let l = pdu[i + 1] as usize;
        i += 2;
        if i + l > pdu.len() {
            break;
        }
        let val = String::from_utf8_lossy(&pdu[i..i + l]).trim().to_string();
        i += l;
        match id {
            0x00 => dev.vendor = Some(val),
            0x01 => dev.product = Some(val),
            0x02 => dev.revision = Some(val),
            _ => {}
        }
    }
    if dev == DeviceId::default() {
        None
    } else {
        Some(dev)
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use tokio::net::TcpListener;
    /// A one-shot mock Modbus/TCP server that answers a Read Holding Registers
    /// request and a Read Device Identification request on one connection.
    async fn mock_server(with_device: bool) -> std::net::SocketAddr {
        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
        let addr = listener.local_addr().expect("addr");
        tokio::spawn(async move {
            let (mut sock, _) = listener.accept().await.expect("accept");
            loop {
                let mut hdr = [0u8; 7];
                if sock.read_exact(&mut hdr).await.is_err() {
                    break;
                }
                let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
                let mut pdu = vec![0u8; plen - 1];
                if sock.read_exact(&mut pdu).await.is_err() {
                    break;
                }
                let reply_pdu: Vec<u8> = match pdu.first() {
                    Some(0x03) => vec![0x03, 0x02, 0x00, 0x00], // 1 register = 0
                    Some(0x2B) if with_device => vec![
                        0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x02, // 2 objects
                        0x00, 0x04, b'A', b'C', b'M', b'E', // vendor
                        0x01, 0x03, b'P', b'L', b'C', // product
                    ],
                    _ => vec![pdu[0] | 0x80, 0x01], // exception
                };
                let len = (reply_pdu.len() + 1) as u16;
                let mut frame = vec![hdr[0], hdr[1], 0x00, 0x00];
                frame.extend_from_slice(&len.to_be_bytes());
                frame.push(hdr[6]);
                frame.extend_from_slice(&reply_pdu);
                if sock.write_all(&frame).await.is_err() {
                    break;
                }
            }
        });
        addr
    }
    #[tokio::test]
    async fn probe_detects_a_modbus_endpoint_and_reads_device_id() {
        let addr = mock_server(true).await;
        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
        assert!(p.reachable && p.speaks_modbus);
        let dev = p.device.expect("device id");
        assert_eq!(dev.vendor.as_deref(), Some("ACME"));
        assert_eq!(dev.product.as_deref(), Some("PLC"));
    }
    #[tokio::test]
    async fn probe_reports_unreachable_for_a_closed_port() {
        // 127.0.0.1:1 is (almost certainly) closed.
        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
        assert!(!p.reachable && !p.speaks_modbus);
    }
    #[test]
    fn parses_device_identification_objects() {
        let pdu = [
            0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x01, // 1 object
            0x02, 0x05, b'v', b'1', b'.', b'2', b'3', // revision
        ];
        let dev = parse_device_id(&pdu).expect("device");
        assert_eq!(dev.revision.as_deref(), Some("v1.23"));
        assert!(dev.vendor.is_none());
    }
 }
@@ -1,131 +0,0 @@
 //! Minimal OPC UA reachability probe.
 //!
 //! Speaks just the OPC UA Connection Protocol (UACP) handshake — a `HEL` (Hello)
 //! message, expecting an `ACK` (or `ERR`) reply — to confirm an OPC UA server is
 //! listening (default port 4840). It does **not** open a secure channel or make
 //! service calls; deep analysis of the server's SecurityPolicy / user-token
 //! policies (the common `None` + `Anonymous` misconfiguration) is a follow-on best
 //! done with a full OPC UA stack.
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;
 use tokio::time::timeout;
 /// Outcome of an OPC UA handshake probe.
 #[derive(Debug, Default, PartialEq, Eq)]
 pub struct OpcUaProbe {
    /// A TCP connection to the port was established.
    pub reachable: bool,
    /// The endpoint replied to the UACP Hello (`ACK`) or rejected it (`ERR`) —
    /// either way it speaks OPC UA.
    pub is_opcua: bool,
 }
 /// Probe an OPC UA endpoint with a UACP Hello. Read-only handshake only.
 pub async fn probe(host: &str, port: u16, budget: Duration) -> OpcUaProbe {
    let mut out = OpcUaProbe::default();
    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
        return out;
    };
    out.reachable = true;
    let hello = hello_message(&format!("opc.tcp://{host}:{port}"));
    if timeout(budget, stream.write_all(&hello))
        .await
        .ok()
        .and_then(Result::ok)
        .is_none()
    {
        return out;
    }
    // Read the 3-byte message type of the reply: ACK (accepted) or ERR (rejected
    // our hello) both prove the peer speaks the OPC UA connection protocol.
    let mut mt = [0u8; 3];
    if timeout(budget, stream.read_exact(&mut mt))
        .await
        .ok()
        .and_then(Result::ok)
        .is_none()
    {
        return out;
    }
    if &mt == b"ACK" || &mt == b"ERR" {
        out.is_opcua = true;
    }
    out
 }
 /// Build a UACP `HEL` (Hello) message advertising our buffer sizes + endpoint URL.
 fn hello_message(endpoint_url: &str) -> Vec<u8> {
    let url = endpoint_url.as_bytes();
    let mut m = Vec::with_capacity(32 + url.len());
    m.extend_from_slice(b"HELF");
    m.extend_from_slice(&0u32.to_le_bytes()); // message size — patched below
    m.extend_from_slice(&0u32.to_le_bytes()); // ProtocolVersion
    m.extend_from_slice(&65536u32.to_le_bytes()); // ReceiveBufferSize
    m.extend_from_slice(&65536u32.to_le_bytes()); // SendBufferSize
    m.extend_from_slice(&0u32.to_le_bytes()); // MaxMessageSize (0 = no limit)
    m.extend_from_slice(&0u32.to_le_bytes()); // MaxChunkCount
    m.extend_from_slice(&(url.len() as i32).to_le_bytes()); // EndpointUrl length
    m.extend_from_slice(url);
    let size = m.len() as u32;
    m[4..8].copy_from_slice(&size.to_le_bytes());
    m
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use tokio::net::TcpListener;
    /// A mock OPC UA server that reads the Hello and replies with an `ACK` frame.
    async fn mock_server() -> std::net::SocketAddr {
        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
        let addr = listener.local_addr().expect("addr");
        tokio::spawn(async move {
            let (mut sock, _) = listener.accept().await.expect("accept");
            // Read the Hello header (8 bytes) to learn the size, then drain it.
            let mut hdr = [0u8; 8];
            if sock.read_exact(&mut hdr).await.is_err() {
                return;
            }
            let size = u32::from_le_bytes([hdr[4], hdr[5], hdr[6], hdr[7]]) as usize;
            let mut rest = vec![0u8; size.saturating_sub(8)];
            let _ = sock.read_exact(&mut rest).await;
            // Reply: ACK + size + 5 u32 fields.
            let mut ack = Vec::new();
            ack.extend_from_slice(b"ACKF");
            ack.extend_from_slice(&28u32.to_le_bytes());
            for _ in 0..5 {
                ack.extend_from_slice(&0u32.to_le_bytes());
            }
            let _ = sock.write_all(&ack).await;
        });
        addr
    }
    #[tokio::test]
    async fn probe_detects_an_opcua_server() {
        let addr = mock_server().await;
        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
        assert!(p.reachable && p.is_opcua);
    }
    #[tokio::test]
    async fn probe_reports_unreachable_for_a_closed_port() {
        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
        assert!(!p.reachable && !p.is_opcua);
    }
    #[test]
    fn hello_message_is_well_formed() {
        let m = hello_message("opc.tcp://h:4840");
        assert_eq!(&m[0..4], b"HELF");
        // The embedded size equals the actual length.
        let size = u32::from_le_bytes([m[4], m[5], m[6], m[7]]) as usize;
        assert_eq!(size, m.len());
    }
 }
@@ -1,137 +0,0 @@
 //! TCP service discovery for a device.
 //!
 //! Connect-scans a curated set of OT/ICS and insecure-management ports and reports
 //! the ones that are open. The deep protocol probes own Modbus (502), OPC UA
 //! (4840) and EtherNet/IP (44818); this surfaces the *rest* of the industrial and
 //! cleartext-management surface (Siemens S7, DNP3, CODESYS programming, Telnet, …).
 use std::time::Duration;
 use futures_util::future::join_all;
 use tokio::net::TcpStream;
 use tokio::time::timeout;
 /// Whether an open port is an industrial protocol or an insecure management service.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum PortKind {
    /// An industrial control protocol (typically unauthenticated).
    Ics,
    /// A cleartext management service (credentials/data in the clear).
    InsecureMgmt,
 }
 /// A well-known port worth flagging when open.
 #[derive(Debug, Clone, Copy)]
 pub struct KnownPort {
    pub port: u16,
    pub service: &'static str,
    pub kind: PortKind,
    pub note: &'static str,
 }
 /// The curated scan list. Excludes 502 / 4840 / 44818 — those have dedicated deep
 /// probes (Modbus, OPC UA, EtherNet/IP) that report richer findings.
 pub const KNOWN_PORTS: &[KnownPort] = &[
    KnownPort {
        port: 102,
        service: "S7comm / ISO-TSAP",
        kind: PortKind::Ics,
        note: "Siemens S7 PLC communication",
    },
    KnownPort {
        port: 20000,
        service: "DNP3",
        kind: PortKind::Ics,
        note: "SCADA / DNP3",
    },
    KnownPort {
        port: 1911,
        service: "Niagara Fox",
        kind: PortKind::Ics,
        note: "Tridium Niagara building automation",
    },
    KnownPort {
        port: 11740,
        service: "CODESYS",
        kind: PortKind::Ics,
        note: "CODESYS programming protocol",
    },
    KnownPort {
        port: 1962,
        service: "PCWorx",
        kind: PortKind::Ics,
        note: "Phoenix Contact PCWorx",
    },
    KnownPort {
        port: 9600,
        service: "OMRON FINS",
        kind: PortKind::Ics,
        note: "Omron FINS",
    },
    KnownPort {
        port: 789,
        service: "Red Lion Crimson",
        kind: PortKind::Ics,
        note: "Red Lion controllers",
    },
    KnownPort {
        port: 23,
        service: "Telnet",
        kind: PortKind::InsecureMgmt,
        note: "cleartext remote shell",
    },
    KnownPort {
        port: 21,
        service: "FTP",
        kind: PortKind::InsecureMgmt,
        note: "cleartext file transfer",
    },
 ];
 /// Connect-scan `ports` on `host` (concurrently) and return those that accept a
 /// TCP connection.
 pub async fn scan<'a>(host: &str, ports: &'a [KnownPort], budget: Duration) -> Vec<&'a KnownPort> {
    let checks = ports.iter().map(|kp| async move {
        let open = timeout(budget, TcpStream::connect((host, kp.port)))
            .await
            .map(|r| r.is_ok())
            .unwrap_or(false);
        (kp, open)
    });
    join_all(checks)
        .await
        .into_iter()
        .filter_map(|(kp, open)| open.then_some(kp))
        .collect()
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use tokio::net::TcpListener;
    #[tokio::test]
    async fn scan_reports_only_open_ports() {
        // Bind one port (open) and pick another that is closed.
        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
        let open_port = listener.local_addr().expect("addr").port();
        let ports = [
            KnownPort {
                port: open_port,
                service: "test-open",
                kind: PortKind::Ics,
                note: "",
            },
            KnownPort {
                port: 1,
                service: "test-closed",
                kind: PortKind::InsecureMgmt,
                note: "",
            },
        ];
        let found = scan("127.0.0.1", &ports, Duration::from_millis(500)).await;
        let services: Vec<&str> = found.iter().map(|p| p.service).collect();
        assert_eq!(services, vec!["test-open"]);
    }
 }
@@ -1,6 +1,5 @@
 use mongodb::bson::doc;
 use crate::pipeline::repo_view::RepoView;
 use compliance_core::models::*;
 use super::orchestrator::{extract_base_url, PipelineOrchestrator};
@@ -11,7 +10,7 @@ use crate::trackers;
 impl PipelineOrchestrator {
    /// Build an issue tracker client from a repository's tracker configuration.
    /// Returns `None` if the repo has no tracker configured.
-    pub(super) fn build_tracker(&self, repo: &RepoView) -> Option<TrackerDispatch> {
+    pub(super) fn build_tracker(&self, repo: &TrackedRepository) -> Option<TrackerDispatch> {
        let tracker_type = repo.tracker_type.as_ref()?;
        // Per-repo token takes precedence, fall back to global config
        match tracker_type {
@@ -82,7 +81,7 @@ impl PipelineOrchestrator {
    #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
    pub(super) async fn create_tracker_issues(
        &self,
-        repo: &RepoView,
+        repo: &TrackedRepository,
        repo_id: &str,
        new_findings: &[Finding],
    ) -> Result<(), AgentError> {
@@ -1,19 +1,15 @@
 pub mod code_review;
 pub mod cve;
 pub mod dedup;
 pub mod firmware_sbom;
 pub mod git;
 pub mod gitleaks;
 mod graph_build;
 pub mod ics;
 mod issue_creation;
 pub mod lint;
 pub mod orchestrator;
 pub mod patterns;
 pub mod plan;
 pub mod plc;
 mod pr_review;
 pub mod repo_view;
 pub mod sbom;
 pub mod semgrep;
 mod tracker_dispatch;
@@ -16,7 +16,6 @@ use crate::pipeline::gitleaks::GitleaksScanner;
 use crate::pipeline::lint::LintScanner;
 use crate::pipeline::patterns::{GdprPatternScanner, OAuthPatternScanner};
 use crate::pipeline::plan::build_scan_plan;
 use crate::pipeline::repo_view::RepoView;
 use crate::pipeline::sbom::SbomScanner;
 use crate::pipeline::semgrep::SemgrepScanner;
@@ -52,8 +51,72 @@ impl PipelineOrchestrator {
        }
    }
    #[tracing::instrument(skip_all, fields(repo_id = %repo_id, trigger = ?trigger))]
    pub async fn run(&self, repo_id: &str, trigger: ScanTrigger) -> Result<(), AgentError> {
        // Look up the repository
        let repo = self
            .db
            .repositories()
            .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(repo_id).map_err(|e| AgentError::Other(e.to_string()))? })
            .await?
            .ok_or_else(|| AgentError::Other(format!("Repository {repo_id} not found")))?;
        // Create scan run
        let scan_run = ScanRun::new(repo_id.to_string(), trigger);
        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
        let scan_run_id = insert
            .inserted_id
            .as_object_id()
            .map(|id| id.to_hex())
            .unwrap_or_default();
        let result = self.run_pipeline(&repo, &scan_run_id).await;
        // Update scan run status
        match &result {
            Ok(count) => {
                self.db
                    .scan_runs()
                    .update_one(
                        doc! { "_id": &insert.inserted_id },
                        doc! {
                            "$set": {
                                "status": "completed",
                                "current_phase": "completed",
                                "new_findings_count": *count as i64,
                                "completed_at": mongodb::bson::DateTime::now(),
                            }
                        },
                    )
                    .await?;
            }
            Err(e) => {
                tracing::error!(repo_id, error = %e, "Scan pipeline failed");
                self.db
                    .scan_runs()
                    .update_one(
                        doc! { "_id": &insert.inserted_id },
                        doc! {
                            "$set": {
                                "status": "failed",
                                "error_message": e.to_string(),
                                "completed_at": mongodb::bson::DateTime::now(),
                            }
                        },
                    )
                    .await?;
            }
        }
        result.map(|_| ())
    }
    #[tracing::instrument(skip_all, fields(repo_id = repo.name.as_str()))]
-    async fn run_pipeline(&self, repo: &RepoView, scan_run_id: &str) -> Result<u32, AgentError> {
+    async fn run_pipeline(
        &self,
        repo: &TrackedRepository,
        scan_run_id: &str,
    ) -> Result<u32, AgentError> {
        let repo_id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
        // Stage 0: Change detection
@@ -67,6 +130,7 @@ impl PipelineOrchestrator {
            return Ok(0);
        }
        let current_sha = GitOps::get_head_sha(&repo_path)?;
        let mut all_findings: Vec<Finding> = Vec::new();
        // Stage 1: Semgrep SAST
@@ -259,13 +323,68 @@ impl PipelineOrchestrator {
                .await?;
        }
-        // Persist CVE alerts and create notifications (shared with the PLC path).
+        // Persist CVE alerts and create notifications
-        let new_notif_count = self
+        {
-            .persist_cve_alerts(&repo_id, &repo.name, &cve_alerts)
+            use compliance_core::models::notification::{parse_severity, CveNotification};
            let repo_name = repo.name.clone();
            let mut new_notif_count = 0u32;
            for alert in &cve_alerts {
                // Upsert the alert
                let filter = doc! {
                    "cve_id": &alert.cve_id,
                    "repo_id": &alert.repo_id,
                };
                let update = mongodb::bson::to_document(alert)
                    .map(|d| doc! { "$set": d })
                    .unwrap_or_else(|_| doc! {});
                self.db
                    .cve_alerts()
                    .update_one(filter, update)
                    .upsert(true)
                    .await?;
                // Create notification (dedup by cve_id + repo + package + version)
                let notif_filter = doc! {
                    "cve_id": &alert.cve_id,
                    "repo_id": &alert.repo_id,
                    "package_name": &alert.affected_package,
                    "package_version": &alert.affected_version,
                };
                let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
                let mut notification = CveNotification::new(
                    alert.cve_id.clone(),
                    repo_id.clone(),
                    repo_name.clone(),
                    alert.affected_package.clone(),
                    alert.affected_version.clone(),
                    severity,
                );
                notification.cvss_score = alert.cvss_score;
                notification.summary = alert.summary.clone();
                notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
                let notif_update = doc! {
                    "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
                };
                if let Ok(result) = self
                    .db
                    .cve_notifications()
                    .update_one(notif_filter, notif_update)
                    .upsert(true)
                    .await
                {
                    if result.upserted_id.is_some() {
                        new_notif_count += 1;
                    }
                }
            }
            if new_notif_count > 0 {
                tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
            }
        }
        // Stage 6: Issue Creation
        tracing::info!("[{repo_id}] Stage 6: Issue Creation");
@@ -277,9 +396,20 @@ impl PipelineOrchestrator {
            tracing::warn!("[{repo_id}] Issue creation failed: {e}");
        }
-        // The onboarded target's findings_count and the git artifact's
+        // Stage 7: Update repository
-        // last_scanned_commit watermark are persisted by `finalize_target` after
+        self.db
-        // `run_pipeline` returns.
+            .repositories()
            .update_one(
                doc! { "_id": repo.id },
                doc! {
                    "$set": {
                        "last_scanned_commit": &current_sha,
                        "updated_at": mongodb::bson::DateTime::now(),
                    },
                    "$inc": { "findings_count": new_count as i64 },
                },
            )
            .await?;
        // Stage 8: DAST (async, optional — only if a DastTarget is configured)
        tracing::info!("[{repo_id}] Stage 8: Checking for DAST targets");
@@ -394,334 +524,33 @@ impl PipelineOrchestrator {
        // wizard-created targets, not just migrated ones.
        self.ensure_dast_target(target, &plan).await;
        // PLC/SPS targets: the control-logic scan consumes the PLC source (an
        // uploaded PlcProject *or* a git repo / source archive of PLCopen XML / ST
        // exports), so it takes over the code artifact — we don't also run the
        // SAST pipeline over it. A PLC device is reachable, so DAST still runs
        // against a WebVisu / exposed endpoint when one is provisioned.
        let mut new_count = 0u32;
        let plc = plan.has(ScanType::PlcControlLogic);
        let ics = plan.has(ScanType::IcsProbe);
        if plc {
            new_count += self.run_plc_scan(target, &target_id, scan_run_id).await?;
        }
        if ics {
            new_count += self.run_ics_probe(target, &target_id, scan_run_id).await?;
        }
        if plc || ics {
            // PLC/SPS device: also DAST against a WebVisu / exposed endpoint, but
            // only when DAST is actually planned — a device reachable only over an
            // industrial protocol (e.g. modbus://) has no web surface to crawl, and
            // running DAST there just fails at reconnaissance. Gating here (not only
            // at provisioning) also stops a DAST target left over from an earlier
            // run from re-triggering. The control-logic scan already consumed the
            // code artifact, so the SAST pipeline is not re-run.
            if plan.has(ScanType::Dast) {
                self.update_phase(scan_run_id, "dast_scanning").await;
                self.maybe_trigger_dast(&target_id, scan_run_id).await;
            }
            return Ok(new_count);
        }
        match target.code_artifact() {
            Some(code) if code.kind == ArtifactKind::GitRepo => {
-                let repo = RepoView::from_target(target, code);
+                let repo = repo_view_from_target(target, code);
-                let n = self.run_pipeline(&repo, scan_run_id).await?;
+                let new_count = self.run_pipeline(&repo, scan_run_id).await?;
-                self.finalize_target(target, &repo, n).await?;
+                self.finalize_target(target, &repo, new_count).await?;
-                new_count += n;
+                Ok(new_count)
            }
            Some(_) => {
                tracing::warn!(
                    target_id = %target_id,
                    "Unified pipeline: source-archive scanning not yet wired; skipping"
                );
                Ok(0)
            }
            None => {
-                // No code to scan (a migrated DAST target). Firmware/mobile static
+                // No code to scan. Firmware/PLC/mobile static scanners land in
-                // scanners land in #128/#129; DAST for a running URL works when a
+                // #128/#129/#130; DAST for a running URL still works when a
-                // DastTarget row exists (provisioned above from a LiveUrl, or from
+                // DastTarget row exists (migrated targets).
                // a migrated target).
                tracing::info!(
                    target_id = %target_id,
-                    "Unified pipeline: no code artifact; attempting DAST"
+                    "Unified pipeline: no code artifact; attempting DAST only"
                );
                self.update_phase(scan_run_id, "dast_scanning").await;
                self.maybe_trigger_dast(&target_id, scan_run_id).await;
                Ok(0)
            }
        }
        Ok(new_count)
    }
    /// Analyze a PLC/SPS project (Structured Text / PLCopen XML) for
    /// control-logic security issues and persist the new findings.
    async fn run_plc_scan(
        &self,
        target: &OnboardedTarget,
        target_id: &str,
        scan_run_id: &str,
    ) -> Result<u32, AgentError> {
        tracing::info!(target_id, "[{target_id}] PLC control-logic analysis");
        self.update_phase(scan_run_id, "plc_analysis").await;
        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
        let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
        // Every PLC-source artifact on the target: dedicated PLC projects plus any
        // code artifacts (git repo / source archive) holding PLCopen XML / ST
        // exports. A target can carry several (e.g. one POU export per file).
        let sources: Vec<&Artifact> = target
            .artifacts
            .iter()
            .filter(|a| {
                matches!(
                    a.kind,
                    ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
                )
            })
            .collect();
        if sources.is_empty() {
            tracing::warn!(target_id, "PLC scan: no PLC source artifact");
            return Ok(0);
        }
        let mut all_findings = Vec::new();
        let mut all_sbom: Vec<SbomEntry> = Vec::new();
        let mut sbom_seen = std::collections::BTreeSet::new();
        for a in &sources {
            let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
                continue;
            };
            all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
            // Control-application SBOM: CODESYS libraries + runtime from a
            // `.projectarchive` (uploaded, or committed in the working tree).
            let archive = a
                .stored_path
                .clone()
                .unwrap_or_else(|| a.source_ref.clone());
            for e in crate::pipeline::plc::sbom::collect_sbom(
                std::path::Path::new(&archive),
                &path,
                target_id,
            ) {
                if sbom_seen.insert((e.name.clone(), e.version.clone())) {
                    all_sbom.push(e);
                }
            }
        }
        tracing::info!(
            target_id,
            artifacts = sources.len(),
            found = all_findings.len(),
            "PLC control-logic analysis complete"
        );
        let mut new_count = 0u32;
        for mut finding in all_findings {
            finding.scan_run_id = Some(scan_run_id.to_string());
            if self
                .db
                .findings()
                .find_one(doc! { "fingerprint": &finding.fingerprint })
                .await?
                .is_none()
            {
                self.db.findings().insert_one(&finding).await?;
                new_count += 1;
            }
        }
        if !all_sbom.is_empty() {
            if let Err(e) = self
                .persist_control_app_sbom(target_id, &target.name, all_sbom)
                .await
            {
                tracing::warn!(target_id, error = %e, "control-app SBOM persist failed");
            }
        }
        Ok(new_count)
    }
    /// Probe a running PLC/SPS device over industrial protocols (Modbus/TCP, …)
    /// and persist findings for exposed / unauthenticated control access. The
    /// probe is read-only; it targets the Modbus port of the target's live URL.
    async fn run_ics_probe(
        &self,
        target: &OnboardedTarget,
        target_id: &str,
        scan_run_id: &str,
    ) -> Result<u32, AgentError> {
        self.update_phase(scan_run_id, "ics_probe").await;
        let Some(endpoint) = target.live_url().map(|a| a.source_ref.clone()) else {
            tracing::warn!(target_id, "ICS probe: no live URL");
            return Ok(0);
        };
        // Short per-request budget so an unreachable device doesn't stall the scan.
        let budget = std::time::Duration::from_secs(5);
        let findings = crate::pipeline::ics::probe_target(&endpoint, target_id, budget).await;
        tracing::info!(
            target_id,
            endpoint = %endpoint,
            found = findings.len(),
            "ICS probe complete"
        );
        let mut new_count = 0u32;
        for mut finding in findings {
            finding.scan_run_id = Some(scan_run_id.to_string());
            if self
                .db
                .findings()
                .find_one(doc! { "fingerprint": &finding.fingerprint })
                .await?
                .is_none()
            {
                self.db.findings().insert_one(&finding).await?;
                new_count += 1;
            }
        }
        Ok(new_count)
    }
    /// Store a control-application SBOM (CODESYS libraries + runtime) for a target
    /// and match it against known CVEs. Scoped to `package_manager = "codesys"` so
    /// it refreshes on re-scan and coexists with any firmware/source SBOM. The
    /// runtime `Cmp*` / `3SLicense` components carry real CODESYS advisories, so
    /// this is where PLC-device CVE coverage comes from.
    async fn persist_control_app_sbom(
        &self,
        target_id: &str,
        target_name: &str,
        mut entries: Vec<SbomEntry>,
    ) -> Result<(), AgentError> {
        if entries.is_empty() {
            return Ok(());
        }
        self.db
            .sbom_entries()
            .delete_many(doc! { "repo_id": target_id, "package_manager": "codesys" })
            .await?;
        let cve_scanner = CveScanner::new(
            self.http.clone(),
            self.config.searxng_url.clone(),
            self.config.nvd_api_key.as_ref().map(|k| {
                use secrecy::ExposeSecret;
                k.expose_secret().to_string()
            }),
        );
        let mut alerts = match tokio::time::timeout(
            std::time::Duration::from_secs(600),
            cve_scanner.scan_dependencies(target_id, &mut entries),
        )
        .await
        {
            Ok(Ok(a)) => a,
            Ok(Err(e)) => {
                tracing::warn!(target_id, error = %e, "control-app CVE scan failed");
                Vec::new()
            }
            Err(_) => {
                tracing::warn!(target_id, "control-app CVE scan timed out");
                Vec::new()
            }
        };
        // OSV can't match `pkg:codesys/*` (no such ecosystem); CODESYS advisories
        // live in NVD keyed by CPE + runtime version. Add those (best-effort).
        if let Ok(codesys) = tokio::time::timeout(
            std::time::Duration::from_secs(120),
            cve_scanner.scan_codesys(target_id, &mut entries),
        )
        .await
        {
            alerts.extend(codesys);
        } else {
            tracing::warn!(target_id, "CODESYS CVE match timed out");
        }
        for entry in &entries {
            let filter = doc! {
                "repo_id": &entry.repo_id,
                "name": &entry.name,
                "version": &entry.version,
            };
            if let Ok(d) = mongodb::bson::to_document(entry) {
                self.db
                    .sbom_entries()
                    .update_one(filter, doc! { "$set": d })
                    .upsert(true)
                    .await?;
            }
        }
        let new_notifs = self
            .persist_cve_alerts(target_id, target_name, &alerts)
            .await?;
        tracing::info!(
            target_id,
            components = entries.len(),
            alerts = alerts.len(),
            notifications = new_notifs,
            "control-app SBOM stored"
        );
        Ok(())
    }
    /// Upsert CVE alerts for a target and create dedup'd CVE notifications;
    /// returns the number of newly-created notifications. Shared by the SAST
    /// pipeline and the PLC control-app SBOM path, so every SBOM source (source,
    /// firmware, CODESYS libraries/runtime) raises the same notifications.
    async fn persist_cve_alerts(
        &self,
        repo_id: &str,
        repo_name: &str,
        alerts: &[CveAlert],
    ) -> Result<u32, AgentError> {
        use compliance_core::models::notification::{parse_severity, CveNotification};
        let mut new_notif = 0u32;
        for alert in alerts {
            let filter = doc! { "cve_id": &alert.cve_id, "repo_id": &alert.repo_id };
            let update = mongodb::bson::to_document(alert)
                .map(|d| doc! { "$set": d })
                .unwrap_or_else(|_| doc! {});
            self.db
                .cve_alerts()
                .update_one(filter, update)
                .upsert(true)
                .await?;
            // Dedup notifications by cve + repo + package + version.
            let notif_filter = doc! {
                "cve_id": &alert.cve_id,
                "repo_id": &alert.repo_id,
                "package_name": &alert.affected_package,
                "package_version": &alert.affected_version,
            };
            let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
            let mut notification = CveNotification::new(
                alert.cve_id.clone(),
                repo_id.to_string(),
                repo_name.to_string(),
                alert.affected_package.clone(),
                alert.affected_version.clone(),
                severity,
            );
            notification.cvss_score = alert.cvss_score;
            notification.summary = alert.summary.clone();
            notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
            let notif_update = doc! {
                "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
            };
            if let Ok(result) = self
                .db
                .cve_notifications()
                .update_one(notif_filter, notif_update)
                .upsert(true)
                .await
            {
                if result.upserted_id.is_some() {
                    new_notif += 1;
                }
            }
        }
        Ok(new_notif)
    }
    /// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
@@ -772,47 +601,6 @@ impl PipelineOrchestrator {
                tracing::warn!(target_id, error = %e, "Unified pipeline: classification failed")
            }
        }
        // Analysis-based firmware SBOM: for embedded targets, derive components
        // (resolved libraries + cross-toolchain) from tramiton's build-plan
        // analysis over the already-ingested source — no build, no binary
        // upload. Best-effort; empty when no build plan forms.
        if crate::pipeline::firmware_sbom::is_firmware_target(target.target_type) {
            if let Some(code) = target.code_artifact() {
                if let Some(path) = working_paths.get(&code.id) {
                    let entries =
                        crate::pipeline::firmware_sbom::firmware_sbom_entries(path, target_id)
                            .await;
                    if !entries.is_empty() {
                        let _ = self
                            .db
                            .sbom_entries()
                            .delete_many(doc! { "repo_id": target_id })
                            .await;
                        for entry in &entries {
                            let filter = doc! {
                                "repo_id": &entry.repo_id,
                                "name": &entry.name,
                                "version": &entry.version,
                            };
                            if let Ok(d) = mongodb::bson::to_document(entry) {
                                let _ = self
                                    .db
                                    .sbom_entries()
                                    .update_one(filter, doc! { "$set": d })
                                    .upsert(true)
                                    .await;
                            }
                        }
                        tracing::info!(
                            target_id,
                            count = entries.len(),
                            "Firmware SBOM: stored components from tramiton analysis"
                        );
                    }
                }
            }
        }
    }
    /// If the target has a `LiveUrl` artifact and DAST is planned, provision a
@@ -874,7 +662,7 @@ impl PipelineOrchestrator {
    async fn finalize_target(
        &self,
        target: &OnboardedTarget,
-        repo: &RepoView,
+        repo: &TrackedRepository,
        new_count: u32,
    ) -> Result<(), AgentError> {
        let oid = match target.id {
@@ -922,6 +710,37 @@ impl PipelineOrchestrator {
    }
 }
 /// Build a legacy `TrackedRepository` view from an onboarded target's code
 /// artifact, so the unified pipeline can reuse the existing repo pipeline. The
 /// inverse of the migration's `repo_to_target`. `_id` is preserved so findings
 /// and DAST lookups resolve against the same key.
 fn repo_view_from_target(target: &OnboardedTarget, code: &Artifact) -> TrackedRepository {
    let mut repo = TrackedRepository::new(target.name.clone(), code.source_ref.clone());
    repo.id = target.id;
    if let Some(git) = &code.git {
        repo.default_branch = git.default_branch.clone();
        repo.last_scanned_commit = git.last_scanned_commit.clone();
        repo.local_path = git.local_path.clone();
    }
    if let Some(auth) = &code.auth {
        repo.auth_token = auth.secret.clone();
        repo.auth_username = auth.username.clone();
    }
    if let Some(it) = &target.scan_config.issue_tracker {
        repo.tracker_type = it.tracker_type.clone();
        repo.tracker_owner = it.owner.clone();
        repo.tracker_repo = it.repo.clone();
        repo.tracker_token = it.token.clone();
    }
    repo.scan_schedule = target.scan_schedule.clone();
    repo.webhook_enabled = target.webhook_enabled;
    repo.webhook_secret = target.webhook_secret.clone();
    repo.findings_count = target.findings_count;
    repo.created_at = target.created_at;
    repo.updated_at = target.updated_at;
    repo
 }
 /// Extract the scheme + host from a git URL.
 /// e.g. "https://gitea.example.com/owner/repo.git" -> "https://gitea.example.com"
 /// e.g. "ssh://git@gitea.example.com:22/owner/repo.git" -> "https://gitea.example.com"
@@ -980,7 +799,7 @@ mod tests {
        target.artifacts.push(artifact);
        let code = target.code_artifact().expect("code artifact");
-        let repo = RepoView::from_target(&target, code);
+        let repo = repo_view_from_target(&target, code);
        assert_eq!(repo.id, target.id); // preserved
        assert_eq!(repo.git_url, "https://git/acme.git");
@@ -75,16 +75,10 @@ pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
 }
 /// Resolve the artifact a scan consumes. A "code" requirement (represented by
-/// `GitRepo`) is satisfied by a git repo *or* a source archive. The PLC
+/// `GitRepo`) is satisfied by a git repo *or* a source archive.
 /// control-logic requirement (represented by `PlcProject`) prefers an uploaded
 /// PLC project but also accepts a code artifact — a git repo / source archive
 /// holding PLCopen XML / ST exports.
 fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
    match required {
        Some(ArtifactKind::GitRepo) => target.code_artifact(),
        Some(ArtifactKind::PlcProject) => target
            .first_of(ArtifactKind::PlcProject)
            .or_else(|| target.code_artifact()),
        Some(kind) => target.first_of(kind),
        None => target.code_artifact().or_else(|| target.artifacts.first()),
    }
@@ -106,7 +100,6 @@ fn phase_for(scan: ScanType) -> ScanPhase {
        ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
        ScanType::MobileStatic => ScanPhase::MobileStatic,
        ScanType::ContainerScan => ScanPhase::ContainerScan,
        ScanType::IcsProbe => ScanPhase::IcsProbe,
    }
 }
@@ -181,18 +174,6 @@ mod tests {
        assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
    }
    #[test]
    fn plc_control_logic_binds_to_a_git_repo() {
        // A CODESYS project in git (PLCopen XML / ST exports) with no uploaded
        // PlcProject: control-logic still plans, bound to the git artifact.
        let git = Artifact::git_repo("https://git/plc", "main");
        let git_id = git.id.clone();
        let t = target(TargetType::PlcSps, vec![git]);
        let plan = build_scan_plan(&t);
        let step = step_for(&plan, ScanType::PlcControlLogic).expect("control-logic planned");
        assert_eq!(step.artifact_id, git_id, "PLC scan binds to the git repo");
    }
    #[test]
    fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
        let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
@@ -1,226 +0,0 @@
 //! Abstract syntax tree for IEC 61131-3 Structured Text (ST).
 //!
 //! This is the security-relevant subset: POUs with their variable declarations
 //! and statement bodies, enough to run semantic control-logic rules over. It is
 //! deliberately not a full language model — declarations we don't reason about
 //! (e.g. exotic type definitions) are parsed loosely and kept as raw text.
 /// A Program Organization Unit: a PROGRAM, FUNCTION, or FUNCTION_BLOCK.
 #[derive(Debug, Clone)]
 pub struct Pou {
    pub name: String,
    pub kind: PouKind,
    /// The declared variables, across all VAR_* sections.
    pub vars: Vec<VarDecl>,
    /// The statement body.
    pub body: Vec<Stmt>,
    /// 1-based line where the POU header appears (in the source that was parsed).
    pub line: u32,
 }
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum PouKind {
    Program,
    Function,
    FunctionBlock,
 }
 impl PouKind {
    pub fn label(self) -> &'static str {
        match self {
            PouKind::Program => "PROGRAM",
            PouKind::Function => "FUNCTION",
            PouKind::FunctionBlock => "FUNCTION_BLOCK",
        }
    }
 }
 /// A single declared variable.
 #[derive(Debug, Clone)]
 pub struct VarDecl {
    pub name: String,
    pub section: VarSection,
    /// The declared type as written (e.g. `BOOL`, `INT`, `ARRAY[0..9] OF INT`).
    pub type_name: String,
    /// Whether the type is an ARRAY, and its declared bounds `(lo, hi)` when
    /// they are literal integers — used by the array-bounds rule.
    pub array_bounds: Option<(i64, i64)>,
    /// The initializer expression, if any (`:= <expr>`).
    pub init: Option<Expr>,
    pub line: u32,
 }
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum VarSection {
    Var,
    Input,
    Output,
    InOut,
    Global,
    Temp,
    External,
 }
 /// A statement.
 #[derive(Debug, Clone)]
 pub enum Stmt {
    Assign {
        target: Expr,
        value: Expr,
        line: u32,
    },
    If {
        /// (condition, body) for IF and each ELSIF, in order.
        branches: Vec<(Expr, Vec<Stmt>)>,
        else_body: Option<Vec<Stmt>>,
        line: u32,
    },
    Case {
        selector: Expr,
        /// (label expressions, body) per CASE arm.
        arms: Vec<(Vec<Expr>, Vec<Stmt>)>,
        else_body: Option<Vec<Stmt>>,
        line: u32,
    },
    For {
        var: String,
        from: Expr,
        to: Expr,
        by: Option<Expr>,
        body: Vec<Stmt>,
        line: u32,
    },
    While {
        cond: Expr,
        body: Vec<Stmt>,
        line: u32,
    },
    Repeat {
        body: Vec<Stmt>,
        until: Expr,
        line: u32,
    },
    /// A bare call statement, e.g. `TON1(IN := x, PT := T#5s);`.
    Call {
        callee: String,
        args: Vec<CallArg>,
        line: u32,
    },
    Return {
        line: u32,
    },
    Exit {
        line: u32,
    },
    /// `JMP label;` — an unstructured jump.
    Jump {
        label: String,
        line: u32,
    },
    /// `label:` — a jump target.
    Label {
        name: String,
        line: u32,
    },
 }
 /// One argument in a call: positional (`name: None`) or named (`X := expr`).
 #[derive(Debug, Clone)]
 pub struct CallArg {
    pub name: Option<String>,
    pub value: Expr,
 }
 /// An expression.
 #[derive(Debug, Clone)]
 pub enum Expr {
    Int(i64, u32),
    Real(f64, u32),
    Bool(bool, u32),
    /// A string literal, with the unquoted contents.
    Str(String, u32),
    /// A duration / date / time literal, kept as raw text (`T#5s`, `DT#...`).
    Time(String, u32),
    Ident(String, u32),
    /// `base[index]`.
    Index {
        base: Box<Expr>,
        index: Box<Expr>,
        line: u32,
    },
    /// `base.field`.
    Member {
        base: Box<Expr>,
        field: String,
        line: u32,
    },
    Unary {
        op: UnOp,
        expr: Box<Expr>,
        line: u32,
    },
    Binary {
        op: BinOp,
        lhs: Box<Expr>,
        rhs: Box<Expr>,
        line: u32,
    },
    /// A function call used as an expression, e.g. `LIMIT(a, b, c)`.
    Call {
        callee: String,
        args: Vec<CallArg>,
        line: u32,
    },
 }
 impl Expr {
    /// The 1-based source line this expression starts on.
    pub fn line(&self) -> u32 {
        match self {
            Expr::Int(_, l)
            | Expr::Real(_, l)
            | Expr::Bool(_, l)
            | Expr::Str(_, l)
            | Expr::Time(_, l)
            | Expr::Ident(_, l)
            | Expr::Index { line: l, .. }
            | Expr::Member { line: l, .. }
            | Expr::Unary { line: l, .. }
            | Expr::Binary { line: l, .. }
            | Expr::Call { line: l, .. } => *l,
        }
    }
    /// If this expression is a plain identifier, its name.
    pub fn as_ident(&self) -> Option<&str> {
        match self {
            Expr::Ident(name, _) => Some(name.as_str()),
            _ => None,
        }
    }
 }
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum UnOp {
    Not,
    Neg,
 }
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum BinOp {
    Add,
    Sub,
    Mul,
    Div,
    Mod,
    Pow,
    Eq,
    Ne,
    Lt,
    Le,
    Gt,
    Ge,
    And,
    Or,
    Xor,
 }
@@ -1,372 +0,0 @@
 //! Lexer for IEC 61131-3 Structured Text.
 //!
 //! Tokenizes ST source into a flat token stream with 1-based line numbers.
 //! Keywords are case-insensitive. Handles `(* *)` and `//` comments, `'..'` and
 //! `".."` strings (with `''`/`""` escapes), based integers (`16#FF`, `2#1010`),
 //! and duration/date literals (`T#5s`, `DT#...`) kept as raw text.
 /// A lexed token with its source line.
 #[derive(Debug, Clone)]
 pub struct Token {
    pub kind: Tok,
    pub line: u32,
 }
 #[derive(Debug, Clone, PartialEq)]
 pub enum Tok {
    Int(i64),
    Real(f64),
    Str(String),
    Time(String),
    Bool(bool),
    Ident(String),
    Kw(Keyword),
    Assign, // :=
    Plus,   // +
    Minus,  // -
    Star,   // *
    Slash,  // /
    Power,  // **
    LParen, // (
    RParen, // )
    LBrack, // [
    RBrack, // ]
    Dot,    // .
    DotDot, // ..
    Comma,  // ,
    Semi,   // ;
    Colon,  // :
    Lt,     // <
    Le,     // <=
    Gt,     // >
    Ge,     // >=
    Eq,     // =
    Ne,     // <>
    Amp,    // &
    Eof,
 }
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Keyword {
    Program,
    EndProgram,
    Function,
    EndFunction,
    FunctionBlock,
    EndFunctionBlock,
    Var,
    VarInput,
    VarOutput,
    VarInOut,
    VarGlobal,
    VarTemp,
    VarExternal,
    Constant,
    EndVar,
    Array,
    Of,
    If,
    Then,
    Elsif,
    Else,
    EndIf,
    Case,
    EndCase,
    For,
    To,
    By,
    Do,
    EndFor,
    While,
    EndWhile,
    Repeat,
    Until,
    EndRepeat,
    Return,
    Exit,
    Jmp,
    Not,
    And,
    Or,
    Xor,
    Mod,
    Type,
    EndType,
    Struct,
    EndStruct,
 }
 fn keyword_from(word: &str) -> Option<Keyword> {
    use Keyword::*;
    Some(match word.to_ascii_uppercase().as_str() {
        "PROGRAM" => Program,
        "END_PROGRAM" => EndProgram,
        "FUNCTION" => Function,
        "END_FUNCTION" => EndFunction,
        "FUNCTION_BLOCK" => FunctionBlock,
        "END_FUNCTION_BLOCK" => EndFunctionBlock,
        "VAR" => Var,
        "VAR_INPUT" => VarInput,
        "VAR_OUTPUT" => VarOutput,
        "VAR_IN_OUT" => VarInOut,
        "VAR_GLOBAL" => VarGlobal,
        "VAR_TEMP" => VarTemp,
        "VAR_EXTERNAL" => VarExternal,
        "CONSTANT" => Constant,
        "END_VAR" => EndVar,
        "ARRAY" => Array,
        "OF" => Of,
        "IF" => If,
        "THEN" => Then,
        "ELSIF" => Elsif,
        "ELSE" => Else,
        "END_IF" => EndIf,
        "CASE" => Case,
        "END_CASE" => EndCase,
        "FOR" => For,
        "TO" => To,
        "BY" => By,
        "DO" => Do,
        "END_FOR" => EndFor,
        "WHILE" => While,
        "END_WHILE" => EndWhile,
        "REPEAT" => Repeat,
        "UNTIL" => Until,
        "END_REPEAT" => EndRepeat,
        "RETURN" => Return,
        "EXIT" => Exit,
        "JMP" => Jmp,
        "NOT" => Not,
        "AND" => And,
        "OR" => Or,
        "XOR" => Xor,
        "MOD" => Mod,
        "TYPE" => Type,
        "END_TYPE" => EndType,
        "STRUCT" => Struct,
        "END_STRUCT" => EndStruct,
        _ => return None,
    })
 }
 /// Tokenize `src`. Unknown characters are skipped (best-effort — a scanner must
 /// not die on odd input).
 pub fn lex(src: &str) -> Vec<Token> {
    let chars: Vec<char> = src.chars().collect();
    let mut i = 0usize;
    let mut line = 1u32;
    let mut out = Vec::new();
    let bump_line = |c: char, line: &mut u32| {
        if c == '\n' {
            *line += 1;
        }
    };
    while i < chars.len() {
        let c = chars[i];
        // Whitespace.
        if c.is_whitespace() {
            bump_line(c, &mut line);
            i += 1;
            continue;
        }
        // Line comment: //
        if c == '/' && i + 1 < chars.len() && chars[i + 1] == '/' {
            while i < chars.len() && chars[i] != '\n' {
                i += 1;
            }
            continue;
        }
        // Block comment: (* ... *)
        if c == '(' && i + 1 < chars.len() && chars[i + 1] == '*' {
            i += 2;
            while i + 1 < chars.len() && !(chars[i] == '*' && chars[i + 1] == ')') {
                bump_line(chars[i], &mut line);
                i += 1;
            }
            i = (i + 2).min(chars.len());
            continue;
        }
        let tok_line = line;
        // String literal: '...' or "..."
        if c == '\'' || c == '"' {
            let quote = c;
            i += 1;
            let mut s = String::new();
            while i < chars.len() {
                let ch = chars[i];
                if ch == quote {
                    // Doubled quote is an escaped quote.
                    if i + 1 < chars.len() && chars[i + 1] == quote {
                        s.push(quote);
                        i += 2;
                        continue;
                    }
                    i += 1;
                    break;
                }
                bump_line(ch, &mut line);
                s.push(ch);
                i += 1;
            }
            out.push(Token {
                kind: Tok::Str(s),
                line: tok_line,
            });
            continue;
        }
        // Identifier / keyword / time literal / boolean.
        if c.is_ascii_alphabetic() || c == '_' {
            let start = i;
            while i < chars.len() && (chars[i].is_ascii_alphanumeric() || chars[i] == '_') {
                i += 1;
            }
            let word: String = chars[start..i].iter().collect();
            // Duration/date/time literal prefix: T#, TIME#, DT#, D#, TOD#, LT# ...
            if i < chars.len() && chars[i] == '#' {
                let up = word.to_ascii_uppercase();
                if matches!(
                    up.as_str(),
                    "T" | "TIME" | "DT" | "D" | "TOD" | "LT" | "DATE"
                ) {
                    let lit_start = start;
                    i += 1; // consume '#'
                    while i < chars.len()
                        && (chars[i].is_ascii_alphanumeric()
                            || chars[i] == '.'
                            || chars[i] == '_'
                            || chars[i] == ':')
                    {
                        i += 1;
                    }
                    let lit: String = chars[lit_start..i].iter().collect();
                    out.push(Token {
                        kind: Tok::Time(lit),
                        line: tok_line,
                    });
                    continue;
                }
            }
            let kind = match word.to_ascii_uppercase().as_str() {
                "TRUE" => Tok::Bool(true),
                "FALSE" => Tok::Bool(false),
                _ => match keyword_from(&word) {
                    Some(kw) => Tok::Kw(kw),
                    None => Tok::Ident(word),
                },
            };
            out.push(Token {
                kind,
                line: tok_line,
            });
            continue;
        }
        // Number: decimal, real, or based (16#..., 2#...).
        if c.is_ascii_digit() {
            let start = i;
            while i < chars.len() && (chars[i].is_ascii_digit() || chars[i] == '_') {
                i += 1;
            }
            // Based literal: <base>#<digits>
            if i < chars.len() && chars[i] == '#' {
                let base_str: String = chars[start..i].iter().filter(|c| **c != '_').collect();
                i += 1;
                let dstart = i;
                while i < chars.len() && (chars[i].is_ascii_alphanumeric() || chars[i] == '_') {
                    i += 1;
                }
                let digits: String = chars[dstart..i].iter().filter(|c| **c != '_').collect();
                let radix = base_str.parse::<u32>().unwrap_or(10);
                let val = i64::from_str_radix(&digits, radix.clamp(2, 36)).unwrap_or(0);
                out.push(Token {
                    kind: Tok::Int(val),
                    line: tok_line,
                });
                continue;
            }
            // Real: has a '.' (not '..') or exponent.
            let is_real =
                i < chars.len() && chars[i] == '.' && !(i + 1 < chars.len() && chars[i + 1] == '.');
            if is_real {
                i += 1;
                while i < chars.len() && (chars[i].is_ascii_digit() || chars[i] == '_') {
                    i += 1;
                }
                let raw: String = chars[start..i].iter().filter(|c| **c != '_').collect();
                out.push(Token {
                    kind: Tok::Real(raw.parse().unwrap_or(0.0)),
                    line: tok_line,
                });
                continue;
            }
            let raw: String = chars[start..i].iter().filter(|c| **c != '_').collect();
            out.push(Token {
                kind: Tok::Int(raw.parse().unwrap_or(0)),
                line: tok_line,
            });
            continue;
        }
        // Operators / punctuation (longest match first).
        let two: String = chars[i..(i + 2).min(chars.len())].iter().collect();
        let kind = match two.as_str() {
            ":=" => Some(Tok::Assign),
            "<=" => Some(Tok::Le),
            ">=" => Some(Tok::Ge),
            "<>" => Some(Tok::Ne),
            ".." => Some(Tok::DotDot),
            "**" => Some(Tok::Power),
            _ => None,
        };
        if let Some(k) = kind {
            out.push(Token {
                kind: k,
                line: tok_line,
            });
            i += 2;
            continue;
        }
        let one = match c {
            '+' => Some(Tok::Plus),
            '-' => Some(Tok::Minus),
            '*' => Some(Tok::Star),
            '/' => Some(Tok::Slash),
            '(' => Some(Tok::LParen),
            ')' => Some(Tok::RParen),
            '[' => Some(Tok::LBrack),
            ']' => Some(Tok::RBrack),
            '.' => Some(Tok::Dot),
            ',' => Some(Tok::Comma),
            ';' => Some(Tok::Semi),
            ':' => Some(Tok::Colon),
            '<' => Some(Tok::Lt),
            '>' => Some(Tok::Gt),
            '=' => Some(Tok::Eq),
            '&' => Some(Tok::Amp),
            _ => None,
        };
        if let Some(k) = one {
            out.push(Token {
                kind: k,
                line: tok_line,
            });
        }
        i += 1;
    }
    out.push(Token {
        kind: Tok::Eof,
        line,
    });
    out
 }
@@ -1,234 +0,0 @@
 //! PLC control-logic security scanner for IEC 61131-3 targets.
 //!
 //! Parses Structured Text (raw `.st`/`.scl`/`.exp` files and PLCopen-XML
 //! projects) into an AST and runs semantic control-logic security rules over it.
 //! Implements [`ScanType::PlcControlLogic`].
 pub mod ast;
 pub mod lexer;
 pub mod parser;
 pub mod plcopen;
 pub mod rules;
 pub mod sbom;
 use std::path::Path;
 use compliance_core::error::CoreError;
 use compliance_core::models::{Finding, ScanType};
 use compliance_core::traits::{ScanOutput, Scanner};
 use crate::pipeline::dedup;
 /// Scanner for `ScanType::PlcControlLogic`.
 pub struct PlcControlLogicScanner;
 impl Scanner for PlcControlLogicScanner {
    fn name(&self) -> &str {
        "plc-control-logic"
    }
    fn scan_type(&self) -> ScanType {
        ScanType::PlcControlLogic
    }
    #[tracing::instrument(skip_all)]
    async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
        let findings = analyze_tree(repo_path, repo_id);
        Ok(ScanOutput {
            findings,
            sbom_entries: Vec::new(),
        })
    }
 }
 /// Walk a PLC project tree and produce findings.
 pub(crate) fn analyze_tree(root: &Path, repo_id: &str) -> Vec<Finding> {
    let mut findings = Vec::new();
    for entry in walkdir::WalkDir::new(root)
        .into_iter()
        .filter_map(|e| e.ok())
    {
        if !entry.file_type().is_file() {
            continue;
        }
        let path = entry.path();
        let ext = path
            .extension()
            .and_then(|e| e.to_str())
            .unwrap_or("")
            .to_ascii_lowercase();
        let is_st = matches!(ext.as_str(), "st" | "iecst" | "scl" | "exp" | "il");
        let is_xml = matches!(ext.as_str(), "xml" | "plcopen" | "project");
        if !is_st && !is_xml {
            continue;
        }
        let Ok(content) = std::fs::read_to_string(path) else {
            continue;
        };
        let pous = if is_xml {
            plcopen::parse_plcopen(&content)
        } else {
            parser::parse(&content)
        };
        if pous.is_empty() {
            continue;
        }
        let rel = path
            .strip_prefix(root)
            .unwrap_or(path)
            .to_string_lossy()
            .to_string();
        for pou in &pous {
            for hit in rules::analyze(pou) {
                let line_s = hit.line.to_string();
                let fingerprint =
                    dedup::compute_fingerprint(&[repo_id, &rel, hit.rule_id, &pou.name, &line_s]);
                let mut f = Finding::new(
                    repo_id.to_string(),
                    fingerprint,
                    "plc-control-logic".to_string(),
                    ScanType::PlcControlLogic,
                    hit.title,
                    hit.description,
                    hit.severity,
                );
                f.file_path = Some(rel.clone());
                f.line_number = Some(hit.line);
                f.rule_id = Some(hit.rule_id.to_string());
                f.cwe = hit.cwe.map(String::from);
                f.remediation = Some(hit.remediation.to_string());
                findings.push(f);
            }
        }
    }
    findings
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use std::collections::HashSet;
    use std::path::PathBuf;
    fn demo_dir() -> PathBuf {
        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
            .parent()
            .expect("workspace root")
            .join("examples/plc-demo")
    }
    #[test]
    fn scans_demo_project_end_to_end() {
        let findings = analyze_tree(&demo_dir(), "demo-target");
        assert!(!findings.is_empty(), "demo project should produce findings");
        let rules: HashSet<&str> = findings
            .iter()
            .filter_map(|f| f.rule_id.as_deref())
            .collect();
        for r in [
            "plc-hardcoded-credential",
            "plc-default-password",
            "plc-safety-bypass",
            "plc-array-unchecked-index",
            "plc-insecure-comm",
            "plc-insecure-protocol-port",
            "plc-unstructured-jump",
            "plc-division-by-zero",
        ] {
            assert!(rules.contains(r), "expected rule {r}; got {rules:?}");
        }
        // Every finding is well-formed for storage.
        for f in &findings {
            assert_eq!(f.repo_id, "demo-target");
            assert!(f.file_path.is_some(), "finding needs a file");
            assert!(f.line_number.is_some(), "finding needs a line");
        }
        // The guarded division (IF ScaleFactor <> 0.0) must not be double-counted:
        // exactly one division-by-zero (the unguarded MeasuredFlow divide).
        let div0 = findings
            .iter()
            .filter(|f| f.rule_id.as_deref() == Some("plc-division-by-zero"))
            .count();
        assert_eq!(div0, 1, "only the unguarded division should be flagged");
    }
    /// The realistic OpenPLC-style traffic-light sample is mostly sound control
    /// logic: the scanner must surface its few genuine defects and stay quiet on
    /// the timed state machine and the guarded duty-cycle division.
    #[test]
    fn realistic_sample_flags_only_real_issues() {
        let all = analyze_tree(&demo_dir(), "demo-target");
        let tl: Vec<_> = all
            .iter()
            .filter(|f| {
                f.file_path
                    .as_deref()
                    .is_some_and(|p| p.ends_with("traffic_light.st"))
            })
            .collect();
        assert!(!tl.is_empty(), "traffic_light.st should produce findings");
        let rules: HashSet<&str> = tl.iter().filter_map(|f| f.rule_id.as_deref()).collect();
        // The three planted defects: hardcoded SCADA password, cleartext Modbus
        // master (no auth), and a maintenance mode that drops the PedPermit.
        for r in [
            "plc-hardcoded-credential",
            "plc-insecure-comm",
            "plc-safety-bypass",
        ] {
            assert!(rules.contains(r), "expected rule {r}; got {rules:?}");
        }
        // Modbus/TCP on 502 is also an insecure-protocol port.
        assert!(rules.contains("plc-insecure-protocol-port"));
        // Low false positives: the guarded `IF LampCount <> 0` division and the
        // JMP-free state machine must not trip anything.
        assert_eq!(
            tl.iter()
                .filter(|f| f.rule_id.as_deref() == Some("plc-division-by-zero"))
                .count(),
            0,
            "the guarded duty-cycle division must not be flagged"
        );
        assert!(
            !rules.contains("plc-unstructured-jump"),
            "the CASE state machine uses no JMP"
        );
    }
    /// Graphical logic must be analysed too: an FBD POU (blocks + in/out
    /// variables) is translated to synthetic ST, so the same rules fire on the
    /// cleartext Modbus block, the hardcoded HMI password and the safety write.
    #[test]
    fn fbd_graphical_body_is_analysed() {
        let all = analyze_tree(&demo_dir(), "demo-target");
        let fbd: Vec<_> = all
            .iter()
            .filter(|f| {
                f.file_path
                    .as_deref()
                    .is_some_and(|p| p.ends_with("pump_fbd.xml"))
            })
            .collect();
        assert!(
            !fbd.is_empty(),
            "pump_fbd.xml (FBD) should produce findings"
        );
        let rules: HashSet<&str> = fbd.iter().filter_map(|f| f.rule_id.as_deref()).collect();
        for r in [
            "plc-insecure-comm",          // Modbus_TCP_Master(AUTH := FALSE)
            "plc-insecure-protocol-port", // PORT := 502
            "plc-hardcoded-credential",   // HmiPassword := 'admin123'
            "plc-safety-bypass",          // Safety_Enable := FALSE
        ] {
            assert!(
                rules.contains(r),
                "expected rule {r} from FBD; got {rules:?}"
            );
        }
    }
 }
@@ -1,766 +0,0 @@
 //! Recursive-descent parser for the security-relevant subset of Structured Text.
 //!
 //! Tolerant by design: it parses the POUs, variable sections, and statement
 //! bodies it understands, and skips (with statement/POU-level recovery) anything
 //! it does not, so a single odd construct never sinks the whole file.
 use super::ast::*;
 use super::lexer::{Keyword as K, Tok, Token};
 pub struct Parser {
    toks: Vec<Token>,
    pos: usize,
 }
 impl Parser {
    pub fn new(toks: Vec<Token>) -> Self {
        Self { toks, pos: 0 }
    }
    // ── token helpers ──────────────────────────────────────────────
    fn peek(&self) -> &Tok {
        &self.toks[self.pos.min(self.toks.len() - 1)].kind
    }
    fn line(&self) -> u32 {
        self.toks[self.pos.min(self.toks.len() - 1)].line
    }
    fn at_end(&self) -> bool {
        matches!(self.peek(), Tok::Eof)
    }
    fn advance(&mut self) -> Tok {
        let t = self.toks[self.pos.min(self.toks.len() - 1)].kind.clone();
        if self.pos < self.toks.len() - 1 {
            self.pos += 1;
        }
        t
    }
    fn eat(&mut self, t: &Tok) -> bool {
        if self.peek() == t {
            self.advance();
            true
        } else {
            false
        }
    }
    fn eat_kw(&mut self, k: K) -> bool {
        if matches!(self.peek(), Tok::Kw(x) if *x == k) {
            self.advance();
            true
        } else {
            false
        }
    }
    fn at_kw(&self, k: K) -> bool {
        matches!(self.peek(), Tok::Kw(x) if *x == k)
    }
    fn ident(&mut self) -> Option<String> {
        if let Tok::Ident(s) = self.peek() {
            let s = s.clone();
            self.advance();
            Some(s)
        } else {
            None
        }
    }
    // ── top level ──────────────────────────────────────────────────
    /// Parse every POU in the token stream.
    pub fn parse_units(&mut self) -> Vec<Pou> {
        let mut pous = Vec::new();
        while !self.at_end() {
            match self.peek() {
                Tok::Kw(K::Program) => {
                    self.advance();
                    if let Some(p) = self.parse_pou(PouKind::Program, K::EndProgram) {
                        pous.push(p);
                    }
                }
                Tok::Kw(K::Function) => {
                    self.advance();
                    if let Some(p) = self.parse_pou(PouKind::Function, K::EndFunction) {
                        pous.push(p);
                    }
                }
                Tok::Kw(K::FunctionBlock) => {
                    self.advance();
                    if let Some(p) = self.parse_pou(PouKind::FunctionBlock, K::EndFunctionBlock) {
                        pous.push(p);
                    }
                }
                // Skip TYPE...END_TYPE and anything else at top level.
                _ => {
                    self.advance();
                }
            }
        }
        pous
    }
    fn parse_pou(&mut self, kind: PouKind, end: K) -> Option<Pou> {
        let line = self.line();
        let name = self.ident().unwrap_or_else(|| "<anonymous>".to_string());
        // Optional `: return_type` for functions.
        if self.eat(&Tok::Colon) {
            let _ = self.advance(); // return type token
        }
        let mut vars = Vec::new();
        // Variable sections precede the body.
        while let Some(section) = self.var_section_kw() {
            self.advance();
            let _ = self.eat_kw(K::Constant); // CONSTANT is informational for our rules
            self.parse_var_decls(section, &mut vars);
        }
        // Body statements until END_<kind>.
        let mut body = Vec::new();
        while !self.at_end() && !self.at_kw(end) {
            if let Some(s) = self.parse_stmt() {
                body.push(s);
            }
        }
        self.eat_kw(end);
        Some(Pou {
            name,
            kind,
            vars,
            body,
            line,
        })
    }
    fn var_section_kw(&self) -> Option<VarSection> {
        match self.peek() {
            Tok::Kw(K::Var) => Some(VarSection::Var),
            Tok::Kw(K::VarInput) => Some(VarSection::Input),
            Tok::Kw(K::VarOutput) => Some(VarSection::Output),
            Tok::Kw(K::VarInOut) => Some(VarSection::InOut),
            Tok::Kw(K::VarGlobal) => Some(VarSection::Global),
            Tok::Kw(K::VarTemp) => Some(VarSection::Temp),
            Tok::Kw(K::VarExternal) => Some(VarSection::External),
            _ => None,
        }
    }
    fn parse_var_decls(&mut self, section: VarSection, out: &mut Vec<VarDecl>) {
        while !self.at_end() && !self.at_kw(K::EndVar) {
            let line = self.line();
            // names: a, b, c
            let mut names = Vec::new();
            match self.ident() {
                Some(n) => names.push(n),
                None => {
                    // Not a declaration we understand — skip to next ; or END_VAR.
                    self.sync_decl();
                    continue;
                }
            }
            while self.eat(&Tok::Comma) {
                if let Some(n) = self.ident() {
                    names.push(n);
                }
            }
            if !self.eat(&Tok::Colon) {
                self.sync_decl();
                continue;
            }
            let (type_name, array_bounds) = self.parse_type();
            let init = if self.eat(&Tok::Assign) {
                Some(self.parse_expr())
            } else {
                None
            };
            self.eat(&Tok::Semi);
            for n in names {
                out.push(VarDecl {
                    name: n,
                    section,
                    type_name: type_name.clone(),
                    array_bounds,
                    init: init.clone(),
                    line,
                });
            }
        }
        self.eat_kw(K::EndVar);
    }
    /// Parse a (possibly ARRAY) type, returning its rendered name and literal
    /// bounds when present.
    fn parse_type(&mut self) -> (String, Option<(i64, i64)>) {
        if self.eat_kw(K::Array) {
            let mut bounds = None;
            if self.eat(&Tok::LBrack) {
                let lo = self.int_lit();
                self.eat(&Tok::DotDot);
                let hi = self.int_lit();
                if let (Some(lo), Some(hi)) = (lo, hi) {
                    bounds = Some((lo, hi));
                }
                // Skip any further dimensions / tokens to the closing bracket.
                while !self.at_end() && !self.eat(&Tok::RBrack) {
                    self.advance();
                }
            }
            self.eat_kw(K::Of);
            let elem = self.type_ident();
            (format!("ARRAY OF {elem}"), bounds)
        } else {
            (self.type_ident(), None)
        }
    }
    fn type_ident(&mut self) -> String {
        // Types can be qualified idents; keep it simple: one token, plus any
        // string-length suffix like STRING[80].
        let base = match self.advance() {
            Tok::Ident(s) => s,
            Tok::Kw(_) => "TYPE".to_string(),
            other => format!("{other:?}"),
        };
        if self.eat(&Tok::LBrack) {
            while !self.at_end() && !self.eat(&Tok::RBrack) {
                self.advance();
            }
        }
        base
    }
    fn int_lit(&mut self) -> Option<i64> {
        match self.peek() {
            Tok::Int(n) => {
                let n = *n;
                self.advance();
                Some(n)
            }
            Tok::Minus => {
                self.advance();
                if let Tok::Int(n) = self.peek() {
                    let n = -*n;
                    self.advance();
                    Some(n)
                } else {
                    None
                }
            }
            _ => None,
        }
    }
    fn sync_decl(&mut self) {
        while !self.at_end() && !self.eat(&Tok::Semi) && !self.at_kw(K::EndVar) {
            self.advance();
        }
    }
    fn sync_stmt(&mut self) {
        while !self.at_end() && !self.eat(&Tok::Semi) {
            // Stop at block terminators so recovery doesn't swallow structure.
            if matches!(
                self.peek(),
                Tok::Kw(
                    K::EndIf
                        | K::EndFor
                        | K::EndWhile
                        | K::EndCase
                        | K::EndRepeat
                        | K::EndProgram
                        | K::EndFunction
                        | K::EndFunctionBlock
                        | K::Else
                        | K::Elsif
                )
            ) {
                return;
            }
            self.advance();
        }
    }
    // ── statements ─────────────────────────────────────────────────
    fn parse_stmt(&mut self) -> Option<Stmt> {
        let line = self.line();
        match self.peek().clone() {
            Tok::Semi => {
                self.advance();
                None
            }
            Tok::Kw(K::If) => self.parse_if(),
            Tok::Kw(K::Case) => self.parse_case(),
            Tok::Kw(K::For) => self.parse_for(),
            Tok::Kw(K::While) => self.parse_while(),
            Tok::Kw(K::Repeat) => self.parse_repeat(),
            Tok::Kw(K::Return) => {
                self.advance();
                self.eat(&Tok::Semi);
                Some(Stmt::Return { line })
            }
            Tok::Kw(K::Exit) => {
                self.advance();
                self.eat(&Tok::Semi);
                Some(Stmt::Exit { line })
            }
            Tok::Kw(K::Jmp) => {
                self.advance();
                let label = self.ident().unwrap_or_default();
                self.eat(&Tok::Semi);
                Some(Stmt::Jump { label, line })
            }
            Tok::Ident(name) => {
                // Could be `label:`, `call(...)`, or an assignment.
                // Lookahead: ident ':' (not ':=') → label.
                if matches!(
                    self.toks.get(self.pos + 1).map(|t| &t.kind),
                    Some(Tok::Colon)
                ) && !matches!(self.toks.get(self.pos + 2).map(|t| &t.kind), Some(Tok::Eq))
                {
                    self.advance(); // ident
                    self.advance(); // ':'
                    return Some(Stmt::Label { name, line });
                }
                let lhs = self.parse_expr();
                if self.eat(&Tok::Assign) {
                    let value = self.parse_expr();
                    self.eat(&Tok::Semi);
                    Some(Stmt::Assign {
                        target: lhs,
                        value,
                        line,
                    })
                } else if let Expr::Call { callee, args, .. } = lhs {
                    self.eat(&Tok::Semi);
                    Some(Stmt::Call { callee, args, line })
                } else {
                    // Bare expression / FB invocation without args recognized —
                    // skip to the terminator.
                    self.sync_stmt();
                    None
                }
            }
            _ => {
                self.sync_stmt();
                None
            }
        }
    }
    fn parse_block_until(&mut self, terms: &[K]) -> Vec<Stmt> {
        let mut body = Vec::new();
        while !self.at_end() && !terms.iter().any(|k| self.at_kw(*k)) {
            if let Some(s) = self.parse_stmt() {
                body.push(s);
            }
        }
        body
    }
    fn parse_if(&mut self) -> Option<Stmt> {
        let line = self.line();
        self.eat_kw(K::If);
        let mut branches = Vec::new();
        let cond = self.parse_expr();
        self.eat_kw(K::Then);
        let body = self.parse_block_until(&[K::Elsif, K::Else, K::EndIf]);
        branches.push((cond, body));
        while self.eat_kw(K::Elsif) {
            let c = self.parse_expr();
            self.eat_kw(K::Then);
            let b = self.parse_block_until(&[K::Elsif, K::Else, K::EndIf]);
            branches.push((c, b));
        }
        let else_body = if self.eat_kw(K::Else) {
            Some(self.parse_block_until(&[K::EndIf]))
        } else {
            None
        };
        self.eat_kw(K::EndIf);
        self.eat(&Tok::Semi);
        Some(Stmt::If {
            branches,
            else_body,
            line,
        })
    }
    fn parse_case(&mut self) -> Option<Stmt> {
        let line = self.line();
        self.eat_kw(K::Case);
        let selector = self.parse_expr();
        self.eat_kw(K::Of);
        let mut arms = Vec::new();
        let mut else_body = None;
        while !self.at_end() && !self.at_kw(K::EndCase) {
            if self.eat_kw(K::Else) {
                else_body = Some(self.parse_block_until(&[K::EndCase]));
                break;
            }
            // labels: expr {, expr} :
            let mut labels = vec![self.parse_expr()];
            while self.eat(&Tok::Comma) {
                labels.push(self.parse_expr());
            }
            self.eat(&Tok::Colon);
            let body = self.parse_block_until(&[K::EndCase, K::Else]);
            arms.push((labels, body));
        }
        self.eat_kw(K::EndCase);
        self.eat(&Tok::Semi);
        Some(Stmt::Case {
            selector,
            arms,
            else_body,
            line,
        })
    }
    fn parse_for(&mut self) -> Option<Stmt> {
        let line = self.line();
        self.eat_kw(K::For);
        let var = self.ident().unwrap_or_default();
        self.eat(&Tok::Assign);
        let from = self.parse_expr();
        self.eat_kw(K::To);
        let to = self.parse_expr();
        let by = if self.eat_kw(K::By) {
            Some(self.parse_expr())
        } else {
            None
        };
        self.eat_kw(K::Do);
        let body = self.parse_block_until(&[K::EndFor]);
        self.eat_kw(K::EndFor);
        self.eat(&Tok::Semi);
        Some(Stmt::For {
            var,
            from,
            to,
            by,
            body,
            line,
        })
    }
    fn parse_while(&mut self) -> Option<Stmt> {
        let line = self.line();
        self.eat_kw(K::While);
        let cond = self.parse_expr();
        self.eat_kw(K::Do);
        let body = self.parse_block_until(&[K::EndWhile]);
        self.eat_kw(K::EndWhile);
        self.eat(&Tok::Semi);
        Some(Stmt::While { cond, body, line })
    }
    fn parse_repeat(&mut self) -> Option<Stmt> {
        let line = self.line();
        self.eat_kw(K::Repeat);
        let body = self.parse_block_until(&[K::Until, K::EndRepeat]);
        self.eat_kw(K::Until);
        let until = self.parse_expr();
        self.eat_kw(K::EndRepeat);
        self.eat(&Tok::Semi);
        Some(Stmt::Repeat { body, until, line })
    }
    // ── expressions (precedence climbing) ──────────────────────────
    pub fn parse_expr(&mut self) -> Expr {
        self.parse_or()
    }
    fn parse_or(&mut self) -> Expr {
        let mut lhs = self.parse_and();
        loop {
            let op = match self.peek() {
                Tok::Kw(K::Or) => BinOp::Or,
                Tok::Kw(K::Xor) => BinOp::Xor,
                _ => break,
            };
            let line = self.line();
            self.advance();
            let rhs = self.parse_and();
            lhs = Expr::Binary {
                op,
                lhs: Box::new(lhs),
                rhs: Box::new(rhs),
                line,
            };
        }
        lhs
    }
    fn parse_and(&mut self) -> Expr {
        let mut lhs = self.parse_cmp();
        while matches!(self.peek(), Tok::Kw(K::And) | Tok::Amp) {
            let op = BinOp::And;
            let line = self.line();
            self.advance();
            let rhs = self.parse_cmp();
            lhs = Expr::Binary {
                op,
                lhs: Box::new(lhs),
                rhs: Box::new(rhs),
                line,
            };
        }
        lhs
    }
    fn parse_cmp(&mut self) -> Expr {
        let mut lhs = self.parse_add();
        loop {
            let op = match self.peek() {
                Tok::Eq => BinOp::Eq,
                Tok::Ne => BinOp::Ne,
                Tok::Lt => BinOp::Lt,
                Tok::Le => BinOp::Le,
                Tok::Gt => BinOp::Gt,
                Tok::Ge => BinOp::Ge,
                _ => break,
            };
            let line = self.line();
            self.advance();
            let rhs = self.parse_add();
            lhs = Expr::Binary {
                op,
                lhs: Box::new(lhs),
                rhs: Box::new(rhs),
                line,
            };
        }
        lhs
    }
    fn parse_add(&mut self) -> Expr {
        let mut lhs = self.parse_mul();
        loop {
            let op = match self.peek() {
                Tok::Plus => BinOp::Add,
                Tok::Minus => BinOp::Sub,
                _ => break,
            };
            let line = self.line();
            self.advance();
            let rhs = self.parse_mul();
            lhs = Expr::Binary {
                op,
                lhs: Box::new(lhs),
                rhs: Box::new(rhs),
                line,
            };
        }
        lhs
    }
    fn parse_mul(&mut self) -> Expr {
        let mut lhs = self.parse_unary();
        loop {
            let op = match self.peek() {
                Tok::Star => BinOp::Mul,
                Tok::Slash => BinOp::Div,
                Tok::Kw(K::Mod) => BinOp::Mod,
                Tok::Power => BinOp::Pow,
                _ => break,
            };
            let line = self.line();
            self.advance();
            let rhs = self.parse_unary();
            lhs = Expr::Binary {
                op,
                lhs: Box::new(lhs),
                rhs: Box::new(rhs),
                line,
            };
        }
        lhs
    }
    fn parse_unary(&mut self) -> Expr {
        let line = self.line();
        match self.peek() {
            Tok::Kw(K::Not) => {
                self.advance();
                Expr::Unary {
                    op: UnOp::Not,
                    expr: Box::new(self.parse_unary()),
                    line,
                }
            }
            Tok::Minus => {
                self.advance();
                Expr::Unary {
                    op: UnOp::Neg,
                    expr: Box::new(self.parse_unary()),
                    line,
                }
            }
            _ => self.parse_postfix(),
        }
    }
    fn parse_postfix(&mut self) -> Expr {
        let mut e = self.parse_primary();
        loop {
            let line = self.line();
            match self.peek() {
                Tok::LBrack => {
                    self.advance();
                    let index = self.parse_expr();
                    self.eat(&Tok::RBrack);
                    e = Expr::Index {
                        base: Box::new(e),
                        index: Box::new(index),
                        line,
                    };
                }
                Tok::Dot => {
                    self.advance();
                    let field = self.ident().unwrap_or_default();
                    e = Expr::Member {
                        base: Box::new(e),
                        field,
                        line,
                    };
                }
                _ => break,
            }
        }
        e
    }
    fn parse_primary(&mut self) -> Expr {
        let line = self.line();
        match self.advance() {
            Tok::Int(n) => Expr::Int(n, line),
            Tok::Real(r) => Expr::Real(r, line),
            Tok::Bool(b) => Expr::Bool(b, line),
            Tok::Str(s) => Expr::Str(s, line),
            Tok::Time(t) => Expr::Time(t, line),
            Tok::LParen => {
                let e = self.parse_expr();
                self.eat(&Tok::RParen);
                e
            }
            Tok::Ident(name) => {
                if self.eat(&Tok::LParen) {
                    let args = self.parse_call_args();
                    Expr::Call {
                        callee: name,
                        args,
                        line,
                    }
                } else {
                    Expr::Ident(name, line)
                }
            }
            // Unrecognized start of expression — yield a placeholder identifier.
            _ => Expr::Ident(String::new(), line),
        }
    }
    fn parse_call_args(&mut self) -> Vec<CallArg> {
        let mut args = Vec::new();
        if self.eat(&Tok::RParen) {
            return args;
        }
        loop {
            // Named arg: ident := expr  (peek two tokens).
            if let Tok::Ident(name) = self.peek().clone() {
                if matches!(
                    self.toks.get(self.pos + 1).map(|t| &t.kind),
                    Some(Tok::Assign)
                ) {
                    self.advance(); // ident
                    self.advance(); // :=
                    let value = self.parse_expr();
                    args.push(CallArg {
                        name: Some(name),
                        value,
                    });
                    if self.eat(&Tok::Comma) {
                        continue;
                    }
                    break;
                }
            }
            let value = self.parse_expr();
            args.push(CallArg { name: None, value });
            if self.eat(&Tok::Comma) {
                continue;
            }
            break;
        }
        self.eat(&Tok::RParen);
        args
    }
 }
 /// Parse ST source into its POUs.
 pub fn parse(src: &str) -> Vec<Pou> {
    let toks = super::lexer::lex(src);
    Parser::new(toks).parse_units()
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    const SAMPLE: &str = r#"
 PROGRAM Main
 VAR
    idx : INT;
    pw : STRING := 'admin123';
    buf : ARRAY[0..9] OF INT;
    ok : BOOL := FALSE;
 END_VAR
    // a comment
    IF idx > 0 THEN
        buf[idx] := idx * 2;
    ELSE
        JMP done;
    END_IF;
    Comm(IP := '10.0.0.1', PORT := 502);
 done:
    ok := TRUE;
 END_PROGRAM
 "#;
    #[test]
    fn parses_program_vars_and_body() {
        let pous = parse(SAMPLE);
        assert_eq!(pous.len(), 1, "one POU");
        let p = &pous[0];
        assert_eq!(p.name, "Main");
        assert_eq!(p.kind, PouKind::Program);
        // vars: idx, pw, buf, ok
        assert_eq!(p.vars.len(), 4);
        let pw = p.vars.iter().find(|v| v.name == "pw").expect("pw");
        assert!(matches!(&pw.init, Some(Expr::Str(s, _)) if s == "admin123"));
        let buf = p.vars.iter().find(|v| v.name == "buf").expect("buf");
        assert_eq!(buf.array_bounds, Some((0, 9)));
        // body has an IF, a Call, a Label, and an Assign
        assert!(p.body.iter().any(|s| matches!(s, Stmt::If { .. })));
        assert!(p
            .body
            .iter()
            .any(|s| matches!(s, Stmt::Call { callee, .. } if callee == "Comm")));
        assert!(p
            .body
            .iter()
            .any(|s| matches!(s, Stmt::Label { name, .. } if name == "done")));
    }
    #[test]
    fn jmp_inside_if_is_captured() {
        let pous = parse(SAMPLE);
        let p = &pous[0];
        // find the IF, check its else branch has a JMP
        let has_jmp = p.body.iter().any(|s| match s {
            Stmt::If { else_body, .. } => else_body
                .as_ref()
                .map(|b| b.iter().any(|s| matches!(s, Stmt::Jump { .. })))
                .unwrap_or(false),
            _ => false,
        });
        assert!(has_jmp, "JMP should be parsed inside the ELSE branch");
    }
 }
@@ -1,418 +0,0 @@
 //! PLCopen XML → Structured Text POUs.
 //!
 //! A PLCopen project stores each POU as `<pou name=".." pouType="..">` with an
 //! `<interface>` (typed variable sections) and a `<body>` in one of the IEC
 //! 61131-3 languages. We reconstruct an equivalent Structured-Text source for
 //! each POU (a `VAR` block from the interface + statements from the body) and run
 //! it through the ST parser, so raw `.st` files and PLCopen projects — textual or
 //! graphical — flow through one analysis path.
 //!
 //! Body languages:
 //! - **ST** — taken verbatim.
 //! - **FBD / LD** — the graphical network is translated to synthetic ST: blocks
 //!   become calls (`TypeName(pin := arg, …)`), out-variables / coils become
 //!   assignments, with input pins resolved by tracing connections. This lets the
 //!   semantic rules see comm calls, hardcoded arguments and safety writes that
 //!   live in graphical logic, not just in text.
 //! - **SFC** — the step/transition graph itself is skipped; the ST/FBD/LD bodies
 //!   embedded in its actions and transitions are still translated.
 use std::collections::HashMap;
 use roxmltree::Node;
 use super::ast::Pou;
 use super::parser;
 /// Parse every POU out of a PLCopen XML document (ST, FBD or LD bodies).
 pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
    let doc = match roxmltree::Document::parse(xml) {
        Ok(d) => d,
        Err(_) => return Vec::new(),
    };
    let mut pous = Vec::new();
    for pou in doc.descendants().filter(|n| n.has_tag_name("pou")) {
        let name = pou.attribute("name").unwrap_or("pou").to_string();
        let pou_type = pou.attribute("pouType").unwrap_or("program");
        let Some(body) = reconstruct_body(pou) else {
            continue;
        };
        if body.trim().is_empty() {
            continue;
        }
        let var_block = build_var_block(pou);
        let kw = match pou_type.to_ascii_lowercase().as_str() {
            "function" => "FUNCTION",
            "functionblock" | "functionblocktype" => "FUNCTION_BLOCK",
            _ => "PROGRAM",
        };
        let synthetic = format!("{kw} {name}\n{var_block}{body}\nEND_{kw}\n");
        pous.extend(parser::parse(&synthetic));
    }
    pous
 }
 /// Case-insensitive tag match (PLCopen uses `FBD`/`LD`/`ST`, CODESYS may vary).
 fn tag_is(n: &Node, name: &str) -> bool {
    n.tag_name().name().eq_ignore_ascii_case(name)
 }
 /// Reconstruct a POU's body as Structured Text, whatever language it is written
 /// in. Concatenates every language body found under `<body>` (SFC actions and
 /// transitions carry their own ST/FBD/LD sub-bodies).
 fn reconstruct_body(pou: Node) -> Option<String> {
    let mut out = String::new();
    for body in pou.descendants().filter(|n| tag_is(n, "body")) {
        for lang in body.children().filter(|n| n.is_element()) {
            let piece = match lang.tag_name().name().to_ascii_uppercase().as_str() {
                "ST" | "IL" => collect_text(lang),
                "FBD" | "LD" => translate_network(lang),
                _ => continue,
            };
            if !piece.trim().is_empty() {
                out.push_str(&piece);
                if !piece.ends_with('\n') {
                    out.push('\n');
                }
            }
        }
    }
    if out.trim().is_empty() {
        None
    } else {
        Some(out)
    }
 }
 // ── graphical (FBD / LD) → synthetic ST ────────────────────────────────
 /// Translate one FBD/LD network into ST statements: blocks → calls,
 /// out-variables and coils → assignments.
 fn translate_network(net: Node) -> String {
    let by_id = index_local_ids(net);
    let mut out = String::new();
    for el in net.children().filter(|n| n.is_element()) {
        let stmt = match el.tag_name().name().to_ascii_lowercase().as_str() {
            "block" => block_call(el, &by_id).map(|c| format!("{c};")),
            "outvariable" => out_assignment(el, &by_id),
            "coil" => coil_assignment(el, &by_id),
            _ => None,
        };
        if let Some(s) = stmt {
            out.push_str(&s);
            out.push('\n');
        }
    }
    out
 }
 /// Index every element in a network by its `localId` so connections resolve.
 fn index_local_ids<'a, 'input>(net: Node<'a, 'input>) -> HashMap<String, Node<'a, 'input>> {
    net.descendants()
        .filter(|n| n.is_element())
        .filter_map(|n| n.attribute("localId").map(|id| (id.to_string(), n)))
        .collect()
 }
 /// Build a call expression for a block: `TypeName(pin := arg, …)`.
 fn block_call(block: Node, by_id: &HashMap<String, Node>) -> Option<String> {
    let ty = block.attribute("typeName")?;
    let mut args = Vec::new();
    if let Some(inputs) = block.children().find(|n| tag_is(n, "inputVariables")) {
        for v in inputs.children().filter(|n| tag_is(n, "variable")) {
            let Some(expr) = input_expr(v, by_id, 0) else {
                continue;
            };
            match v.attribute("formalParameter") {
                Some(pin) if !pin.is_empty() => args.push(format!("{pin} := {expr}")),
                _ => args.push(expr),
            }
        }
    }
    Some(format!("{ty}({})", args.join(", ")))
 }
 /// `target := <traced expression>;` for an FBD out-variable.
 fn out_assignment(outvar: Node, by_id: &HashMap<String, Node>) -> Option<String> {
    let target = expression_text(outvar)?;
    let value = input_expr(outvar, by_id, 0).unwrap_or_else(|| "0".to_string());
    Some(format!("{target} := {value};"))
 }
 /// `coil := <traced rung expression>;` for an LD coil (negated → `NOT (…)`).
 fn coil_assignment(coil: Node, by_id: &HashMap<String, Node>) -> Option<String> {
    let target = child_text(coil, "variable")?;
    let rung = input_expr(coil, by_id, 0).unwrap_or_else(|| "TRUE".to_string());
    let negated = matches!(coil.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
    let rhs = if negated {
        format!("NOT ({rung})")
    } else {
        rung
    };
    Some(format!("{target} := {rhs};"))
 }
 /// Resolve the expression feeding `node`'s single input connection.
 fn input_expr(node: Node, by_id: &HashMap<String, Node>, depth: u8) -> Option<String> {
    let refid = ref_local_id(node)?;
    Some(expr_for(&refid, by_id, depth))
 }
 /// Build the ST expression produced by the element with this `localId`.
 fn expr_for(local_id: &str, by_id: &HashMap<String, Node>, depth: u8) -> String {
    if depth > 24 {
        return "0".to_string();
    }
    let Some(node) = by_id.get(local_id) else {
        return format!("__net{local_id}");
    };
    match node.tag_name().name().to_ascii_lowercase().as_str() {
        "invariable" | "inoutvariable" => {
            expression_text(*node).unwrap_or_else(|| format!("__net{local_id}"))
        }
        // A block feeding another element: reference it by a synthetic result
        // name; the block is emitted as its own call statement, so we neither
        // duplicate the call nor lose it.
        "block" => format!("__blk{local_id}"),
        "contact" => {
            let var = child_text(*node, "variable").unwrap_or_else(|| "TRUE".to_string());
            let negated =
                matches!(node.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
            let term = if negated { format!("NOT {var}") } else { var };
            match ref_local_id(*node) {
                Some(up) => {
                    let upstream = expr_for(&up, by_id, depth + 1);
                    if upstream == "TRUE" {
                        term
                    } else {
                        format!("({upstream} AND {term})")
                    }
                }
                None => term,
            }
        }
        "leftpowerrail" => "TRUE".to_string(),
        _ => format!("__net{local_id}"),
    }
 }
 /// The `refLocalId` of `node`'s first input connection, if any.
 fn ref_local_id(node: Node) -> Option<String> {
    node.descendants()
        .find(|n| tag_is(n, "connectionPointIn"))
        .and_then(|cpi| cpi.descendants().find(|n| tag_is(n, "connection")))
        .and_then(|c| c.attribute("refLocalId"))
        .map(|s| s.to_string())
 }
 /// Text of a node's `<expression>` child (variable name or literal).
 fn expression_text(node: Node) -> Option<String> {
    let e = node.children().find(|n| tag_is(n, "expression"))?;
    let t = collect_text(e).trim().to_string();
    if t.is_empty() {
        None
    } else {
        Some(t)
    }
 }
 /// Text of a named child element (e.g. `<variable>` of a contact/coil).
 fn child_text(node: Node, name: &str) -> Option<String> {
    let c = node.children().find(|n| tag_is(n, name))?;
    let t = collect_text(c).trim().to_string();
    if t.is_empty() {
        None
    } else {
        Some(t)
    }
 }
 /// Concatenate the text of a node's descendant text nodes (bodies are often
 /// wrapped in `<xhtml>` and may contain multiple text runs). Only text nodes are
 /// gathered: an element's `.text()` would re-yield its first child's text, which
 /// (with the text node itself) would duplicate every value.
 fn collect_text(node: Node) -> String {
    node.descendants()
        .filter(|n| n.is_text())
        .filter_map(|n| n.text())
        .collect::<String>()
 }
 /// Build an ST `VAR … END_VAR` block from a POU's `<interface>` variable
 /// sections, so declarations (types, initial values) reach the rules.
 fn build_var_block(pou: Node) -> String {
    let Some(interface) = pou.children().find(|n| n.has_tag_name("interface")) else {
        return String::new();
    };
    let mut out = String::from("VAR\n");
    let mut any = false;
    for container in interface.children().filter(|n| n.is_element()) {
        // localVars / inputVars / outputVars / inOutVars / tempVars / globalVars / externalVars
        if !container.tag_name().name().ends_with("Vars") {
            continue;
        }
        for var in container.children().filter(|n| n.has_tag_name("variable")) {
            let Some(vname) = var.attribute("name") else {
                continue;
            };
            let ty = var
                .children()
                .find(|n| n.has_tag_name("type"))
                .map(type_name)
                .unwrap_or_else(|| "BOOL".to_string());
            let init = var
                .children()
                .find(|n| n.has_tag_name("initialValue"))
                .and_then(initial_value);
            match init {
                Some(v) => out.push_str(&format!("  {vname} : {ty} := {v};\n")),
                None => out.push_str(&format!("  {vname} : {ty};\n")),
            }
            any = true;
        }
    }
    out.push_str("END_VAR\n");
    if any {
        out
    } else {
        String::new()
    }
 }
 /// Render a PLCopen `<type>` element as an ST type string.
 fn type_name(type_node: Node) -> String {
    let Some(inner) = type_node.children().find(|n| n.is_element()) else {
        return "BOOL".to_string();
    };
    let tag = inner.tag_name().name();
    match tag {
        "derived" => inner.attribute("name").unwrap_or("DERIVED").to_string(),
        "array" => {
            let dim = inner.children().find(|n| n.has_tag_name("dimension"));
            let (lo, hi) = dim
                .map(|d| {
                    (
                        d.attribute("lower").unwrap_or("0").to_string(),
                        d.attribute("upper").unwrap_or("0").to_string(),
                    )
                })
                .unwrap_or_else(|| ("0".to_string(), "0".to_string()));
            let base = inner
                .children()
                .find(|n| n.has_tag_name("baseType"))
                .map(type_name)
                .unwrap_or_else(|| "INT".to_string());
            format!("ARRAY[{lo}..{hi}] OF {base}")
        }
        "string" | "wstring" => "STRING".to_string(),
        // BOOL, INT, DINT, REAL, TIME, ... — the tag name is the ST type.
        other => other.to_ascii_uppercase(),
    }
 }
 /// Extract an initial value as an ST literal (quoting strings).
 fn initial_value(iv: Node) -> Option<String> {
    let simple = iv.descendants().find(|n| n.has_tag_name("simpleValue"))?;
    let raw = simple.attribute("value")?.trim().to_string();
    if raw.is_empty() {
        return None;
    }
    // Numbers / booleans / time literals pass through; everything else is a
    // string literal.
    let is_scalar = raw.eq_ignore_ascii_case("true")
        || raw.eq_ignore_ascii_case("false")
        || raw.starts_with(['T', 't', 'D', 'd']) && raw.contains('#')
        || raw
            .chars()
            .all(|c| c.is_ascii_digit() || c == '.' || c == '-' || c == '+');
    if is_scalar || raw.starts_with('\'') || raw.starts_with('"') {
        Some(raw)
    } else {
        Some(format!("'{}'", raw.replace('\'', "''")))
    }
 }
 #[cfg(test)]
 mod tests {
    use super::parse_plcopen;
    use crate::pipeline::plc::rules;
    use std::collections::HashSet;
    fn rule_ids(xml: &str) -> HashSet<&'static str> {
        parse_plcopen(xml)
            .iter()
            .flat_map(rules::analyze)
            .map(|h| h.rule_id)
            .collect()
    }
    /// A Ladder Diagram network: a rung (power rail → contact → coil) plus an
    /// insecure comm block. Coils/contacts translate to assignments; the block
    /// translates to a call so the port rule fires.
    #[test]
    fn ld_coil_and_block_translate_and_are_analysed() {
        let xml = r#"<?xml version="1.0"?>
 <project xmlns="http://www.plcopen.org/xml/tc6_0201">
 <types><pous>
  <pou name="Rung" pouType="program">
   <interface><localVars>
     <variable name="Motor"><type><BOOL/></type></variable>
   </localVars></interface>
   <body><LD>
     <leftPowerRail localId="0"/>
     <contact localId="1"><variable>Start</variable>
       <connectionPointIn><connection refLocalId="0"/></connectionPointIn></contact>
     <coil localId="2"><variable>Motor</variable>
       <connectionPointIn><connection refLocalId="1"/></connectionPointIn></coil>
     <inVariable localId="3"><expression>21</expression></inVariable>
     <inVariable localId="4"><expression>FALSE</expression></inVariable>
     <block localId="10" typeName="Ftp_Send">
       <inputVariables>
         <variable formalParameter="PORT">
           <connectionPointIn><connection refLocalId="3"/></connectionPointIn></variable>
         <variable formalParameter="ENCRYPT">
           <connectionPointIn><connection refLocalId="4"/></connectionPointIn></variable>
       </inputVariables>
     </block>
   </LD></body>
  </pou>
 </pous></types>
 </project>"#;
        let ids = rule_ids(xml);
        // Ftp_Send(PORT := 21, ENCRYPT := FALSE) — port 21 is an insecure protocol.
        assert!(
            ids.contains("plc-insecure-protocol-port"),
            "LD block should flag port 21; got {ids:?}"
        );
    }
    /// Doubled-text regression: a graphical expression must be extracted once,
    /// so literals like `502` and `FALSE` stay intact (not `502502`/`FALSEFALSE`).
    #[test]
    fn graphical_expression_text_is_not_duplicated() {
        let xml = r#"<?xml version="1.0"?>
 <project xmlns="http://www.plcopen.org/xml/tc6_0201">
 <types><pous>
  <pou name="Comm" pouType="program">
   <body><FBD>
     <inVariable localId="1"><expression>502</expression></inVariable>
     <inVariable localId="2"><expression>FALSE</expression></inVariable>
     <block localId="10" typeName="Modbus_TCP_Master">
       <inputVariables>
         <variable formalParameter="PORT">
           <connectionPointIn><connection refLocalId="1"/></connectionPointIn></variable>
         <variable formalParameter="AUTH">
           <connectionPointIn><connection refLocalId="2"/></connectionPointIn></variable>
       </inputVariables>
     </block>
   </FBD></body>
  </pou>
 </pous></types>
 </project>"#;
        let ids = rule_ids(xml);
        assert!(ids.contains("plc-insecure-protocol-port")); // PORT := 502 (not 502502)
        assert!(ids.contains("plc-insecure-comm")); // AUTH := FALSE (not FALSEFALSE)
    }
 }
@@ -1,632 +0,0 @@
 //! Semantic control-logic security rules over the Structured Text AST.
 //!
 //! Each rule walks the parsed [`Pou`] and yields [`RuleHit`]s the scanner turns
 //! into findings. Rules reason over structure (declarations, assignments, calls,
 //! array accesses, division, jumps) rather than raw text, so they see through
 //! formatting and comments.
 use std::collections::{HashMap, HashSet};
 use compliance_core::models::Severity;
 use super::ast::*;
 /// One rule match within a POU.
 pub struct RuleHit {
    pub line: u32,
    pub severity: Severity,
    pub rule_id: &'static str,
    pub title: String,
    pub description: String,
    pub cwe: Option<&'static str>,
    pub remediation: &'static str,
 }
 /// Run every rule over a POU.
 pub fn analyze(pou: &Pou) -> Vec<RuleHit> {
    let mut hits = Vec::new();
    let ctx = Ctx::build(pou);
    // Declaration-level rules.
    for v in &pou.vars {
        if let Some(init) = &v.init {
            check_credential_binding(&v.name, init, &pou.name, &mut hits);
            check_default_password(init, &v.name, &pou.name, &mut hits);
        }
    }
    // Body walk.
    walk(&pou.body, pou, &ctx, &GuardSet::default(), &mut hits);
    hits
 }
 /// Per-POU context precomputed once.
 struct Ctx {
    /// Names declared in VAR_INPUT (untrusted / externally driven).
    input_vars: HashSet<String>,
    /// Array variable name → declared (lo, hi) bounds.
    arrays: HashMap<String, (i64, i64)>,
 }
 impl Ctx {
    fn build(pou: &Pou) -> Self {
        let mut input_vars = HashSet::new();
        let mut arrays = HashMap::new();
        for v in &pou.vars {
            if v.section == VarSection::Input {
                input_vars.insert(v.name.to_ascii_lowercase());
            }
            if let Some(b) = v.array_bounds {
                arrays.insert(v.name.to_ascii_lowercase(), b);
            }
        }
        Self { input_vars, arrays }
    }
 }
 /// Variables proven non-zero on the current control-flow path (from enclosing
 /// `IF`/`WHILE` conditions), so guarded divisions aren't false-flagged.
 #[derive(Default, Clone)]
 struct GuardSet {
    nonzero: HashSet<String>,
 }
 impl GuardSet {
    fn with(&self, names: Vec<String>) -> Self {
        let mut g = self.clone();
        g.nonzero.extend(names);
        g
    }
    fn is_nonzero(&self, name: &str) -> bool {
        self.nonzero.contains(name)
    }
 }
 /// Variable names a condition proves non-zero (`v <> 0`, `v > 0`, `v >= 1`,
 /// `v < 0`, and conjunctions thereof).
 fn guards_from_cond(cond: &Expr) -> Vec<String> {
    let mut out = Vec::new();
    collect_nonzero(cond, &mut out);
    out
 }
 fn collect_nonzero(e: &Expr, out: &mut Vec<String>) {
    let Expr::Binary { op, lhs, rhs, .. } = e else {
        return;
    };
    let is_zero = |x: &Expr| {
        matches!(x, Expr::Int(0, _)) || matches!(x, Expr::Real(r, _) if r.abs() < f64::EPSILON)
    };
    let int_of = |x: &Expr| match x {
        Expr::Int(n, _) => Some(*n),
        _ => None,
    };
    match op {
        BinOp::And => {
            collect_nonzero(lhs, out);
            collect_nonzero(rhs, out);
        }
        BinOp::Ne => {
            if let (Some(v), true) = (lhs.as_ident(), is_zero(rhs)) {
                out.push(v.to_ascii_lowercase());
            }
            if let (true, Some(v)) = (is_zero(lhs), rhs.as_ident()) {
                out.push(v.to_ascii_lowercase());
            }
        }
        BinOp::Gt | BinOp::Lt => {
            // v > 0  or  v < 0
            if let (Some(v), true) = (lhs.as_ident(), is_zero(rhs)) {
                out.push(v.to_ascii_lowercase());
            }
        }
        BinOp::Ge => {
            // v >= n, n >= 1
            if let (Some(v), Some(n)) = (lhs.as_ident(), int_of(rhs)) {
                if n >= 1 {
                    out.push(v.to_ascii_lowercase());
                }
            }
        }
        _ => {}
    }
 }
 // ── the walker ─────────────────────────────────────────────────────
 fn walk(stmts: &[Stmt], pou: &Pou, ctx: &Ctx, guards: &GuardSet, hits: &mut Vec<RuleHit>) {
    for s in stmts {
        match s {
            Stmt::Assign {
                target,
                value,
                line,
            } => {
                check_safety_bypass(target, value, *line, &pou.name, hits);
                // A string bound to a secret-looking target is a credential.
                if let Some(name) = flatten_ident(target) {
                    check_credential_binding(&name, value, &pou.name, hits);
                    check_default_password(value, &name, &pou.name, hits);
                }
                walk_expr(target, pou, ctx, guards, hits);
                walk_expr(value, pou, ctx, guards, hits);
            }
            Stmt::Call { callee, args, line } => {
                check_insecure_comm(callee, args, *line, &pou.name, hits);
                check_credentials_in_call(callee, args, *line, &pou.name, hits);
                for a in args {
                    walk_expr(&a.value, pou, ctx, guards, hits);
                }
            }
            Stmt::Jump { label, line } => hits.push(RuleHit {
                line: *line,
                severity: Severity::Medium,
                rule_id: "plc-unstructured-jump",
                title: "Unstructured jump (JMP) in control logic".to_string(),
                description: format!(
                    "POU `{}` uses `JMP {label}`. Unstructured jumps make control flow hard to \
                     verify and can bypass safety interlocks or leave outputs in an undefined \
                     state on unexpected paths.",
                    pou.name
                ),
                cwe: Some("CWE-691"),
                remediation: "Replace JMP with structured constructs (IF/CASE/loops); reserve \
                              jumps for well-reviewed state machines only.",
            }),
            Stmt::If {
                branches,
                else_body,
                ..
            } => {
                for (cond, body) in branches {
                    walk_expr(cond, pou, ctx, guards, hits);
                    let child = guards.with(guards_from_cond(cond));
                    walk(body, pou, ctx, &child, hits);
                }
                if let Some(b) = else_body {
                    walk(b, pou, ctx, guards, hits);
                }
            }
            Stmt::Case {
                selector,
                arms,
                else_body,
                ..
            } => {
                walk_expr(selector, pou, ctx, guards, hits);
                for (labels, body) in arms {
                    for l in labels {
                        walk_expr(l, pou, ctx, guards, hits);
                    }
                    walk(body, pou, ctx, guards, hits);
                }
                if let Some(b) = else_body {
                    walk(b, pou, ctx, guards, hits);
                }
            }
            Stmt::For {
                from, to, by, body, ..
            } => {
                walk_expr(from, pou, ctx, guards, hits);
                walk_expr(to, pou, ctx, guards, hits);
                if let Some(b) = by {
                    walk_expr(b, pou, ctx, guards, hits);
                }
                walk(body, pou, ctx, guards, hits);
            }
            Stmt::While { cond, body, .. } => {
                walk_expr(cond, pou, ctx, guards, hits);
                let child = guards.with(guards_from_cond(cond));
                walk(body, pou, ctx, &child, hits);
            }
            Stmt::Repeat { body, until, .. } => {
                walk(body, pou, ctx, guards, hits);
                walk_expr(until, pou, ctx, guards, hits);
            }
            Stmt::Return { .. } | Stmt::Exit { .. } | Stmt::Label { .. } => {}
        }
    }
 }
 fn walk_expr(e: &Expr, pou: &Pou, ctx: &Ctx, guards: &GuardSet, hits: &mut Vec<RuleHit>) {
    match e {
        Expr::Index { base, index, line } => {
            check_array_bounds(base, index, *line, ctx, &pou.name, hits);
            walk_expr(base, pou, ctx, guards, hits);
            walk_expr(index, pou, ctx, guards, hits);
        }
        Expr::Binary { op, lhs, rhs, line } => {
            if matches!(op, BinOp::Div | BinOp::Mod) {
                check_division(rhs, *line, &pou.name, guards, hits);
            }
            walk_expr(lhs, pou, ctx, guards, hits);
            walk_expr(rhs, pou, ctx, guards, hits);
        }
        Expr::Unary { expr, .. } => walk_expr(expr, pou, ctx, guards, hits),
        Expr::Member { base, .. } => walk_expr(base, pou, ctx, guards, hits),
        Expr::Call { args, .. } => {
            for a in args {
                walk_expr(&a.value, pou, ctx, guards, hits);
            }
        }
        _ => {}
    }
 }
 // ── individual rules ───────────────────────────────────────────────
 const SECRET_HINTS: &[&str] = &[
    "password",
    "passwd",
    "pwd",
    "secret",
    "apikey",
    "api_key",
    "token",
    "credential",
    "privkey",
    "private_key",
    "passphrase",
 ];
 const DEFAULT_PASSWORDS: &[&str] = &[
    "admin",
    "administrator",
    "password",
    "passwd",
    "1234",
    "12345",
    "123456",
    "0000",
    "1111",
    "root",
    "default",
    "admin123",
    "changeme",
    "letmein",
    "guest",
    "user",
    "system",
    "plc",
    "codesys",
 ];
 const COMM_FB_HINTS: &[&str] = &[
    "modbus", "tcp", "udp", "socket", "mqtt", "opcua", "opc_ua", "ethernet", "ethip", "enip",
    "dnp3", "ftp", "telnet", "http", "send", "connect", "sock", "comm", "profinet", "s7",
 ];
 /// Insecure cleartext service ports.
 const INSECURE_PORTS: &[i64] = &[21, 23, 80, 502, 20000, 44818, 102];
 fn check_credential_binding(var_name: &str, value: &Expr, pou: &str, hits: &mut Vec<RuleHit>) {
    let name = var_name.to_ascii_lowercase();
    let looks_secret = SECRET_HINTS.iter().any(|h| name.contains(h));
    if looks_secret {
        if let Expr::Str(s, line) = value {
            if !s.is_empty() {
                hits.push(RuleHit {
                    line: *line,
                    severity: Severity::High,
                    rule_id: "plc-hardcoded-credential",
                    title: "Hardcoded credential in PLC program".to_string(),
                    description: format!(
                        "POU `{pou}` binds a hardcoded secret to `{var_name}`. Credentials \
                         embedded in control logic are extracted trivially from a project export \
                         or a firmware dump and cannot be rotated without a redeploy."
                    ),
                    cwe: Some("CWE-798"),
                    remediation: "Store secrets outside the program (secure parameter store / \
                                  operator-entered, retained-but-protected memory); never commit \
                                  them to the POU.",
                });
            }
        }
    }
 }
 fn check_default_password(value: &Expr, var_name: &str, pou: &str, hits: &mut Vec<RuleHit>) {
    if let Expr::Str(s, line) = value {
        let lower = s.to_ascii_lowercase();
        if DEFAULT_PASSWORDS.contains(&lower.as_str()) {
            hits.push(RuleHit {
                line: *line,
                severity: Severity::Critical,
                rule_id: "plc-default-password",
                title: "Default/weak password in PLC program".to_string(),
                description: format!(
                    "POU `{pou}` uses the well-known default/weak password `{s}` (bound to \
                     `{var_name}`). Default PLC credentials are the first thing an attacker tries."
                ),
                cwe: Some("CWE-1393"),
                remediation:
                    "Require a strong, unique, operator-set password; block commissioning \
                              until the default is changed.",
            });
        }
    }
 }
 fn check_credentials_in_call(
    callee: &str,
    args: &[CallArg],
    line: u32,
    pou: &str,
    hits: &mut Vec<RuleHit>,
 ) {
    for a in args {
        if let Some(name) = &a.name {
            let n = name.to_ascii_lowercase();
            if SECRET_HINTS.iter().any(|h| n.contains(h)) {
                if let Expr::Str(s, l) = &a.value {
                    if !s.is_empty() {
                        hits.push(RuleHit {
                            line: *l,
                            severity: Severity::High,
                            rule_id: "plc-hardcoded-credential",
                            title: "Hardcoded credential passed to a function block".to_string(),
                            description: format!(
                                "POU `{pou}` passes a hardcoded secret as `{name}` to `{callee}`."
                            ),
                            cwe: Some("CWE-798"),
                            remediation: "Supply credentials from protected configuration at \
                                          runtime, not as a literal argument.",
                        });
                    }
                }
            }
        }
    }
    let _ = line;
 }
 fn check_safety_bypass(target: &Expr, value: &Expr, line: u32, pou: &str, hits: &mut Vec<RuleHit>) {
    let Some(name) = flatten_ident(target) else {
        return;
    };
    let n = name.to_ascii_lowercase();
    let safety = [
        "safety",
        "estop",
        "e_stop",
        "emergency",
        "interlock",
        "guard",
        "permit",
    ]
    .iter()
    .any(|h| n.contains(h));
    let watchdog = n.contains("watchdog") || n.contains("wdt");
    // A safety enable / interlock / watchdog signal driven to FALSE or 0 in
    // application logic is a bypass (e.g. `Safety_Enable := FALSE`, `Watchdog_Kick := 0`).
    let disabling = matches!(value, Expr::Bool(false, _)) || matches!(value, Expr::Int(0, _));
    if (safety || watchdog) && disabling {
        hits.push(RuleHit {
            line,
            severity: Severity::Critical,
            rule_id: "plc-safety-bypass",
            title: "Safety interlock / watchdog disabled in logic".to_string(),
            description: format!(
                "POU `{pou}` disables a safety-related signal (`{name}`) in program logic. \
                 Bypassing interlocks or watchdogs in code defeats the plant's protective \
                 functions and is a direct hazard."
            ),
            cwe: Some("CWE-1384"),
            remediation: "Never disable safety functions from application logic; safety must be \
                          handled by a certified safety controller / hard-wired circuit.",
        });
    }
 }
 fn check_array_bounds(
    base: &Expr,
    index: &Expr,
    line: u32,
    ctx: &Ctx,
    pou: &str,
    hits: &mut Vec<RuleHit>,
 ) {
    // Only reason about arrays we know the bounds of.
    let Some(arr_name) = base.as_ident() else {
        return;
    };
    if !ctx.arrays.contains_key(&arr_name.to_ascii_lowercase()) {
        return;
    }
    // Index by an untrusted input variable → potential out-of-bounds access.
    if let Some(idx_name) = index.as_ident() {
        if ctx.input_vars.contains(&idx_name.to_ascii_lowercase()) {
            hits.push(RuleHit {
                line,
                severity: Severity::High,
                rule_id: "plc-array-unchecked-index",
                title: "Array indexed by unvalidated input".to_string(),
                description: format!(
                    "POU `{pou}` indexes array `{arr_name}` with the input variable `{idx_name}` \
                     without a validated bounds check. An out-of-range index corrupts adjacent \
                     memory or faults the PLC (loss of control)."
                ),
                cwe: Some("CWE-129"),
                remediation: "Clamp or validate the index against the array bounds (e.g. \
                              `LIMIT`/explicit `IF idx >= lo AND idx <= hi`) before the access.",
            });
        }
    }
 }
 fn check_division(
    divisor: &Expr,
    line: u32,
    pou: &str,
    guards: &GuardSet,
    hits: &mut Vec<RuleHit>,
 ) {
    // A divisor proven non-zero by an enclosing guard is safe.
    if let Expr::Ident(name, _) = divisor {
        if guards.is_nonzero(&name.to_ascii_lowercase()) {
            return;
        }
    }
    // Flag division by a variable (could be zero); nonzero literals are fine.
    let risky = matches!(
        divisor,
        Expr::Ident(_, _) | Expr::Member { .. } | Expr::Index { .. } | Expr::Int(0, _)
    );
    if risky {
        hits.push(RuleHit {
            line,
            severity: Severity::Medium,
            rule_id: "plc-division-by-zero",
            title: "Division by a variable without a zero-guard".to_string(),
            description: format!(
                "POU `{pou}` divides by a variable that is not proven non-zero. A zero divisor \
                 raises a PLC exception and can halt the scan cycle (denial of control)."
            ),
            cwe: Some("CWE-369"),
            remediation: "Guard the divisor (`IF d <> 0 THEN …`) or use a safe-divide helper that \
                          returns a defined value for a zero denominator.",
        });
    }
 }
 fn check_insecure_comm(
    callee: &str,
    args: &[CallArg],
    line: u32,
    pou: &str,
    hits: &mut Vec<RuleHit>,
 ) {
    let c = callee.to_ascii_lowercase();
    let is_comm = COMM_FB_HINTS.iter().any(|h| c.contains(h));
    if !is_comm {
        return;
    }
    // Auth/encryption explicitly disabled.
    for a in args {
        if let Some(name) = &a.name {
            let n = name.to_ascii_lowercase();
            let security_flag = ["auth", "secure", "encrypt", "tls", "ssl", "authentication"]
                .iter()
                .any(|h| n.contains(h));
            if security_flag && matches!(a.value, Expr::Bool(false, _)) {
                hits.push(RuleHit {
                    line,
                    severity: Severity::High,
                    rule_id: "plc-insecure-comm",
                    title: "Network communication with security disabled".to_string(),
                    description: format!(
                        "POU `{pou}` calls `{callee}` with `{name} := FALSE`, disabling \
                         authentication/encryption on an industrial network link."
                    ),
                    cwe: Some("CWE-319"),
                    remediation: "Enable authentication + transport encryption; segment OT \
                                  networks and restrict the endpoint to trusted peers.",
                });
            }
        }
        // Well-known cleartext port literal.
        if let Expr::Int(p, _) = &a.value {
            if INSECURE_PORTS.contains(p) {
                hits.push(RuleHit {
                    line,
                    severity: Severity::Medium,
                    rule_id: "plc-insecure-protocol-port",
                    title: "Cleartext industrial protocol port".to_string(),
                    description: format!(
                        "POU `{pou}` opens `{callee}` on port {p}, a well-known cleartext OT \
                         protocol port with no built-in authentication or encryption."
                    ),
                    cwe: Some("CWE-319"),
                    remediation: "Front the protocol with a secure gateway/VPN, or use the \
                                  authenticated/encrypted variant; never expose it to untrusted \
                                  networks.",
                });
            }
        }
    }
    let _ = line;
 }
 /// The dotted/base identifier of an lvalue expression (`a`, `a.b` → `a.b`,
 /// `a[i]` → `a`), for name-based rules.
 fn flatten_ident(e: &Expr) -> Option<String> {
    match e {
        Expr::Ident(n, _) => Some(n.clone()),
        Expr::Member { base, field, .. } => flatten_ident(base).map(|b| format!("{b}.{field}")),
        Expr::Index { base, .. } => flatten_ident(base),
        _ => None,
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use crate::pipeline::plc::parser;
    const VULN: &str = r#"
 FUNCTION_BLOCK CommCtrl
 VAR_INPUT
    cmdIndex : INT;
 END_VAR
 VAR
    Password : STRING := 'admin123';
    buffer : ARRAY[0..15] OF INT;
    Safety_Enable : BOOL := TRUE;
    divisor : INT;
    result : INT;
 END_VAR
    Safety_Enable := FALSE;
    result := 100 / divisor;
    buffer[cmdIndex] := 1;
    Modbus_Connect(IP := '192.168.0.10', PORT := 502, AUTH := FALSE);
    IF cmdIndex > 100 THEN
        JMP fault;
    END_IF;
 fault:
    result := 0;
 END_FUNCTION_BLOCK
 "#;
    fn rule_ids(src: &str) -> Vec<&'static str> {
        parser::parse(src)
            .iter()
            .flat_map(analyze)
            .map(|h| h.rule_id)
            .collect()
    }
    #[test]
    fn vulnerable_program_triggers_every_rule() {
        let ids = rule_ids(VULN);
        for expected in [
            "plc-hardcoded-credential",
            "plc-default-password",
            "plc-safety-bypass",
            "plc-division-by-zero",
            "plc-array-unchecked-index",
            "plc-insecure-comm",
            "plc-insecure-protocol-port",
            "plc-unstructured-jump",
        ] {
            assert!(
                ids.contains(&expected),
                "expected rule {expected}, got {ids:?}"
            );
        }
    }
    #[test]
    fn clean_program_has_no_findings() {
        let clean = r#"
 PROGRAM Clean
 VAR
    a : INT := 5;
    b : INT := 3;
    total : INT;
 END_VAR
    IF b <> 0 THEN
        total := a / b;
    END_IF;
 END_PROGRAM
 "#;
        assert!(rule_ids(clean).is_empty(), "clean program should be quiet");
    }
 }
@@ -1,253 +0,0 @@
 //! Control-application dependency SBOM from a CODESYS `.projectarchive`.
 //!
 //! A `.projectarchive` is a ZIP that bundles the project plus its referenced
 //! libraries and the target runtime. Each referenced library is an entry whose
 //! path segment follows the CODESYS convention
 //! `Name, Major.Minor.Patch.Build (Company)` (e.g. `Standard, 3.5.18.0 (System)`,
 //! `CSV Utility SL, 1.9.0.0 (CODESYS)`); the runtime appears as a device-descriptor
 //! entry `CODESYS Control … <version> …`. We enumerate those entries — no binary
 //! parsing — and emit SBOM components tagged `pkg:codesys/…`, so the CVE pipeline
 //! can match them (the runtime `Cmp*` / `3SLicense` components carry real CODESYS
 //! CVEs).
 use std::collections::BTreeSet;
 use std::path::{Path, PathBuf};
 use compliance_core::models::SbomEntry;
 /// Collect the control-application SBOM from every `.projectarchive` reachable for
 /// a target: the ingested artifact file itself (an uploaded archive), plus any
 /// `*.projectarchive` committed inside the working tree — e.g. a git repo or an
 /// extracted source archive that ships the archive alongside its PLCopen XML / ST
 /// exports. Deduplicated by (name, version).
 pub fn collect_sbom(artifact_file: &Path, working_path: &Path, repo_id: &str) -> Vec<SbomEntry> {
    let mut archives: Vec<PathBuf> = Vec::new();
    if artifact_file.is_file() {
        archives.push(artifact_file.to_path_buf());
    }
    for entry in walkdir::WalkDir::new(working_path)
        .max_depth(8)
        .into_iter()
        .filter_map(|e| e.ok())
    {
        let p = entry.path();
        if entry.file_type().is_file()
            && p.extension()
                .and_then(|x| x.to_str())
                .is_some_and(|x| x.eq_ignore_ascii_case("projectarchive"))
        {
            archives.push(p.to_path_buf());
        }
    }
    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
    let mut out = Vec::new();
    for a in archives {
        for e in projectarchive_sbom(&a, repo_id) {
            if seen.insert((e.name.clone(), e.version.clone())) {
                out.push(e);
            }
        }
    }
    out
 }
 /// Extract CODESYS library + runtime components from a `.projectarchive` (a zip).
 /// Best-effort: returns empty if the file is not a readable zip (e.g. a bare
 /// `.st`/`.xml` project, which carries no library manifest).
 pub fn projectarchive_sbom(archive: &Path, repo_id: &str) -> Vec<SbomEntry> {
    let Ok(file) = std::fs::File::open(archive) else {
        return Vec::new();
    };
    let Ok(mut zip) = zip::ZipArchive::new(file) else {
        return Vec::new();
    };
    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
    let mut entries = Vec::new();
    for i in 0..zip.len() {
        let Ok(entry) = zip.by_index(i) else {
            continue;
        };
        // Entry paths use `\` (Windows-authored) and/or `/` separators; the
        // component id is one path segment.
        for seg in entry.name().split(['/', '\\']) {
            if let Some((name, version)) = parse_library(seg).or_else(|| parse_runtime(seg)) {
                if seen.insert((name.clone(), version.clone())) {
                    let mut e = SbomEntry::new(
                        repo_id.to_string(),
                        name.clone(),
                        version.clone(),
                        "codesys".to_string(),
                    );
                    e.purl = Some(format!(
                        "pkg:codesys/{}@{version}",
                        name.replace(' ', "%20")
                    ));
                    entries.push(e);
                }
            }
        }
    }
    entries
 }
 /// `Name, X.Y.Z.W (Company)` → (name, version).
 fn parse_library(seg: &str) -> Option<(String, String)> {
    let seg = seg.trim();
    // Company is the trailing "(…)".
    let open = seg.rfind(" (")?;
    let rest = &seg[open + 2..];
    let close = rest.find(')')?;
    if rest[..close].trim().is_empty() {
        return None;
    }
    let head = seg[..open].trim(); // "Name, X.Y.Z.W"
    let comma = head.rfind(", ")?;
    let name = head[..comma].trim().to_string();
    let version = head[comma + 2..].trim().to_string();
    if name.is_empty() || !is_dotted_version(&version) {
        return None;
    }
    Some((name, version))
 }
 /// Device-descriptor entry `CODESYS Control … X.Y.Z.W …` → (runtime name, version).
 fn parse_runtime(seg: &str) -> Option<(String, String)> {
    let seg = seg.trim();
    if !seg.starts_with("CODESYS Control") {
        return None;
    }
    let version = seg
        .split_whitespace()
        .find(|t| is_dotted_version(t))?
        .to_string();
    // The runtime name is the first field, before the run of padding spaces that
    // precede the descriptor's numeric columns.
    let name = seg.split("  ").next().unwrap_or(seg).trim().to_string();
    if name.is_empty() {
        return None;
    }
    Some((name, version))
 }
 /// A dotted numeric version with at least 3 components (`3.5.18.0`, `4.17.0.0`).
 fn is_dotted_version(s: &str) -> bool {
    let parts: Vec<&str> = s.split('.').collect();
    parts.len() >= 3
        && parts
            .iter()
            .all(|p| !p.is_empty() && p.chars().all(|c| c.is_ascii_digit()))
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use std::collections::HashMap;
    use std::io::Write;
    /// Build a synthetic `.projectarchive` (zip) mirroring the real CODESYS entry
    /// naming (verified against Proemion/codesys-examples): a native `.project`,
    /// referenced libraries as `Name, Version (Company)` segments, and a runtime
    /// device descriptor.
    fn synthetic_archive(dir: &Path) -> std::path::PathBuf {
        let path = dir.join("App.projectarchive");
        write_synthetic_archive(&path);
        path
    }
    fn write_synthetic_archive(path: &Path) {
        let file = std::fs::File::create(path).expect("create");
        let mut zip = zip::ZipWriter::new(file);
        let opts: zip::write::SimpleFileOptions = Default::default();
        let names = [
            "App.project",
            r"{b0b5}\App.Device.Plc.compileinfo",
            r"{e179}\Standard, 3.5.18.0 (System)   standard.compiled-library-v3",
            r"{e179}\Util, 3.5.21.0 (System)   util.compiled-library-v3",
            r"{e179}\CSV Utility SL, 1.9.0.0 (CODESYS)   csv utility sl.compiled-library-v3",
            r"{e179}\3SLicense, 3.5.20.0 (CODESYS)   3slicense.compiled-library-v3",
            r"{0c63}\CODESYS Control for Linux ARM SL     0000 0006     4.17.0.0     4096     .zip",
        ];
        for n in names {
            zip.start_file(n, opts).expect("start");
            zip.write_all(b"x").expect("write");
        }
        zip.finish().expect("finish");
    }
    #[test]
    fn extracts_libraries_and_runtime_from_projectarchive() {
        let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-{}", uuid::Uuid::new_v4()));
        std::fs::create_dir_all(&tmp).expect("mkdir");
        let archive = synthetic_archive(&tmp);
        let entries = projectarchive_sbom(&archive, "plc-target");
        let by_name: HashMap<&str, &SbomEntry> =
            entries.iter().map(|e| (e.name.as_str(), e)).collect();
        // Libraries with their versions.
        assert_eq!(
            by_name.get("Standard").map(|e| e.version.as_str()),
            Some("3.5.18.0")
        );
        assert_eq!(
            by_name.get("Util").map(|e| e.version.as_str()),
            Some("3.5.21.0")
        );
        assert_eq!(
            by_name.get("CSV Utility SL").map(|e| e.version.as_str()),
            Some("1.9.0.0"),
            "multi-word library names must parse"
        );
        assert!(by_name.contains_key("3SLicense"));
        // The runtime, from the device descriptor.
        assert_eq!(
            by_name
                .get("CODESYS Control for Linux ARM SL")
                .map(|e| e.version.as_str()),
            Some("4.17.0.0")
        );
        // Every component is CODESYS-tagged with a purl the CVE pipeline can match,
        // and the native `.project` / compileinfo are not mistaken for components.
        for e in &entries {
            assert_eq!(e.package_manager, "codesys");
            assert!(e.purl.as_deref().unwrap_or("").starts_with("pkg:codesys/"));
        }
        assert!(!by_name.contains_key("App"));
        let _ = std::fs::remove_dir_all(&tmp);
    }
    #[test]
    fn collect_sbom_finds_a_projectarchive_committed_in_a_git_tree() {
        let tmp = std::env::temp_dir().join(format!("cs-plc-collect-{}", uuid::Uuid::new_v4()));
        let src = tmp.join("clone/src");
        std::fs::create_dir_all(&src).expect("mkdir");
        // Simulate a git clone that commits the archive alongside its exports.
        write_synthetic_archive(&src.join("PumpStation.projectarchive"));
        // The artifact "file" is a git URL (not a real file), so the SBOM must
        // come from walking the cloned tree.
        let entries = collect_sbom(Path::new("https://git.example/plc.git"), &tmp, "t");
        let names: std::collections::HashSet<&str> =
            entries.iter().map(|e| e.name.as_str()).collect();
        assert!(
            names.contains("Standard"),
            "found libs in the committed archive"
        );
        assert!(names.contains("CODESYS Control for Linux ARM SL"));
        let _ = std::fs::remove_dir_all(&tmp);
    }
    #[test]
    fn non_zip_file_yields_no_sbom() {
        let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-st-{}", uuid::Uuid::new_v4()));
        std::fs::create_dir_all(&tmp).expect("mkdir");
        let st = tmp.join("prog.st");
        std::fs::write(&st, "PROGRAM P\nVAR x : INT; END_VAR\nEND_PROGRAM\n").expect("write");
        assert!(projectarchive_sbom(&st, "t").is_empty());
        let _ = std::fs::remove_dir_all(&tmp);
    }
 }
@@ -1,4 +1,3 @@
 use crate::pipeline::repo_view::RepoView;
 use compliance_core::models::*;
 use super::dedup::compute_fingerprint;
@@ -15,7 +14,7 @@ impl PipelineOrchestrator {
    #[tracing::instrument(skip_all, fields(repo_id = %repo_id, pr_number))]
    pub async fn run_pr_review(
        &self,
-        repo: &RepoView,
+        repo: &TrackedRepository,
        repo_id: &str,
        pr_number: u64,
        base_sha: &str,
@@ -1,74 +0,0 @@
 //! `RepoView` — an internal, non-persisted view of a code target for the scan
 //! pipeline.
 //!
 //! It replaces the old persisted `TrackedRepository` model. The pipeline
 //! (SAST → SBOM → CVE → triage → issues → DAST, and PR review) only ever needs a
 //! flat bundle of git + issue-tracker + auth fields; those are projected from an
 //! [`OnboardedTarget`] and its code [`Artifact`] by [`RepoView::from_target`].
 //! Nothing here is written to Mongo — onboarded targets are the sole persisted
 //! entity.
 use compliance_core::models::{Artifact, OnboardedTarget, TrackerType};
 /// A flat, pipeline-facing view of a code target. Built from an onboarded
 /// target; never persisted.
 #[derive(Debug, Clone)]
 pub struct RepoView {
    /// The onboarded target's id (used as `repo_id` across findings/sbom/etc.).
    pub id: Option<mongodb::bson::oid::ObjectId>,
    pub name: String,
    pub git_url: String,
    pub default_branch: String,
    pub local_path: Option<String>,
    pub scan_schedule: Option<String>,
    pub webhook_enabled: bool,
    pub webhook_secret: Option<String>,
    pub tracker_type: Option<TrackerType>,
    pub tracker_owner: Option<String>,
    pub tracker_repo: Option<String>,
    pub tracker_token: Option<String>,
    pub auth_token: Option<String>,
    pub auth_username: Option<String>,
    pub last_scanned_commit: Option<String>,
    pub findings_count: u32,
 }
 impl RepoView {
    /// Project an onboarded target + its code artifact into a pipeline view.
    pub fn from_target(target: &OnboardedTarget, code: &Artifact) -> Self {
        let mut view = Self {
            id: target.id,
            name: target.name.clone(),
            git_url: code.source_ref.clone(),
            default_branch: "main".to_string(),
            local_path: None,
            scan_schedule: target.scan_schedule.clone(),
            webhook_enabled: target.webhook_enabled,
            webhook_secret: target.webhook_secret.clone(),
            tracker_type: None,
            tracker_owner: None,
            tracker_repo: None,
            tracker_token: None,
            auth_token: None,
            auth_username: None,
            last_scanned_commit: None,
            findings_count: target.findings_count,
        };
        if let Some(git) = &code.git {
            view.default_branch = git.default_branch.clone();
            view.last_scanned_commit = git.last_scanned_commit.clone();
            view.local_path = git.local_path.clone();
        }
        if let Some(auth) = &code.auth {
            view.auth_token = auth.secret.clone();
            view.auth_username = auth.username.clone();
        }
        if let Some(it) = &target.scan_config.issue_tracker {
            view.tracker_type = it.tracker_type.clone();
            view.tracker_owner = it.owner.clone();
            view.tracker_repo = it.repo.clone();
            view.tracker_token = it.token.clone();
        }
        view
    }
 }
@@ -348,7 +348,7 @@ async fn monitor_cves(agent: &ComplianceAgent, tenant_id: &str) {
        std::collections::HashMap::new();
    for rid in &repo_ids {
        if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(rid) {
-            if let Ok(Some(repo)) = db.onboarded_targets().find_one(doc! { "_id": oid }).await {
+            if let Ok(Some(repo)) = db.repositories().find_one(doc! { "_id": oid }).await {
                repo_names.insert(rid.clone(), repo.name.clone());
            }
        }
@@ -31,7 +31,7 @@ pub async fn handle_gitea_webhook(
        }
    };
    let repo = match db
-        .onboarded_targets()
+        .repositories()
        .find_one(mongodb::bson::doc! { "_id": oid })
        .await
    {
@@ -31,7 +31,7 @@ pub async fn handle_github_webhook(
        }
    };
    let repo = match db
-        .onboarded_targets()
+        .repositories()
        .find_one(mongodb::bson::doc! { "_id": oid })
        .await
    {
@@ -27,7 +27,7 @@ pub async fn handle_gitlab_webhook(
        }
    };
    let repo = match db
-        .onboarded_targets()
+        .repositories()
        .find_one(mongodb::bson::doc! { "_id": oid })
        .await
    {
@@ -70,6 +70,7 @@ impl TestServer {
            pentest_imap_password: None,
            admin_api_token: None,
            tenant_registry_url: None,
            unified_pipeline: false,
        };
        let agent = ComplianceAgent::new(config, db_pool);
@@ -113,16 +113,15 @@ async fn delete_repo_cascades_to_dast_and_pentest_data() {
    // Create a repo
    let resp = server
        .post(
-            "/api/v1/targets",
+            "/api/v1/repositories",
            &json!({
                "name": "cascade-test",
-                "target_type": "web_app",
+                "git_url": "https://github.com/example/cascade-test.git",
                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/cascade-test.git", "branch": "main" }],
            }),
        )
        .await;
    let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+    let repo_id = body["data"]["id"].as_str().unwrap().to_string();
    // Insert DAST target linked to repo
    let target_id = insert_dast_target(&server, &repo_id, "cascade-target").await;
@@ -141,7 +140,9 @@ async fn delete_repo_cascades_to_dast_and_pentest_data() {
    assert_eq!(count_docs(&server, "dast_findings").await, 1);
    // Delete the repo
-    let resp = server.delete(&format!("/api/v1/targets/{repo_id}")).await;
+    let resp = server
        .delete(&format!("/api/v1/repositories/{repo_id}"))
        .await;
    assert_eq!(resp.status(), 200);
    // All downstream data should be gone
@@ -160,16 +161,15 @@ async fn delete_repo_cascades_sast_findings_and_sbom() {
    // Create a repo
    let resp = server
        .post(
-            "/api/v1/targets",
+            "/api/v1/repositories",
            &json!({
                "name": "sast-cascade",
-                "target_type": "web_app",
+                "git_url": "https://github.com/example/sast-cascade.git",
                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/sast-cascade.git", "branch": "main" }],
            }),
        )
        .await;
    let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+    let repo_id = body["data"]["id"].as_str().unwrap().to_string();
    // Insert SAST finding and SBOM entry
    let mongodb_uri = std::env::var("TEST_MONGODB_URI")
@@ -209,7 +209,9 @@ async fn delete_repo_cascades_sast_findings_and_sbom() {
    assert_eq!(count_docs(&server, "sbom_entries").await, 1);
    // Delete repo
-    server.delete(&format!("/api/v1/targets/{repo_id}")).await;
+    server
        .delete(&format!("/api/v1/repositories/{repo_id}"))
        .await;
    // Both should be gone
    assert_eq!(count_docs(&server, "findings").await, 0);
@@ -3,4 +3,5 @@ mod dast;
 mod findings;
 mod health;
 mod onboarding;
 mod repositories;
 mod stats;
@@ -0,0 +1,110 @@
 use crate::common::TestServer;
 use serde_json::json;
 #[tokio::test]
 async fn add_and_list_repository() {
    let server = TestServer::start().await;
    // Initially empty
    let resp = server.get("/api/v1/repositories").await;
    assert_eq!(resp.status(), 200);
    let body: serde_json::Value = resp.json().await.unwrap();
    assert_eq!(body["data"].as_array().unwrap().len(), 0);
    // Add a repository
    let resp = server
        .post(
            "/api/v1/repositories",
            &json!({
                "name": "test-repo",
                "git_url": "https://github.com/example/test-repo.git",
            }),
        )
        .await;
    assert_eq!(resp.status(), 200);
    let body: serde_json::Value = resp.json().await.unwrap();
    let repo_id = body["data"]["id"].as_str().unwrap().to_string();
    assert!(!repo_id.is_empty());
    // List should now return 1
    let resp = server.get("/api/v1/repositories").await;
    let body: serde_json::Value = resp.json().await.unwrap();
    let repos = body["data"].as_array().unwrap();
    assert_eq!(repos.len(), 1);
    assert_eq!(repos[0]["name"], "test-repo");
    server.cleanup().await;
 }
 #[tokio::test]
 async fn add_duplicate_repository_fails() {
    let server = TestServer::start().await;
    let payload = json!({
        "name": "dup-repo",
        "git_url": "https://github.com/example/dup-repo.git",
    });
    // First add succeeds
    let resp = server.post("/api/v1/repositories", &payload).await;
    assert_eq!(resp.status(), 200);
    // Second add with same git_url should fail (unique index)
    let resp = server.post("/api/v1/repositories", &payload).await;
    assert_ne!(resp.status(), 200);
    server.cleanup().await;
 }
 #[tokio::test]
 async fn delete_repository() {
    let server = TestServer::start().await;
    // Add a repo
    let resp = server
        .post(
            "/api/v1/repositories",
            &json!({
                "name": "to-delete",
                "git_url": "https://github.com/example/to-delete.git",
            }),
        )
        .await;
    let body: serde_json::Value = resp.json().await.unwrap();
    let repo_id = body["data"]["id"].as_str().unwrap();
    // Delete it
    let resp = server
        .delete(&format!("/api/v1/repositories/{repo_id}"))
        .await;
    assert_eq!(resp.status(), 200);
    // List should be empty again
    let resp = server.get("/api/v1/repositories").await;
    let body: serde_json::Value = resp.json().await.unwrap();
    assert_eq!(body["data"].as_array().unwrap().len(), 0);
    server.cleanup().await;
 }
 #[tokio::test]
 async fn delete_nonexistent_repository_returns_404() {
    let server = TestServer::start().await;
    let resp = server
        .delete("/api/v1/repositories/000000000000000000000000")
        .await;
    assert_eq!(resp.status(), 404);
    server.cleanup().await;
 }
 #[tokio::test]
 async fn delete_invalid_id_returns_400() {
    let server = TestServer::start().await;
    let resp = server.delete("/api/v1/repositories/not-a-valid-id").await;
    assert_eq!(resp.status(), 400);
    server.cleanup().await;
 }
@@ -5,14 +5,13 @@ use serde_json::json;
 async fn stats_overview_reflects_inserted_data() {
    let server = TestServer::start().await;
-    // Add a target
+    // Add a repo
    server
        .post(
-            "/api/v1/targets",
+            "/api/v1/repositories",
            &json!({
                "name": "stats-repo",
-                "target_type": "web_app",
+                "git_url": "https://github.com/example/stats-repo.git",
                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/stats-repo.git", "branch": "main" }],
            }),
        )
        .await;
@@ -0,0 +1,156 @@
 // Integration tests for the onboarding backfill migration.
 //
 // Requires MongoDB (set TEST_MONGODB_URI if not at the default).
 // Not run in CI (which is `--lib` only) — run locally:
 //   cargo test -p compliance-agent --test e2e migration
 use compliance_agent::database::{Database, DatabasePool};
 use compliance_agent::migrate::onboarding;
 use compliance_core::models::{
    ArtifactKind, DastTarget, DastTargetType, TargetType, TrackedRepository,
 };
 use mongodb::bson::{doc, Document};
 async fn fresh_db() -> (DatabasePool, String, Database) {
    let uri = std::env::var("TEST_MONGODB_URI")
        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
    // Prefix must fit the pool's 30-char cap (`<prefix>_<32 hex>` <= 63).
    let prefix = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
    let pool = DatabasePool::connect(&uri, &prefix)
        .await
        .expect("connect mongo");
    let db = pool.for_tenant_id("t1").await.expect("tenant db");
    (pool, prefix, db)
 }
 async fn cleanup(pool: &DatabasePool, prefix: &str) {
    if let Ok(names) = pool.client().list_database_names().await {
        for n in names {
            if n.starts_with(prefix) {
                pool.client().database(&n).drop().await.ok();
            }
        }
    }
 }
 #[tokio::test]
 async fn backfill_folds_relinks_is_idempotent_and_reversible() {
    let (pool, prefix, db) = fresh_db().await;
    // Seed a repo.
    let repo = TrackedRepository::new("acme".into(), "https://git/acme.git".into());
    let repo_id = db
        .repositories()
        .insert_one(repo)
        .await
        .expect("insert repo")
        .inserted_id
        .as_object_id()
        .expect("repo oid");
    // A DAST target linked to the repo (folds + promotes to WebApp + relinks).
    let mut linked = DastTarget::new(
        "acme-web".into(),
        "https://acme.example.com".into(),
        DastTargetType::WebApp,
    );
    linked.repo_id = Some(repo_id.to_hex());
    let linked_id = db
        .dast_targets()
        .insert_one(linked)
        .await
        .expect("insert linked dast")
        .inserted_id
        .as_object_id()
        .expect("linked oid");
    // A repo-less DAST target (standalone).
    let standalone = DastTarget::new(
        "acme-api".into(),
        "https://api.acme.com".into(),
        DastTargetType::RestApi,
    );
    let standalone_id = db
        .dast_targets()
        .insert_one(standalone)
        .await
        .expect("insert standalone dast")
        .inserted_id
        .as_object_id()
        .expect("standalone oid");
    // A DAST scan run pointing at the linked target — should be relinked to the repo.
    db.collection_named::<Document>("dast_scan_runs")
        .insert_one(doc! { "target_id": linked_id.to_hex(), "status": "completed" })
        .await
        .expect("insert dast run");
    // --- Backfill ---
    assert!(!onboarding::already_applied(&db).await.unwrap());
    let report = onboarding::backfill_onboarded_targets(&db, false)
        .await
        .expect("backfill");
    assert_eq!(report.repos_migrated, 1);
    assert_eq!(report.dast_targets_folded, 1);
    assert_eq!(report.dast_targets_standalone, 1);
    assert!(onboarding::already_applied(&db).await.unwrap());
    // Repo target: preserved _id, has git + folded live-url, promoted to WebApp.
    let repo_target = db
        .onboarded_targets()
        .find_one(doc! { "_id": repo_id })
        .await
        .unwrap()
        .expect("repo target");
    assert!(repo_target.has(ArtifactKind::GitRepo));
    assert!(repo_target.has(ArtifactKind::LiveUrl));
    assert_eq!(repo_target.target_type, TargetType::WebApp);
    // Standalone target: preserved _id, live-url, backend service.
    let standalone_target = db
        .onboarded_targets()
        .find_one(doc! { "_id": standalone_id })
        .await
        .unwrap()
        .expect("standalone target");
    assert!(standalone_target.has(ArtifactKind::LiveUrl));
    assert_eq!(standalone_target.target_type, TargetType::BackendService);
    // The DAST run was relinked from the old dast id to the repo (unified) id.
    let run = db
        .collection_named::<Document>("dast_scan_runs")
        .find_one(doc! {})
        .await
        .unwrap()
        .expect("run");
    assert_eq!(run.get_str("target_id").unwrap(), repo_id.to_hex());
    // --- Idempotent: re-run migrates nothing new ---
    let again = onboarding::backfill_onboarded_targets(&db, false)
        .await
        .expect("backfill again");
    assert_eq!(again.repos_migrated, 0);
    assert_eq!(again.dast_targets_folded, 0);
    assert_eq!(again.dast_targets_standalone, 0);
    assert!(again.skipped_existing >= 2);
    // --- Revert: onboarded targets gone, relink undone, marker cleared ---
    onboarding::revert(&db).await.expect("revert");
    assert_eq!(
        db.onboarded_targets()
            .count_documents(doc! {})
            .await
            .unwrap(),
        0
    );
    let run_after = db
        .collection_named::<Document>("dast_scan_runs")
        .find_one(doc! {})
        .await
        .unwrap()
        .expect("run");
    assert_eq!(run_after.get_str("target_id").unwrap(), linked_id.to_hex());
    assert!(!onboarding::already_applied(&db).await.unwrap());
    cleanup(&pool, &prefix).await;
 }
@@ -7,3 +7,4 @@
 // Or nightly: (via CI with MongoDB service container)
 mod api;
 mod migration;
@@ -11,7 +11,7 @@
 #![allow(clippy::expect_used, clippy::unwrap_used)]
 use compliance_agent::database::DatabasePool;
-use compliance_core::models::{Artifact, OnboardedTarget, TargetType};
+use compliance_core::models::TrackedRepository;
 use compliance_core::{OrgRole, TenantContext, TenantStatus};
 use mongodb::bson::doc;
@@ -28,12 +28,27 @@ fn ctx(tenant_id: &str, slug: &str) -> TenantContext {
    }
 }
-fn fixture_repo(name: &str, git_url: &str) -> OnboardedTarget {
+fn fixture_repo(name: &str, git_url: &str) -> TrackedRepository {
-    let mut target = OnboardedTarget::new(name.to_string(), TargetType::WebApp);
+    TrackedRepository {
-    target
+        id: None,
-        .artifacts
+        name: name.to_string(),
-        .push(Artifact::git_repo(git_url.to_string(), "main".to_string()));
+        git_url: git_url.to_string(),
-    target
+        default_branch: "main".to_string(),
        local_path: None,
        scan_schedule: None,
        webhook_enabled: false,
        webhook_secret: None,
        tracker_type: None,
        tracker_owner: None,
        tracker_repo: None,
        tracker_token: None,
        auth_token: None,
        auth_username: None,
        last_scanned_commit: None,
        findings_count: 0,
        created_at: chrono::Utc::now(),
        updated_at: chrono::Utc::now(),
    }
 }
 #[tokio::test]
@@ -56,12 +71,12 @@ async fn pool_isolates_tenants_at_driver_level() {
    // Write distinct repos into each tenant's database.
    acme_db
-        .onboarded_targets()
+        .repositories()
        .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
        .await
        .expect("insert acme");
    globex_db
-        .onboarded_targets()
+        .repositories()
        .insert_one(fixture_repo(
            "globex-platform",
            "git@example.com:globex/platform.git",
@@ -158,12 +173,12 @@ async fn admin_helpers_list_and_drop_tenant_dbs() {
    let acme_db = pool.for_tenant(&acme).await.expect("acme db");
    let globex_db = pool.for_tenant(&globex).await.expect("globex db");
    acme_db
-        .onboarded_targets()
+        .repositories()
        .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
        .await
        .expect("insert acme");
    globex_db
-        .onboarded_targets()
+        .repositories()
        .insert_one(fixture_repo("globex-app", "git@example.com:globex/app.git"))
        .await
        .expect("insert globex");
@@ -269,9 +284,9 @@ fn short_id() -> String {
 }
 /// Drain a `repositories` find cursor on the given tenant database.
-async fn collect(db: &compliance_agent::database::Database) -> Vec<OnboardedTarget> {
+async fn collect(db: &compliance_agent::database::Database) -> Vec<TrackedRepository> {
    let mut cursor = db
-        .onboarded_targets()
+        .repositories()
        .find(doc! {})
        .await
        .expect("find repositories");
@@ -49,6 +49,11 @@ pub struct AgentConfig {
    /// of tenants to iterate. When `None` or unreachable, scheduler
    /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
    pub tenant_registry_url: Option<String>,
    /// When true, `run_scan` dispatches to the unified `run_target` pipeline
    /// (reads `onboarded_targets`) instead of the legacy repository pipeline.
    /// Env `UNIFIED_PIPELINE`. Defaults on; set `UNIFIED_PIPELINE=0` to use the
    /// legacy repository pipeline.
    pub unified_pipeline: bool,
 }
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -44,6 +44,6 @@ pub use pentest::{
    PentestStatus, PentestStrategy, SeverityDistribution, TestUserRecord, TesterInfo,
    ToolCallRecord,
 };
-pub use repository::ScanTrigger;
+pub use repository::{ScanTrigger, TrackedRepository};
 pub use sbom::{SbomEntry, VulnRef};
 pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};
@@ -202,9 +202,6 @@ pub enum PlcFormat {
    PlcopenXml,
    /// IEC 61131-3 Structured Text source.
    StructuredText,
    /// A CODESYS project archive (`.projectarchive` — a zip bundling the project
    /// plus its referenced libraries and runtime; the source of the control-app SBOM).
    ProjectArchive,
 }
 /// PLC-specific configuration for a [`ArtifactKind::PlcProject`] artifact.
@@ -1,6 +1,8 @@
-use serde::{Deserialize, Serialize};
+use chrono::{DateTime, Utc};
 use serde::{Deserialize, Deserializer, Serialize};
 use super::issue::TrackerType;
 /// What initiated a scan.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum ScanTrigger {
@@ -8,3 +10,92 @@ pub enum ScanTrigger {
    Webhook,
    Manual,
 }
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TrackedRepository {
    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
    pub id: Option<bson::oid::ObjectId>,
    #[serde(default)]
    pub name: String,
    #[serde(default)]
    pub git_url: String,
    #[serde(default = "default_branch")]
    pub default_branch: String,
    pub local_path: Option<String>,
    pub scan_schedule: Option<String>,
    #[serde(default)]
    pub webhook_enabled: bool,
    /// Auto-generated HMAC secret for verifying incoming webhooks
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub webhook_secret: Option<String>,
    pub tracker_type: Option<TrackerType>,
    pub tracker_owner: Option<String>,
    pub tracker_repo: Option<String>,
    /// Optional per-repo PAT for the issue tracker (GitHub/GitLab/Jira)
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tracker_token: Option<String>,
    /// Optional auth token for HTTPS private repos (PAT or password)
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth_token: Option<String>,
    /// Optional username for HTTPS auth (defaults to "x-access-token" for PATs)
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth_username: Option<String>,
    pub last_scanned_commit: Option<String>,
    #[serde(default, deserialize_with = "deserialize_findings_count")]
    pub findings_count: u32,
    #[serde(
        default = "chrono::Utc::now",
        with = "super::serde_helpers::bson_datetime"
    )]
    pub created_at: DateTime<Utc>,
    #[serde(
        default = "chrono::Utc::now",
        with = "super::serde_helpers::bson_datetime"
    )]
    pub updated_at: DateTime<Utc>,
 }
 fn default_branch() -> String {
    "main".to_string()
 }
 fn deserialize_findings_count<'de, D>(deserializer: D) -> Result<u32, D::Error>
 where
    D: Deserializer<'de>,
 {
    let bson = bson::Bson::deserialize(deserializer)?;
    match &bson {
        bson::Bson::Int32(n) => Ok(*n as u32),
        bson::Bson::Int64(n) => Ok(*n as u32),
        bson::Bson::Double(n) => Ok(*n as u32),
        _ => Ok(0),
    }
 }
 impl TrackedRepository {
    pub fn new(name: String, git_url: String) -> Self {
        let now = Utc::now();
        // Generate a random webhook secret (hex-encoded UUID v4, no dashes)
        let webhook_secret = uuid::Uuid::new_v4().to_string().replace('-', "");
        Self {
            id: None,
            name,
            git_url,
            default_branch: "main".to_string(),
            local_path: None,
            scan_schedule: None,
            auth_token: None,
            auth_username: None,
            webhook_enabled: false,
            webhook_secret: Some(webhook_secret),
            tracker_type: None,
            tracker_owner: None,
            tracker_repo: None,
            tracker_token: None,
            last_scanned_commit: None,
            findings_count: 0,
            created_at: now,
            updated_at: now,
        }
    }
 }
@@ -24,9 +24,6 @@ pub enum ScanType {
    MobileStatic,
    /// Static analysis of a container image.
    ContainerScan,
    /// Dynamic probing of a running PLC/SPS device over industrial protocols
    /// (Modbus/TCP, OPC UA, …) for exposed/unauthenticated control access.
    IcsProbe,
 }
 impl std::fmt::Display for ScanType {
@@ -46,7 +43,6 @@ impl std::fmt::Display for ScanType {
            Self::PlcControlLogic => write!(f, "plc_control_logic"),
            Self::MobileStatic => write!(f, "mobile_static"),
            Self::ContainerScan => write!(f, "container_scan"),
            Self::IcsProbe => write!(f, "ics_probe"),
        }
    }
 }
@@ -80,7 +76,6 @@ pub enum ScanPhase {
    LlmTriage,
    IssueCreation,
    DastScanning,
    IcsProbe,
    Completed,
 }
@@ -14,12 +14,8 @@ use crate::models::{ArtifactKind, OnboardedTarget, ScanType, TargetType};
 pub enum ArtifactRequirement {
    /// Source code — a git repo or a source archive.
    Code,
-    /// A reachable running instance (any live URL / endpoint, scheme-agnostic —
+    /// A reachable running instance (live URL / endpoint).
    /// e.g. the ICS probe works off the host:port of a modbus:// or http:// ref).
    RunningUrl,
    /// A reachable **web** endpoint — a live URL with an http(s) scheme. DAST is
    /// an HTTP crawler, so a modbus:// / opc.tcp:// endpoint does not satisfy it.
    HttpUrl,
    /// A firmware image / binary blob.
    Firmware,
    /// A PLC project (PLCopen XML or Structured Text).
@@ -138,7 +134,7 @@ fn sast_umbrella() -> Vec<ScanRule> {
 /// The rule set for a target type. Scans that are never applicable to a type are
 /// simply absent (e.g. DAST is not listed for a PLC target).
 pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
-    use ArtifactRequirement::{Firmware, HttpUrl, Mobile, Plc, RunningUrl};
+    use ArtifactRequirement::{Firmware, Mobile, Plc, RunningUrl};
    match target_type {
        TargetType::WebApp | TargetType::BackendService => {
            let mut r = sast_umbrella();
@@ -146,7 +142,7 @@ pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
                ScanType::Dast,
                true,
                "Dynamic scan of the running endpoint",
-                HttpUrl,
+                RunningUrl,
            ));
            r
        }
@@ -207,62 +203,16 @@ pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
                ScanType::Dast,
                false,
                "Dynamic scan of exposed network services (if any)",
-                HttpUrl,
+                RunningUrl,
            ));
            r
        }
-        TargetType::PlcSps => {
+        TargetType::PlcSps => vec![ScanRule::new(
            // A PLC/SPS device is a composite: the control application *and* the
            // device it runs on (firmware/OS + reachable runtime services). The
            // control-logic scan runs on the PLC project; the firmware and DAST
            // scans light up only when a firmware image / running endpoint is
            // attached (e.g. a CODESYS runtime on a Yocto image with WebVisu).
            // Firmware-image SBOM/CVE *execution* is shared with the firmware
            // families and tracked in #151/#128; DAST over a WebVisu/OPC-UA
            // endpoint uses the existing DAST path.
            vec![
                ScanRule::new(
            ScanType::PlcControlLogic,
            true,
            "Control-logic security rules over the PLC program",
            Plc,
-                ),
+        )],
                // Device-level scans are offered but opt-in (default-off): they
                // apply only when a firmware image is attached, and firmware-image
                // SBOM/CVE *execution* is shared with the firmware families and
                // still landing (#151/#128), so they must not silently auto-run.
                ScanRule::new(
                    ScanType::FirmwareStatic,
                    false,
                    "Static analysis of the device firmware image (OS + runtime)",
                    Firmware,
                ),
                ScanRule::new(
                    ScanType::Sbom,
                    false,
                    "SBOM from the device firmware image (OS packages + CODESYS runtime)",
                    Firmware,
                ),
                ScanRule::new(
                    ScanType::Cve,
                    false,
                    "Match device firmware components against known CVEs",
                    Firmware,
                ),
                ScanRule::new(
                    ScanType::Dast,
                    false,
                    "Dynamic scan of the running device (WebVisu / exposed services)",
                    HttpUrl,
                ),
                ScanRule::new(
                    ScanType::IcsProbe,
                    false,
                    "Probe the running device over industrial protocols (Modbus/TCP, …)",
                    RunningUrl,
                ),
            ]
        }
    }
 }
@@ -279,9 +229,6 @@ pub fn supports_pentest(target_type: TargetType) -> bool {
            | TargetType::AndroidApp
            | TargetType::IosApp
            | TargetType::EmbeddedLinuxYocto
            // A PLC/SPS device exposes reachable runtime services (WebVisu, OPC UA,
            // the CODESYS programming protocol), so an active pentest applies.
            | TargetType::PlcSps
    )
 }
@@ -289,9 +236,7 @@ pub fn supports_pentest(target_type: TargetType) -> bool {
 fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
    match req {
        ArtifactRequirement::Code => Some(ArtifactKind::GitRepo),
-        ArtifactRequirement::RunningUrl | ArtifactRequirement::HttpUrl => {
+        ArtifactRequirement::RunningUrl => Some(ArtifactKind::LiveUrl),
            Some(ArtifactKind::LiveUrl)
        }
        ArtifactRequirement::Firmware => Some(ArtifactKind::FirmwareImage),
        ArtifactRequirement::Plc => Some(ArtifactKind::PlcProject),
        ArtifactRequirement::Mobile => Some(ArtifactKind::MobilePackage),
@@ -300,29 +245,13 @@ fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
    }
 }
 /// Whether a live-URL reference is an http(s) web endpoint (vs. an industrial
 /// endpoint like `modbus://` / `opc.tcp://`, which DAST cannot crawl).
 fn is_http_url(source_ref: &str) -> bool {
    let s = source_ref.trim();
    s.starts_with("http://") || s.starts_with("https://")
 }
 /// Whether the target carries an artifact that satisfies the requirement.
 fn requirement_satisfied(req: ArtifactRequirement, target: &OnboardedTarget) -> bool {
    match req {
        ArtifactRequirement::Code => target.code_artifact().is_some(),
        ArtifactRequirement::RunningUrl => target.has(ArtifactKind::LiveUrl),
        ArtifactRequirement::HttpUrl => target
            .artifacts
            .iter()
            .any(|a| a.kind == ArtifactKind::LiveUrl && is_http_url(&a.source_ref)),
        ArtifactRequirement::Firmware => target.has(ArtifactKind::FirmwareImage),
-        // A PLC project artifact, or a code artifact (git repo / source archive)
+        ArtifactRequirement::Plc => target.has(ArtifactKind::PlcProject),
        // holding the control logic as PLCopen XML / ST exports — the common way
        // CODESYS projects are version-controlled.
        ArtifactRequirement::Plc => {
            target.has(ArtifactKind::PlcProject) || target.code_artifact().is_some()
        }
        ArtifactRequirement::Mobile => target.has(ArtifactKind::MobilePackage),
        ArtifactRequirement::Container => target.has(ArtifactKind::ContainerImage),
        ArtifactRequirement::Any => true,
@@ -339,10 +268,6 @@ pub fn applicable_scans(target: &OnboardedTarget) -> Vec<ScanOption> {
            let required_artifact = representative_kind(rule.requires);
            let blocked_reason = if satisfied {
                None
            } else if rule.requires == ArtifactRequirement::HttpUrl {
                // A live URL may be present but non-HTTP (e.g. modbus://): be
                // specific so the user knows DAST needs a web endpoint.
                Some("no http(s) live URL — DAST needs a web endpoint".to_string())
            } else {
                Some(match required_artifact {
                    Some(kind) => format!("no {kind} artifact provided"),
@@ -415,124 +340,22 @@ mod tests {
    }
    #[test]
-    fn plc_control_logic_is_default_on_and_device_scans_block_without_artifacts() {
+    fn plc_offers_only_control_logic() {
        // A PLC project alone: control-logic runs; the device-level scans are
        // offered but blocked until a firmware image / running endpoint is added.
        let t = target_with(
            TargetType::PlcSps,
            vec![Artifact::plc_project("p.xml", PlcFormat::PlcopenXml)],
        );
        let opts = applicable_scans(&t);
-        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
+        assert_eq!(opts.len(), 1);
-        assert!(plc.default_on && plc.blocked_reason.is_none());
+        assert_eq!(opts[0].scan, ScanType::PlcControlLogic);
-        for scan in [ScanType::FirmwareStatic, ScanType::Sbom, ScanType::Cve] {
+        assert!(opts[0].default_on);
            let o = option(&opts, scan).expect("device scan offered");
            assert!(
                !o.default_on,
                "{scan} must not pre-select without a firmware image"
            );
            assert!(o.blocked_reason.is_some());
        }
        let dast = option(&opts, ScanType::Dast).expect("dast offered");
        assert!(!dast.default_on);
        assert!(dast.blocked_reason.is_some());
    }
    #[test]
    fn plc_control_logic_is_satisfied_by_a_git_repo() {
        // A CODESYS project version-controlled in git (PLCopen XML / ST exports),
        // no uploaded PlcProject artifact.
        let t = target_with(TargetType::PlcSps, vec![Artifact::git_repo("u", "main")]);
        let opts = applicable_scans(&t);
        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
        assert!(
            plc.default_on && plc.blocked_reason.is_none(),
            "a git repo should satisfy PLC control-logic"
        );
    }
    #[test]
    fn plc_composite_lights_up_device_scans_with_firmware_and_url() {
        // A CODESYS-on-Yocto device: PLC project + firmware image + WebVisu URL.
        let t = target_with(
            TargetType::PlcSps,
            vec![
                Artifact::plc_project("p.xml", PlcFormat::PlcopenXml),
                Artifact::firmware_image("device.img"),
                Artifact::live_url("http://plc.local/webvisu"),
            ],
        );
        let opts = applicable_scans(&t);
        for scan in [
            ScanType::PlcControlLogic,
            ScanType::FirmwareStatic,
            ScanType::Sbom,
            ScanType::Cve,
        ] {
            let o = option(&opts, scan).expect("scan offered");
            assert!(o.blocked_reason.is_none(), "{scan} should be unblocked");
        }
        // Control-logic auto-runs; the device-level scans are unblocked but opt-in
        // (default-off) until firmware-image execution lands (#151/#128).
        assert!(option(&opts, ScanType::PlcControlLogic).unwrap().default_on);
        assert!(!option(&opts, ScanType::Sbom).unwrap().default_on);
        assert!(!option(&opts, ScanType::Dast).unwrap().default_on);
        assert!(option(&opts, ScanType::Dast)
            .unwrap()
            .blocked_reason
            .is_none());
    }
    #[test]
    fn plc_with_modbus_url_offers_ics_probe_but_blocks_dast() {
        // A soft-PLC reachable only over Modbus/TCP (no WebVisu). The ICS probe
        // is applicable (it works off host:port), but DAST — an HTTP crawler —
        // must be blocked so it isn't offered/run against a non-web endpoint.
        let t = target_with(
            TargetType::PlcSps,
            vec![Artifact::live_url("modbus://plc-sim:502")],
        );
        let opts = applicable_scans(&t);
        let ics = option(&opts, ScanType::IcsProbe).expect("ics probe offered");
        assert!(
            ics.blocked_reason.is_none(),
            "ICS probe should be unblocked for a modbus:// endpoint"
        );
        assert!(!ics.default_on, "ICS probe stays opt-in (default-off)");
        let dast = option(&opts, ScanType::Dast).expect("dast listed");
        assert!(
            dast.blocked_reason.is_some(),
            "DAST must be blocked without an http(s) endpoint"
        );
        assert!(!dast.default_on);
    }
    #[test]
    fn plc_with_http_webvisu_offers_both_dast_and_ics_probe() {
        // A PLC exposing a WebVisu over HTTP: both DAST (web) and the ICS probe
        // (OT ports on the same host) are applicable.
        let t = target_with(
            TargetType::PlcSps,
            vec![Artifact::live_url("http://plc.local/webvisu")],
        );
        let opts = applicable_scans(&t);
        assert!(option(&opts, ScanType::Dast)
            .expect("dast offered")
            .blocked_reason
            .is_none());
        assert!(option(&opts, ScanType::IcsProbe)
            .expect("ics probe offered")
            .blocked_reason
            .is_none());
    }
    #[test]
    fn pentest_support_matches_reachable_families() {
        assert!(supports_pentest(TargetType::WebApp));
        assert!(supports_pentest(TargetType::BackendService));
-        assert!(supports_pentest(TargetType::EmbeddedLinuxYocto));
+        assert!(!supports_pentest(TargetType::PlcSps));
        // A PLC/SPS device is network-reachable (WebVisu / OPC UA / 11740).
        assert!(supports_pentest(TargetType::PlcSps));
        assert!(!supports_pentest(TargetType::FirmwareBareMetal));
        assert!(!supports_pentest(TargetType::DesktopApp));
    }
@@ -10,6 +10,8 @@ pub enum Route {
    #[layout(AppShell)]
        #[route("/")]
        OverviewPage {},
        #[route("/repositories")]
        RepositoriesPage {},
        #[route("/targets")]
        TargetsPage {},
        #[route("/onboard")]
@@ -4,9 +4,8 @@ use dioxus_free_icons::Icon;
 use crate::app::Route;
 use crate::infrastructure::dast::fetch_dast_targets;
 use crate::infrastructure::onboarding::fetch_targets;
 use crate::infrastructure::pentest::{create_pentest_session_wizard, lookup_repo_by_url};
-use crate::infrastructure::repositories::fetch_ssh_public_key;
+use crate::infrastructure::repositories::{fetch_repositories, fetch_ssh_public_key};
 const DISCLAIMER_TEXT: &str = "I confirm that I have authorization to perform security testing \
 against the specified target. I understand that penetration testing may cause disruption to the \
@@ -40,7 +39,7 @@ pub fn PentestWizard(show: Signal<bool>) -> Element {
    let mut show_target_dropdown = use_signal(|| false);
    let mut show_repo_dropdown = use_signal(|| false);
    let existing_targets = use_resource(|| async { fetch_dast_targets().await.ok() });
-    let existing_repos = use_resource(|| async { fetch_targets().await.ok() });
+    let existing_repos = use_resource(|| async { fetch_repositories(1).await.ok() });
    // SSH key state for private repos
    let mut ssh_public_key = use_signal(String::new);
@@ -212,25 +211,7 @@ pub fn PentestWizard(show: Signal<bool>) -> Element {
            Some(Some(data)) => data
                .data
                .iter()
-                .filter_map(|t| {
+                .map(|r| (r.git_url.clone(), r.name.clone()))
                    let name = t
                        .get("name")
                        .and_then(|v| v.as_str())
                        .unwrap_or_default()
                        .to_string();
                    let git_url = t
                        .get("artifacts")
                        .and_then(|a| a.as_array())
                        .and_then(|arr| {
                            arr.iter().find(|a| {
                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
                            })
                        })
                        .and_then(|a| a.get("source_ref"))
                        .and_then(|s| s.as_str())?
                        .to_string();
                    Some((git_url, name))
                })
                .collect(),
            _ => Vec::new(),
        }
@@ -19,6 +19,10 @@ impl Database {
        Ok(Self { inner: db })
    }
    pub fn repositories(&self) -> Collection<TrackedRepository> {
        self.inner.collection("repositories")
    }
    pub fn findings(&self) -> Collection<Finding> {
        self.inner.collection("findings")
    }
@@ -39,67 +39,6 @@ pub struct ApplicableScansResponse {
    pub data: ApplicableScansData,
 }
 /// Validate a target name. The name is used as the clone directory downstream,
 /// so it must be a single safe segment (no slashes) and free of stray spaces.
 pub fn validate_target_name(name: &str) -> Option<String> {
    let n = name.trim();
    if n.is_empty() {
        return Some("Enter a name".to_string());
    }
    if name != n {
        return Some("Remove the leading/trailing spaces".to_string());
    }
    if n.contains('/') || n.contains('\\') {
        return Some("No slashes — the name becomes a folder (e.g. stm32f411-blinky)".to_string());
    }
    None
 }
 /// Client-side validation of an artifact reference for its kind. Returns an
 /// error message when the value is obviously wrong for its category, so the
 /// wizard / editor can flag it up front instead of the scan discovering it.
 pub fn validate_artifact_ref(kind: &str, source_ref: &str) -> Option<String> {
    let s = source_ref;
    if s.trim().is_empty() {
        return Some("Cannot be empty".to_string());
    }
    if s != s.trim() {
        return Some("Remove the leading/trailing spaces".to_string());
    }
    let no_space = !s.contains(char::is_whitespace);
    match kind {
        "git_repo" => {
            let looks_git = s.starts_with("https://")
                || s.starts_with("http://")
                || s.starts_with("ssh://")
                || s.starts_with("git://")
                || (s.contains('@') && s.contains(':'));
            (!(looks_git && no_space))
                .then(|| "Enter a git URL — https://…, ssh://…, or git@host:path".to_string())
        }
        "live_url" => {
            // http(s) for web/DAST targets; modbus:// and opc.tcp:// for ICS
            // devices probed by the ICS probe (e.g. modbus://plc:502).
            let ok = (s.starts_with("https://")
                || s.starts_with("http://")
                || s.starts_with("modbus://")
                || s.starts_with("opc.tcp://"))
                && no_space;
            (!ok).then(|| {
                "Enter a URL — https://app.example.com, or modbus://host:502 for a PLC".to_string()
            })
        }
        "container_image" => {
            (!no_space).then(|| "Enter an image ref, e.g. registry/name:tag".to_string())
        }
        "source_archive" | "firmware_image" | "mobile_package" | "plc_project" => {
            (!no_space).then(|| "Enter a path or URL (no spaces)".to_string())
        }
        // plaintext_description (and anything unknown): accept free-form text.
        _ => None,
    }
 }
 /// List onboarded targets.
 #[server]
 pub async fn fetch_targets() -> Result<TargetsResponse, ServerFnError> {
@@ -138,94 +77,6 @@ pub async fn create_target(
        .map_err(|e| ServerFnError::new(e.to_string()))
 }
 /// Upload a file artifact (PLC project, firmware image, source archive, mobile
 /// package) to a target — proxied to the agent as multipart.
 #[server]
 pub async fn upload_target_artifact(
    id: String,
    kind: String,
    plc_format: Option<String>,
    filename: String,
    bytes: Vec<u8>,
 ) -> Result<TargetResponse, ServerFnError> {
    let mut form = reqwest::multipart::Form::new().text("kind", kind).part(
        "file",
        reqwest::multipart::Part::bytes(bytes).file_name(filename),
    );
    if let Some(pf) = plc_format {
        form = form.text("plc_format", pf);
    }
    let resp = super::agent_client::agent_request(
        reqwest::Method::POST,
        &format!("/api/v1/targets/{id}/artifacts/upload"),
    )
    .await?
    .multipart(form)
    .send()
    .await
    .map_err(|e| ServerFnError::new(e.to_string()))?;
    resp.json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))
 }
 /// Update a target's name / type / artifacts (dashboard editor).
 #[server]
 pub async fn update_target(
    id: String,
    name: Option<String>,
    target_type: Option<String>,
    artifacts: Option<Vec<ArtifactInputDto>>,
 ) -> Result<TargetResponse, ServerFnError> {
    let mut body = serde_json::Map::new();
    if let Some(n) = name {
        body.insert("name".to_string(), serde_json::json!(n));
    }
    if let Some(t) = target_type {
        body.insert("target_type".to_string(), serde_json::json!(t));
    }
    if let Some(a) = artifacts {
        body.insert(
            "artifacts".to_string(),
            serde_json::to_value(a).map_err(|e| ServerFnError::new(e.to_string()))?,
        );
    }
    let resp = super::agent_client::agent_request(
        reqwest::Method::PATCH,
        &format!("/api/v1/targets/{id}"),
    )
    .await?
    .json(&serde_json::Value::Object(body))
    .send()
    .await
    .map_err(|e| ServerFnError::new(e.to_string()))?;
    resp.json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))
 }
 /// Enable specific opt-in scans on a target by setting `scan_config.enabled_scans`.
 /// `scans` are serde scan-type names (lowercase, no underscores — e.g. `icsprobe`).
 #[server]
 pub async fn enable_target_scans(
    id: String,
    scans: Vec<String>,
 ) -> Result<TargetResponse, ServerFnError> {
    let body = serde_json::json!({ "scan_config": { "enabled_scans": scans } });
    let resp = super::agent_client::agent_request(
        reqwest::Method::PATCH,
        &format!("/api/v1/targets/{id}"),
    )
    .await?
    .json(&body)
    .send()
    .await
    .map_err(|e| ServerFnError::new(e.to_string()))?;
    resp.json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))
 }
 /// Run kind-based classification on a target.
 #[server]
 pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {
@@ -1,10 +1,145 @@
 //! The agent's SSH deploy public key — shown so a read-only deploy key can be
 //! added to private git targets. (The legacy repositories CRUD moved to the
 //! unified onboarding/targets API.)
 use dioxus::prelude::*;
 use serde::{Deserialize, Serialize};
 use compliance_core::models::TrackedRepository;
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct RepositoryListResponse {
    pub data: Vec<TrackedRepository>,
    pub total: Option<u64>,
    pub page: Option<u64>,
 }
 #[server]
 pub async fn fetch_repositories(page: u64) -> Result<RepositoryListResponse, ServerFnError> {
    let path = format!("/api/v1/repositories?page={page}&limit=20");
    let resp = super::agent_client::agent_get(&path)
        .await?
        .send()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    let body: RepositoryListResponse = resp
        .json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    Ok(body)
 }
 #[server]
 pub async fn add_repository(
    name: String,
    git_url: String,
    default_branch: String,
    auth_token: Option<String>,
    auth_username: Option<String>,
    tracker_type: Option<String>,
    tracker_owner: Option<String>,
    tracker_repo: Option<String>,
    tracker_token: Option<String>,
 ) -> Result<(), ServerFnError> {
    let mut body = serde_json::json!({
        "name": name,
        "git_url": git_url,
        "default_branch": default_branch,
    });
    if let Some(token) = auth_token.filter(|t| !t.is_empty()) {
        body["auth_token"] = serde_json::Value::String(token);
    }
    if let Some(username) = auth_username.filter(|u| !u.is_empty()) {
        body["auth_username"] = serde_json::Value::String(username);
    }
    if let Some(tt) = tracker_type.filter(|t| !t.is_empty()) {
        body["tracker_type"] = serde_json::Value::String(tt);
    }
    if let Some(to) = tracker_owner.filter(|t| !t.is_empty()) {
        body["tracker_owner"] = serde_json::Value::String(to);
    }
    if let Some(tr) = tracker_repo.filter(|t| !t.is_empty()) {
        body["tracker_repo"] = serde_json::Value::String(tr);
    }
    if let Some(tk) = tracker_token.filter(|t| !t.is_empty()) {
        body["tracker_token"] = serde_json::Value::String(tk);
    }
    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/repositories")
        .await?
        .json(&body)
        .send()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    if !resp.status().is_success() {
        let body = resp.text().await.unwrap_or_default();
        return Err(ServerFnError::new(format!(
            "Failed to add repository: {body}"
        )));
    }
    Ok(())
 }
 #[server]
 pub async fn update_repository(
    repo_id: String,
    name: Option<String>,
    default_branch: Option<String>,
    auth_token: Option<String>,
    auth_username: Option<String>,
    tracker_type: Option<String>,
    tracker_owner: Option<String>,
    tracker_repo: Option<String>,
    tracker_token: Option<String>,
    scan_schedule: Option<String>,
 ) -> Result<(), ServerFnError> {
    let mut body = serde_json::Map::new();
    if let Some(v) = name.filter(|s| !s.is_empty()) {
        body.insert("name".into(), serde_json::Value::String(v));
    }
    if let Some(v) = default_branch.filter(|s| !s.is_empty()) {
        body.insert("default_branch".into(), serde_json::Value::String(v));
    }
    if let Some(v) = auth_token {
        body.insert("auth_token".into(), serde_json::Value::String(v));
    }
    if let Some(v) = auth_username {
        body.insert("auth_username".into(), serde_json::Value::String(v));
    }
    if let Some(v) = tracker_type {
        body.insert("tracker_type".into(), serde_json::Value::String(v));
    }
    if let Some(v) = tracker_owner {
        body.insert("tracker_owner".into(), serde_json::Value::String(v));
    }
    if let Some(v) = tracker_repo {
        body.insert("tracker_repo".into(), serde_json::Value::String(v));
    }
    if let Some(v) = tracker_token {
        body.insert("tracker_token".into(), serde_json::Value::String(v));
    }
    if let Some(v) = scan_schedule {
        body.insert("scan_schedule".into(), serde_json::Value::String(v));
    }
    let resp = super::agent_client::agent_request(
        reqwest::Method::PATCH,
        &format!("/api/v1/repositories/{repo_id}"),
    )
    .await?
    .json(&body)
    .send()
    .await
    .map_err(|e| ServerFnError::new(e.to_string()))?;
    if !resp.status().is_success() {
        let text = resp.text().await.unwrap_or_default();
        return Err(ServerFnError::new(format!(
            "Failed to update repository: {text}"
        )));
    }
    Ok(())
 }
 /// Fetch the agent's SSH deploy public key.
 #[server]
 pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
    let resp = super::agent_client::agent_get("/api/v1/settings/ssh-public-key")
@@ -28,3 +163,86 @@ pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
        .unwrap_or("")
        .to_string())
 }
 #[server]
 pub async fn delete_repository(repo_id: String) -> Result<(), ServerFnError> {
    let resp = super::agent_client::agent_request(
        reqwest::Method::DELETE,
        &format!("/api/v1/repositories/{repo_id}"),
    )
    .await?
    .send()
    .await
    .map_err(|e| ServerFnError::new(e.to_string()))?;
    if !resp.status().is_success() {
        let body = resp.text().await.unwrap_or_default();
        return Err(ServerFnError::new(format!(
            "Failed to delete repository: {body}"
        )));
    }
    Ok(())
 }
 #[server]
 pub async fn trigger_repo_scan(repo_id: String) -> Result<(), ServerFnError> {
    super::agent_client::agent_request(
        reqwest::Method::POST,
        &format!("/api/v1/repositories/{repo_id}/scan"),
    )
    .await?
    .send()
    .await
    .map_err(|e| ServerFnError::new(e.to_string()))?;
    Ok(())
 }
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct WebhookConfigResponse {
    pub webhook_secret: Option<String>,
    pub tracker_type: String,
 }
 #[server]
 pub async fn fetch_webhook_config(repo_id: String) -> Result<WebhookConfigResponse, ServerFnError> {
    let resp =
        super::agent_client::agent_get(&format!("/api/v1/repositories/{repo_id}/webhook-config"))
            .await?
            .send()
            .await
            .map_err(|e| ServerFnError::new(e.to_string()))?;
    let body: WebhookConfigResponse = resp
        .json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    Ok(body)
 }
 /// Check if a repository has any running scans
 #[server]
 pub async fn check_repo_scanning(repo_id: String) -> Result<bool, ServerFnError> {
    let resp = super::agent_client::agent_get("/api/v1/scan-runs?page=1&limit=1")
        .await?
        .send()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    let body: serde_json::Value = resp
        .json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    // Check if the most recent scan for this repo is still running
    if let Some(scans) = body.get("data").and_then(|d| d.as_array()) {
        for scan in scans {
            let scan_repo = scan.get("repo_id").and_then(|v| v.as_str()).unwrap_or("");
            let status = scan.get("status").and_then(|v| v.as_str()).unwrap_or("");
            if scan_repo == repo_id && status == "running" {
                return Ok(true);
            }
        }
    }
    Ok(false)
 }
@@ -1,4 +1,3 @@
 use axum::extract::DefaultBodyLimit;
 use axum::routing::{get, post};
 use axum::{middleware, Extension};
 use dioxus::prelude::*;
@@ -67,9 +66,6 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
                // Webhook proxy: forward to agent (no auth required)
                .route("/webhook/{platform}/{repo_id}", post(webhook_proxy))
                .serve_dioxus_application(ServeConfig::new(), app)
                // Allow large artifact uploads through the upload server function
                // (PLC .projectarchive, firmware, mobile) — default is 2 MiB.
                .layer(DefaultBodyLimit::max(512 * 1024 * 1024))
                .layer(Extension(PendingOAuthStore::default()))
                .layer(middleware::from_fn(require_auth))
                .layer(Extension(server_state))
@@ -2,11 +2,11 @@ use dioxus::prelude::*;
 use crate::app::Route;
 use crate::components::page_header::PageHeader;
-use crate::infrastructure::onboarding::fetch_targets;
+use crate::infrastructure::repositories::fetch_repositories;
 #[component]
 pub fn ChatIndexPage() -> Element {
-    let repos = use_resource(|| async { fetch_targets().await.ok() });
+    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
    rsx! {
        PageHeader {
@@ -28,32 +28,10 @@ pub fn ChatIndexPage() -> Element {
                        div { class: "graph-index-grid",
                            for repo in repo_list {
                                {
-                                    let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                    let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-                                    let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                    let name = repo.name.clone();
-                                    let url = repo
+                                    let url = repo.git_url.clone();
-                                        .get("artifacts")
+                                    let branch = repo.default_branch.clone();
                                        .and_then(|a| a.as_array())
                                        .and_then(|arr| {
                                            arr.iter().find(|a| {
                                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
                                            })
                                        })
                                        .and_then(|a| a.get("source_ref"))
                                        .and_then(|s| s.as_str())
                                        .unwrap_or_default()
                                        .to_string();
                                    let branch = repo
                                        .get("artifacts")
                                        .and_then(|a| a.as_array())
                                        .and_then(|arr| {
                                            arr.iter().find_map(|a| {
                                                a.get("git")
                                                    .and_then(|g| g.get("default_branch"))
                                                    .and_then(|b| b.as_str())
                                            })
                                        })
                                        .unwrap_or("main")
                                        .to_string();
                                    rsx! {
                                        Link {
                                            to: Route::ChatPage { repo_id },
@@ -2,11 +2,11 @@ use dioxus::prelude::*;
 use crate::app::Route;
 use crate::components::page_header::PageHeader;
-use crate::infrastructure::onboarding::fetch_targets;
+use crate::infrastructure::repositories::fetch_repositories;
 #[component]
 pub fn GraphIndexPage() -> Element {
-    let repos = use_resource(|| async { fetch_targets().await.ok() });
+    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
    rsx! {
        PageHeader {
@@ -28,34 +28,27 @@ pub fn GraphIndexPage() -> Element {
                        div { class: "graph-index-grid",
                            for repo in repo_list {
                                {
-                                    let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                    let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-                                    let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                    let name = repo.name.clone();
-                                    let url = repo
+                                    let url = repo.git_url.clone();
-                                        .get("artifacts")
+                                    let branch = repo.default_branch.clone();
-                                        .and_then(|a| a.as_array())
+                                    let findings = repo.findings_count;
                                        .and_then(|arr| {
                                            arr.iter().find(|a| {
                                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
                                            })
                                        })
                                        .and_then(|a| a.get("source_ref"))
                                        .and_then(|s| s.as_str())
                                        .unwrap_or_default()
                                        .to_string();
                                    let branch = repo
                                        .get("artifacts")
                                        .and_then(|a| a.as_array())
                                        .and_then(|arr| {
                                            arr.iter().find_map(|a| {
                                                a.get("git")
                                                    .and_then(|g| g.get("default_branch"))
                                                    .and_then(|b| b.as_str())
                                            })
                                        })
                                        .unwrap_or("main")
                                        .to_string();
                                    let findings = repo.get("findings_count").and_then(|n| n.as_u64()).unwrap_or(0);
                                    let findings_label = if findings != 1 { format!("{findings} findings") } else { "1 finding".to_string() };
                                    let updated = {
                                        let now = chrono::Utc::now();
                                        let diff = now.signed_duration_since(repo.updated_at);
                                        if diff.num_minutes() < 1 {
                                            "just now".to_string()
                                        } else if diff.num_hours() < 1 {
                                            format!("{}m ago", diff.num_minutes())
                                        } else if diff.num_days() < 1 {
                                            format!("{}h ago", diff.num_hours())
                                        } else if diff.num_days() < 30 {
                                            format!("{}d ago", diff.num_days())
                                        } else {
                                            repo.updated_at.format("%Y-%m-%d").to_string()
                                        }
                                    };
                                    rsx! {
                                        Link {
                                            to: Route::GraphExplorerPage { repo_id },
@@ -74,6 +67,9 @@ pub fn GraphIndexPage() -> Element {
                                                span { class: "graph-repo-card-tag graph-repo-card-tag-findings",
                                                    "{findings_label}"
                                                }
                                                span { class: "graph-repo-card-tag",
                                                    "Updated {updated}"
                                                }
                                            }
                                        }
                                    }
@@ -16,6 +16,7 @@ pub mod onboarding;
 pub mod overview;
 pub mod pentest_dashboard;
 pub mod pentest_session;
 pub mod repositories;
 pub mod sbom;
 pub mod targets;
@@ -37,5 +38,6 @@ pub use onboarding::OnboardingPage;
 pub use overview::OverviewPage;
 pub use pentest_dashboard::PentestDashboardPage;
 pub use pentest_session::PentestSessionPage;
 pub use repositories::RepositoriesPage;
 pub use sbom::SbomPage;
 pub use targets::TargetsPage;
@@ -2,8 +2,7 @@ use dioxus::prelude::*;
 use crate::components::page_header::PageHeader;
 use crate::infrastructure::onboarding::{
-    create_target, detect_target, enable_target_scans, fetch_applicable_scans, trigger_target_scan,
+    create_target, detect_target, fetch_applicable_scans, trigger_target_scan, ArtifactInputDto,
    upload_target_artifact, validate_artifact_ref, validate_target_name, ArtifactInputDto,
 };
 /// (value, label, one-line description) for the 9 target families.
@@ -41,23 +40,6 @@ const ARTIFACT_KINDS: &[(&str, &str)] = &[
 const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
 /// Artifact kinds provided as an uploaded file (rather than a URL/text ref).
 fn is_file_kind(kind: &str) -> bool {
    matches!(
        kind,
        "plc_project" | "firmware_image" | "source_archive" | "mobile_package"
    )
 }
 /// A file artifact staged in the wizard, uploaded after the target is created.
 #[derive(Clone, PartialEq)]
 struct PendingFile {
    kind: String,
    plc_format: Option<String>,
    filename: String,
    bytes: Vec<u8>,
 }
 /// One row in the applicable-scans list on the success step.
 #[component]
 fn ScanRow(scan: serde_json::Value) -> Element {
@@ -125,10 +107,6 @@ pub fn OnboardingPage() -> Element {
    let mut new_kind = use_signal(|| "git_repo".to_string());
    let mut new_source = use_signal(String::new);
    let mut new_branch = use_signal(|| "main".to_string());
    // File-upload artifacts (PLC project, firmware image, ...).
    let mut new_plc_format = use_signal(|| "plcopen_xml".to_string());
    let mut new_file = use_signal(|| Option::<(String, Vec<u8>)>::None);
    let mut pending_files = use_signal(Vec::<PendingFile>::new);
    // Create + result state.
    let mut creating = use_signal(|| false);
@@ -137,41 +115,10 @@ pub fn OnboardingPage() -> Element {
    let mut suggested = use_signal(|| Option::<String>::None);
    let mut created_id = use_signal(|| Option::<String>::None);
    let mut scan_msg = use_signal(|| Option::<String>::None);
    // Opt-in scans (default-off but unblocked) the user ticks to enable before
    // running — stored as serde scan-type names (lowercase, no underscores).
    let mut enabled_extra = use_signal(Vec::<String>::new);
    let step_now = step();
-    let name_error = validate_target_name(&name());
+    let can_advance_type = !name().trim().is_empty() && !target_type().trim().is_empty();
-    let can_advance_type = name_error.is_none() && !target_type().trim().is_empty();
+    let has_artifacts = !artifacts().is_empty();
    let has_artifacts = !artifacts().is_empty() || !pending_files().is_empty();
    // Opt-in scans: applicable + unblocked, but default-off (e.g. the ICS probe).
    // The user ticks these to enable them before the first run. Each entry is
    // (display name for the label, serde scan-type name for the enable call —
    // lowercase, no underscores, matching ScanType's rename_all = "lowercase").
    let optin_scans: Vec<(String, String)> = scans()
        .iter()
        .filter_map(|s| {
            let unblocked = s.get("blocked_reason").and_then(|v| v.as_str()).is_none();
            let default_on = s
                .get("default_on")
                .and_then(|v| v.as_bool())
                .unwrap_or(false);
            if unblocked && !default_on {
                let display = s.get("scan").and_then(|v| v.as_str())?.to_string();
                let serde_name = display.replace('_', "");
                Some((display, serde_name))
            } else {
                None
            }
        })
        .collect();
    // Live validation of the artifact reference being typed (empty = no error yet).
    let new_source_error = if new_source().is_empty() {
        None
    } else {
        validate_artifact_ref(&new_kind(), &new_source())
    };
    rsx! {
        PageHeader {
@@ -210,11 +157,6 @@ pub fn OnboardingPage() -> Element {
                            value: "{name}",
                            oninput: move |e| name.set(e.value()),
                        }
                        if !name().is_empty() {
                            if let Some(err) = name_error.clone() {
                                div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 4px;", "{err}" }
                            }
                        }
                    }
                    div {
                        style: "display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; margin-top: 12px;",
@@ -238,36 +180,6 @@ pub fn OnboardingPage() -> Element {
            // ---- Step 1: artifacts ----
            if step_now == 1 {
                div { class: "card-header", "Attach artifacts" }
                if target_type() == "plc_sps" {
                    div {
                        style: "margin: 12px 16px 0; padding: 12px 14px; border-left: 3px solid var(--accent, #3b82f6); background: var(--surface-2, rgba(59,130,246,0.08)); font-size: 0.88em; line-height: 1.55;",
                        div { style: "font-weight: 600; margin-bottom: 4px;", "CODESYS / PLC projects" }
                        "Attach a "
                        b { "PLC project" }
                        " (PLCopen XML / ST, or a .projectarchive), or a "
                        b { "Git repository" }
                        " of exported source — every scan is then just a pull."
                        ul { style: "margin: 6px 0 0; padding-left: 18px;",
                            li {
                                b { "Control-logic SAST" }
                                " — commit "
                                b { "PLCopen XML exports" }
                                " (Project → Export PLCopenXML) or raw .st; ST and graphical FBD/LD are both analyzed."
                            }
                            li {
                                b { "Library + runtime SBOM" }
                                " — include the "
                                b { ".projectarchive" }
                                "; PLCopen XML alone carries no libraries."
                            }
                            li {
                                "Avoid committing only the binary "
                                code { ".project" }
                                " — it can't be parsed and doesn't diff."
                            }
                        }
                    }
                }
                div { style: "padding: 16px;",
                    div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
                        div { class: "form-group", style: "margin: 0;",
@@ -280,78 +192,6 @@ pub fn OnboardingPage() -> Element {
                                }
                            }
                        }
                        if is_file_kind(&new_kind()) {
                            div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
                                label { "File" }
                                input {
                                    r#type: "file",
                                    onchange: move |evt| {
                                        let Some(file) = evt.files().into_iter().next() else { return; };
                                        let name = file.name();
                                        // Auto-detect the PLC format from the file extension.
                                        let lname = name.to_ascii_lowercase();
                                        if lname.ends_with(".projectarchive") || lname.ends_with(".project") {
                                            new_plc_format.set("project_archive".to_string());
                                        } else if lname.ends_with(".xml") || lname.ends_with(".plcopen") {
                                            new_plc_format.set("plcopen_xml".to_string());
                                        } else if lname.ends_with(".st") || lname.ends_with(".exp") || lname.ends_with(".scl") {
                                            new_plc_format.set("structured_text".to_string());
                                        }
                                        spawn(async move {
                                            if let Ok(bytes) = file.read_bytes().await {
                                                new_file.set(Some((name, bytes.to_vec())));
                                            }
                                        });
                                    },
                                }
                            }
                            if new_kind() == "plc_project" {
                                div { class: "form-group", style: "margin: 0;",
                                    label { "Format" }
                                    select {
                                        value: "{new_plc_format}",
                                        oninput: move |e| new_plc_format.set(e.value()),
                                        option {
                                            value: "plcopen_xml",
                                            selected: new_plc_format() == "plcopen_xml",
                                            "PLCopen XML",
                                        }
                                        option {
                                            value: "structured_text",
                                            selected: new_plc_format() == "structured_text",
                                            "Structured Text",
                                        }
                                        option {
                                            value: "project_archive",
                                            selected: new_plc_format() == "project_archive",
                                            "Project archive (.projectarchive)",
                                        }
                                    }
                                }
                            }
                            button {
                                class: "btn btn-secondary",
                                disabled: new_file().is_none(),
                                onclick: move |_| {
                                    if let Some((fname, data)) = new_file() {
                                        let kind = new_kind();
                                        let plc_format = if kind == "plc_project" {
                                            Some(new_plc_format())
                                        } else {
                                            None
                                        };
                                        pending_files.write().push(PendingFile {
                                            kind,
                                            plc_format,
                                            filename: fname,
                                            bytes: data,
                                        });
                                        new_file.set(None);
                                    }
                                },
                                "+ Add file"
                            }
                        } else {
                        div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
                            label { "Reference (URL / path / text)" }
                            input {
@@ -373,12 +213,9 @@ pub fn OnboardingPage() -> Element {
                        }
                        button {
                            class: "btn btn-secondary",
                                disabled: new_source().trim().is_empty() || new_source_error.is_some(),
                            onclick: move |_| {
                                let kind = new_kind();
-                                    if !new_source().trim().is_empty()
+                                if !new_source().trim().is_empty() {
                                        && validate_artifact_ref(&kind, &new_source()).is_none()
                                    {
                                    let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
                                    artifacts.write().push(ArtifactInputDto {
                                        kind,
@@ -392,31 +229,6 @@ pub fn OnboardingPage() -> Element {
                            "+ Add"
                        }
                    }
                    }
                    if is_file_kind(&new_kind()) {
                        if let Some((fname, data)) = new_file() {
                            div { style: "font-size: 0.85em; opacity: 0.7; margin-top: 6px;",
                                "Selected: {fname} ({data.len()} bytes)"
                            }
                        }
                    } else if let Some(err) = new_source_error.clone() {
                        div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 6px;", "{err}" }
                    }
                    // Staged file artifacts (uploaded after the target is created).
                    for (i, pf) in pending_files().iter().enumerate() {
                        div {
                            style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-top: 6px;",
                            span {
                                span { style: "opacity: 0.7;", "{kind_label(&pf.kind)} (file): " }
                                "{pf.filename} ({pf.bytes.len()} bytes)"
                            }
                            button {
                                class: "btn btn-ghost-danger btn-sm",
                                onclick: move |_| { pending_files.write().remove(i); },
                                "Remove"
                            }
                        }
                    }
                    div { style: "margin-top: 16px;",
                        if has_artifacts {
@@ -480,39 +292,6 @@ pub fn OnboardingPage() -> Element {
                            ScanRow { scan: s }
                        }
                    }
                    if !optin_scans.is_empty() {
                        div { style: "margin-top: 12px; padding: 10px; border: 1px dashed var(--border, #ccc); border-radius: 6px;",
                            div { style: "font-weight: 600; margin-bottom: 6px;", "Enable opt-in scans" }
                            div { style: "opacity: 0.7; font-size: 0.85em; margin-bottom: 8px;",
                                "These are applicable but off by default (they touch a live device). Tick to enable before running."
                            }
                            for pair in optin_scans.clone() {
                                {
                                    let (display, serde_name) = pair;
                                    let cb_name = serde_name.clone();
                                    rsx! {
                                        label {
                                            style: "display: flex; gap: 6px; align-items: center; margin-top: 4px;",
                                            input {
                                                r#type: "checkbox",
                                                checked: enabled_extra().contains(&serde_name),
                                                onchange: move |_| {
                                                    let mut v = enabled_extra();
                                                    if let Some(p) = v.iter().position(|x| x == &cb_name) {
                                                        v.remove(p);
                                                    } else {
                                                        v.push(cb_name.clone());
                                                    }
                                                    enabled_extra.set(v);
                                                },
                                            }
                                            "Enable {display}"
                                        }
                                    }
                                }
                            }
                        }
                    }
                    if let Some(msg) = scan_msg() {
                        div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
                    }
@@ -521,21 +300,8 @@ pub fn OnboardingPage() -> Element {
                            class: "btn btn-primary",
                            onclick: move |_| {
                                if let Some(id) = created_id() {
                                    let extra = enabled_extra();
                                    scan_msg.set(Some("Scan triggered...".to_string()));
                                    spawn(async move {
                                        // Persist any ticked opt-in scans first, so the
                                        // agent's build_scan_plan includes them this run.
                                        if !extra.is_empty() {
                                            if let Err(e) =
                                                enable_target_scans(id.clone(), extra).await
                                            {
                                                scan_msg.set(Some(format!(
                                                    "Failed to enable opt-in scans: {e}"
                                                )));
                                                return;
                                            }
                                        }
                                        match trigger_target_scan(id).await {
                                            Ok(_) => scan_msg.set(Some(
                                                "Scan started — findings will appear as it runs.".to_string(),
@@ -555,8 +321,6 @@ pub fn OnboardingPage() -> Element {
                                target_type.set(String::new());
                                description.set(String::new());
                                artifacts.write().clear();
                                pending_files.write().clear();
                                new_file.set(None);
                                scans.write().clear();
                                suggested.set(None);
                                created_id.set(None);
@@ -595,7 +359,6 @@ pub fn OnboardingPage() -> Element {
                            let tt = target_type();
                            let desc = description();
                            let arts = artifacts();
                            let files = pending_files();
                            let d = if desc.trim().is_empty() { None } else { Some(desc) };
                            creating.set(true);
                            error.set(None);
@@ -610,23 +373,6 @@ pub fn OnboardingPage() -> Element {
                                            .map(String::from);
                                        if let Some(id) = id {
                                            created_id.set(Some(id.clone()));
                                            // Upload staged file artifacts now that the target exists.
                                            for pf in files {
                                                let fname = pf.filename.clone();
                                                if let Err(e) = upload_target_artifact(
                                                    id.clone(),
                                                    pf.kind,
                                                    pf.plc_format,
                                                    pf.filename,
                                                    pf.bytes,
                                                )
                                                .await
                                                {
                                                    error.set(Some(format!(
                                                        "Upload failed for {fname}: {e}"
                                                    )));
                                                }
                                            }
                                            if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
                                                scans.set(sc.data.scans);
                                            }
@@ -6,7 +6,7 @@ use crate::app::Route;
 use crate::components::page_header::PageHeader;
 use crate::components::stat_card::StatCard;
 use crate::infrastructure::mcp::fetch_mcp_servers;
-use crate::infrastructure::onboarding::fetch_targets;
+use crate::infrastructure::repositories::fetch_repositories;
 #[cfg(feature = "server")]
 use crate::infrastructure::stats::fetch_overview_stats;
@@ -26,7 +26,7 @@ pub fn OverviewPage() -> Element {
        }
    });
-    let repos = use_resource(|| async { fetch_targets().await.ok() });
+    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
    let mcp_servers = use_resource(|| async { fetch_mcp_servers().await.ok() });
    rsx! {
@@ -94,8 +94,8 @@ pub fn OverviewPage() -> Element {
                                        style: "display: grid; grid-template-columns: repeat(3, 1fr); gap: 1rem; padding: 1rem;",
                                        for repo in repo_list {
                                            {
-                                                let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                                let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                                let name = repo.name.clone();
                                                rsx! {
                                                    Link {
                                                        to: Route::ChatPage { repo_id },
@@ -0,0 +1,428 @@
 use dioxus::prelude::*;
 use dioxus_free_icons::icons::bs_icons::*;
 #[allow(unused_imports)]
 use dioxus_free_icons::icons::bs_icons::{BsGear, BsPencil};
 use dioxus_free_icons::Icon;
 use crate::components::page_header::PageHeader;
 use crate::components::pagination::Pagination;
 use crate::components::toast::{ToastType, Toasts};
 use crate::pages::graph_explorer::GraphExplorerInline;
 async fn async_sleep_5s() {
    #[cfg(feature = "web")]
    {
        gloo_timers::future::TimeoutFuture::new(5_000).await;
    }
    #[cfg(not(feature = "web"))]
    {
        tokio::time::sleep(std::time::Duration::from_secs(5)).await;
    }
 }
 #[component]
 pub fn RepositoriesPage() -> Element {
    let mut page = use_signal(|| 1u64);
    let mut toasts = use_context::<Toasts>();
    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None); // (id, name)
    let mut edit_repo_id = use_signal(|| Option::<String>::None);
    let mut edit_name = use_signal(String::new);
    let mut edit_branch = use_signal(String::new);
    let mut edit_tracker_type = use_signal(String::new);
    let mut edit_tracker_owner = use_signal(String::new);
    let mut edit_tracker_repo = use_signal(String::new);
    let mut edit_tracker_token = use_signal(String::new);
    let mut edit_saving = use_signal(|| false);
    let mut edit_webhook_secret = use_signal(|| Option::<String>::None);
    let mut edit_webhook_tracker = use_signal(String::new);
    let mut scanning_ids = use_signal(Vec::<String>::new);
    let mut graph_repo_id = use_signal(|| Option::<String>::None);
    let mut repos = use_resource(move || {
        let p = page();
        async move {
            crate::infrastructure::repositories::fetch_repositories(p)
                .await
                .ok()
        }
    });
    rsx! {
        PageHeader {
            title: "Repositories",
            description: "Legacy git repositories. Onboard new targets from Targets / Onboard.",
        }
        // ── Delete confirmation dialog ──
        if let Some((del_id, del_name)) = confirm_delete() {
            div { class: "modal-overlay",
                div { class: "modal-dialog",
                    h3 { "Delete Repository" }
                    p {
                        "Are you sure you want to delete "
                        strong { "{del_name}" }
                        "?"
                    }
                    p { class: "modal-warning",
                        "This will permanently remove all associated findings, SBOM entries, scan runs, graph data, embeddings, and CVE alerts."
                    }
                    div { class: "modal-actions",
                        button {
                            class: "btn btn-secondary",
                            onclick: move |_| confirm_delete.set(None),
                            "Cancel"
                        }
                        button {
                            class: "btn btn-danger",
                            onclick: move |_| {
                                let id = del_id.clone();
                                let name = del_name.clone();
                                confirm_delete.set(None);
                                spawn(async move {
                                    match crate::infrastructure::repositories::delete_repository(id).await {
                                        Ok(_) => {
                                            toasts.push(ToastType::Success, format!("{name} deleted"));
                                            repos.restart();
                                        }
                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
                                    }
                                });
                            },
                            "Delete"
                        }
                    }
                }
            }
        }
        // ── Edit repository dialog ──
        if let Some(eid) = edit_repo_id() {
            div { class: "modal-overlay",
                div { class: "modal-dialog",
                    h3 { "Edit Repository" }
                    div { class: "form-group",
                        label { "Name" }
                        input {
                            r#type: "text",
                            value: "{edit_name}",
                            oninput: move |e| edit_name.set(e.value()),
                        }
                    }
                    div { class: "form-group",
                        label { "Default Branch" }
                        input {
                            r#type: "text",
                            value: "{edit_branch}",
                            oninput: move |e| edit_branch.set(e.value()),
                        }
                    }
                    h4 { style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);", "Issue Tracker" }
                    div { class: "form-group",
                        label { "Tracker Type" }
                        select {
                            value: "{edit_tracker_type}",
                            onchange: move |e| edit_tracker_type.set(e.value()),
                            option { value: "", "None" }
                            option { value: "github", "GitHub" }
                            option { value: "gitlab", "GitLab" }
                            option { value: "gitea", "Gitea" }
                            option { value: "jira", "Jira" }
                        }
                    }
                    div { class: "form-group",
                        label { "Owner / Namespace" }
                        input {
                            r#type: "text",
                            placeholder: "org-name",
                            value: "{edit_tracker_owner}",
                            oninput: move |e| edit_tracker_owner.set(e.value()),
                        }
                    }
                    div { class: "form-group",
                        label { "Repository / Project" }
                        input {
                            r#type: "text",
                            placeholder: "repo-name",
                            value: "{edit_tracker_repo}",
                            oninput: move |e| edit_tracker_repo.set(e.value()),
                        }
                    }
                    div { class: "form-group",
                        label { "Tracker Token (leave empty to keep existing)" }
                        input {
                            r#type: "password",
                            placeholder: "Enter new token to change",
                            value: "{edit_tracker_token}",
                            oninput: move |e| edit_tracker_token.set(e.value()),
                        }
                    }
                    // Webhook configuration section
                    if let Some(secret) = edit_webhook_secret() {
                        h4 {
                            style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);",
                            "Webhook Configuration"
                        }
                        p {
                            style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
                            "Add this webhook in your repository settings to enable push-triggered scans and PR reviews."
                        }
                        div { class: "form-group",
                            label { "Webhook URL" }
                            {
                                #[cfg(feature = "web")]
                                let origin = web_sys::window()
                                    .and_then(|w: web_sys::Window| w.location().origin().ok())
                                    .unwrap_or_default();
                                #[cfg(not(feature = "web"))]
                                let origin = String::new();
                                let webhook_url = format!("{origin}/webhook/{}/{eid}", edit_webhook_tracker());
                                rsx! {
                                    div { class: "copyable",
                                        input {
                                            r#type: "text",
                                            readonly: true,
                                            style: "font-family: monospace; font-size: 12px; flex: 1;",
                                            value: "{webhook_url}",
                                        }
                                        crate::components::copy_button::CopyButton { value: webhook_url.clone() }
                                    }
                                }
                            }
                        }
                        div { class: "form-group",
                            label { "Webhook Secret" }
                            div { class: "copyable",
                                input {
                                    r#type: "text",
                                    readonly: true,
                                    style: "font-family: monospace; font-size: 12px; flex: 1;",
                                    value: "{secret}",
                                }
                                crate::components::copy_button::CopyButton { value: secret.clone() }
                            }
                        }
                    }
                    div { class: "modal-actions",
                        button {
                            class: "btn btn-secondary",
                            onclick: move |_| edit_repo_id.set(None),
                            "Cancel"
                        }
                        button {
                            class: "btn btn-primary",
                            disabled: edit_saving(),
                            onclick: move |_| {
                                let id = eid.clone();
                                let nm = { let v = edit_name(); if v.is_empty() { None } else { Some(v) } };
                                let br = { let v = edit_branch(); if v.is_empty() { None } else { Some(v) } };
                                let tt = { let v = edit_tracker_type(); if v.is_empty() { None } else { Some(v) } };
                                let t_owner = { let v = edit_tracker_owner(); if v.is_empty() { None } else { Some(v) } };
                                let t_repo = { let v = edit_tracker_repo(); if v.is_empty() { None } else { Some(v) } };
                                let t_tok = { let v = edit_tracker_token(); if v.is_empty() { None } else { Some(v) } };
                                edit_saving.set(true);
                                spawn(async move {
                                    match crate::infrastructure::repositories::update_repository(
                                        id, nm, br, None, None, tt, t_owner, t_repo, t_tok, None,
                                    ).await {
                                        Ok(_) => {
                                            toasts.push(ToastType::Success, "Repository updated");
                                            repos.restart();
                                        }
                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
                                    }
                                    edit_saving.set(false);
                                    edit_repo_id.set(None);
                                });
                            },
                            if edit_saving() { "Saving..." } else { "Save" }
                        }
                    }
                }
            }
        }
        match &*repos.read() {
            Some(Some(resp)) => {
                let total_pages = resp.total.unwrap_or(0).div_ceil(20).max(1);
                rsx! {
                    div { class: "card",
                        div { class: "table-wrapper",
                            table {
                                thead {
                                    tr {
                                        th { "Name" }
                                        th { "Git URL" }
                                        th { "Branch" }
                                        th { "Findings" }
                                        th { "Last Scanned" }
                                        th { "Actions" }
                                    }
                                }
                                tbody {
                                    for repo in &resp.data {
                                        {
                                            let repo_id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
                                            let repo_id_scan = repo_id.clone();
                                            let repo_id_del = repo_id.clone();
                                            let repo_id_edit = repo_id.clone();
                                            let repo_name_del = repo.name.clone();
                                            let edit_repo_data = repo.clone();
                                            let is_scanning = scanning_ids().contains(&repo_id);
                                            rsx! {
                                                tr {
                                                    td { "{repo.name}" }
                                                    td {
                                                        style: "font-size: 12px; font-family: monospace;",
                                                        "{repo.git_url}"
                                                    }
                                                    td { "{repo.default_branch}" }
                                                    td { "{repo.findings_count}" }
                                                    td {
                                                        {
                                                            let now = chrono::Utc::now();
                                                            let diff = now.signed_duration_since(repo.updated_at);
                                                            let label = if diff.num_minutes() < 1 {
                                                                "just now".to_string()
                                                            } else if diff.num_hours() < 1 {
                                                                format!("{}m ago", diff.num_minutes())
                                                            } else if diff.num_days() < 1 {
                                                                format!("{}h ago", diff.num_hours())
                                                            } else if diff.num_days() < 30 {
                                                                format!("{}d ago", diff.num_days())
                                                            } else {
                                                                repo.updated_at.format("%Y-%m-%d").to_string()
                                                            };
                                                            rsx! { span { style: "font-size: 12px;", "{label}" } }
                                                        }
                                                    }
                                                    td { style: "display: flex; gap: 4px;",
                                                        button {
                                                            class: if graph_repo_id().as_deref() == Some(repo_id.as_str()) { "btn btn-ghost btn-active" } else { "btn btn-ghost" },
                                                            title: "View graph",
                                                            onclick: {
                                                                let rid = repo_id.clone();
                                                                move |_| {
                                                                    if graph_repo_id().as_deref() == Some(rid.as_str()) {
                                                                        graph_repo_id.set(None);
                                                                    } else {
                                                                        graph_repo_id.set(Some(rid.clone()));
                                                                    }
                                                                }
                                                            },
                                                            Icon { icon: BsDiagram3, width: 16, height: 16 }
                                                        }
                                                        button {
                                                            class: "btn btn-ghost",
                                                            title: "Edit repository",
                                                            onclick: move |_| {
                                                                edit_name.set(edit_repo_data.name.clone());
                                                                edit_branch.set(edit_repo_data.default_branch.clone());
                                                                edit_tracker_type.set(
                                                                    edit_repo_data.tracker_type.as_ref().map(|t| t.to_string()).unwrap_or_default()
                                                                );
                                                                edit_tracker_owner.set(edit_repo_data.tracker_owner.clone().unwrap_or_default());
                                                                edit_tracker_repo.set(edit_repo_data.tracker_repo.clone().unwrap_or_default());
                                                                edit_tracker_token.set(String::new());
                                                                edit_webhook_secret.set(None);
                                                                edit_webhook_tracker.set(String::new());
                                                                edit_repo_id.set(Some(repo_id_edit.clone()));
                                                                // Fetch webhook config in background
                                                                let rid = repo_id_edit.clone();
                                                                spawn(async move {
                                                                    if let Ok(cfg) = crate::infrastructure::repositories::fetch_webhook_config(rid).await {
                                                                        edit_webhook_secret.set(cfg.webhook_secret);
                                                                        edit_webhook_tracker.set(cfg.tracker_type);
                                                                    }
                                                                });
                                                            },
                                                            Icon { icon: BsPencil, width: 16, height: 16 }
                                                        }
                                                        button {
                                                            class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
                                                            title: "Trigger scan",
                                                            disabled: is_scanning,
                                                            onclick: move |_| {
                                                                let id = repo_id_scan.clone();
                                                                // Add to scanning set
                                                                let mut ids = scanning_ids();
                                                                ids.push(id.clone());
                                                                scanning_ids.set(ids);
                                                                spawn(async move {
                                                                    match crate::infrastructure::repositories::trigger_repo_scan(id.clone()).await {
                                                                        Ok(_) => {
                                                                            toasts.push(ToastType::Success, "Scan triggered");
                                                                            // Poll until scan completes
                                                                            loop {
                                                                                async_sleep_5s().await;
                                                                                match crate::infrastructure::repositories::check_repo_scanning(id.clone()).await {
                                                                                    Ok(false) => break,
                                                                                    Ok(true) => continue,
                                                                                    Err(_) => break,
                                                                                }
                                                                            }
                                                                            toasts.push(ToastType::Success, "Scan complete");
                                                                            repos.restart();
                                                                        }
                                                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
                                                                    }
                                                                    // Remove from scanning set
                                                                    let mut ids = scanning_ids();
                                                                    ids.retain(|i| i != &id);
                                                                    scanning_ids.set(ids);
                                                                });
                                                            },
                                                            if is_scanning {
                                                                span { class: "spinner" }
                                                            } else {
                                                                Icon { icon: BsPlayCircle, width: 16, height: 16 }
                                                            }
                                                        }
                                                        button {
                                                            class: "btn btn-ghost btn-ghost-danger",
                                                            title: "Delete repository",
                                                            onclick: move |_| {
                                                                confirm_delete.set(Some((repo_id_del.clone(), repo_name_del.clone())));
                                                            },
                                                            Icon { icon: BsTrash, width: 16, height: 16 }
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                        Pagination {
                            current_page: page(),
                            total_pages: total_pages,
                            on_page_change: move |p| page.set(p),
                        }
                    }
                    // Inline graph explorer
                    if let Some(rid) = graph_repo_id() {
                        div { class: "card", style: "margin-top: 16px;",
                            div { class: "card-header", style: "display: flex; justify-content: space-between; align-items: center;",
                                span { "Code Graph" }
                                button {
                                    class: "btn btn-sm btn-ghost",
                                    title: "Close graph",
                                    onclick: move |_| { graph_repo_id.set(None); },
                                    Icon { icon: BsX, width: 18, height: 18 }
                                }
                            }
                            GraphExplorerInline { repo_id: rid }
                        }
                    }
                }
            },
            Some(None) => rsx! {
                div { class: "card", p { "Failed to load repositories." } }
            },
            None => rsx! {
                div { class: "loading", "Loading repositories..." }
            },
        }
    }
 }
@@ -12,35 +12,9 @@ use dioxus_free_icons::Icon;
 use crate::components::page_header::PageHeader;
 use crate::components::toast::{ToastType, Toasts};
 use crate::infrastructure::onboarding::{
-    delete_target, fetch_applicable_scans, fetch_targets, trigger_target_scan, update_target,
+    delete_target, fetch_applicable_scans, fetch_targets, trigger_target_scan,
    validate_artifact_ref, validate_target_name, ArtifactInputDto,
 };
 /// The nine target families (value, label) for the edit form's type selector.
 const TARGET_TYPES: &[(&str, &str)] = &[
    ("web_app", "Web Application"),
    ("backend_service", "Backend / API"),
    ("desktop_app", "Desktop App"),
    ("android_app", "Android App"),
    ("ios_app", "iOS App"),
    ("firmware_bare_metal", "Firmware — bare metal"),
    ("firmware_rtos", "Firmware — RTOS"),
    ("embedded_linux_yocto", "Embedded Linux / Yocto"),
    ("plc_sps", "PLC / SPS"),
 ];
 /// The artifact kinds (value, label) for the edit form.
 const ARTIFACT_KINDS: &[(&str, &str)] = &[
    ("git_repo", "Git repository"),
    ("source_archive", "Source archive (zip)"),
    ("firmware_image", "Firmware image"),
    ("mobile_package", "Mobile package (APK/IPA)"),
    ("container_image", "Container image"),
    ("live_url", "Live URL"),
    ("plc_project", "PLC project"),
    ("plaintext_description", "Description (text)"),
 ];
 /// Prettify a snake_case target-type value into a human label.
 fn pretty_type(v: &str) -> String {
    match v {
@@ -132,17 +106,6 @@ pub fn TargetsPage() -> Element {
    let mut expanded_ids = use_signal(Vec::<String>::new);
    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None);
    // Edit-target modal state.
    let mut edit_id = use_signal(|| Option::<String>::None);
    let mut edit_name = use_signal(String::new);
    let mut edit_type = use_signal(String::new);
    let mut edit_arts = use_signal(Vec::<ArtifactInputDto>::new);
    let mut edit_saving = use_signal(|| false);
    // In-modal "add artifact" mini-form.
    let mut e_kind = use_signal(|| "git_repo".to_string());
    let mut e_source = use_signal(String::new);
    let mut e_branch = use_signal(|| "main".to_string());
    let mut targets = use_resource(move || async move { fetch_targets().await.ok() });
    rsx! {
@@ -200,145 +163,6 @@ pub fn TargetsPage() -> Element {
            }
        }
        // ── Edit target ──
        if let Some(eid) = edit_id() {
            {
            let name_err = validate_target_name(&edit_name());
            let e_source_err = if e_source().is_empty() {
                None
            } else {
                validate_artifact_ref(&e_kind(), &e_source())
            };
            rsx! {
                div { class: "modal-overlay",
                    div { class: "modal-dialog",
                        h3 { "Edit target" }
                        div { class: "form-group",
                            label { "Name" }
                            input {
                                r#type: "text",
                                value: "{edit_name}",
                                oninput: move |e| edit_name.set(e.value()),
                            }
                            if !edit_name().is_empty() {
                                if let Some(err) = name_err.clone() {
                                    div { style: "color: var(--danger, #d33); font-size: 0.85em;", "{err}" }
                                }
                            }
                        }
                        div { class: "form-group",
                            label { "Type" }
                            select {
                                value: "{edit_type}",
                                oninput: move |e| edit_type.set(e.value()),
                                for (v, l) in TARGET_TYPES.iter().copied() {
                                    option { value: "{v}", selected: edit_type() == v, "{l}" }
                                }
                            }
                        }
                        label { style: "font-weight: 600;", "Artifacts" }
                        for (i, a) in edit_arts().iter().enumerate() {
                            div { style: "display: flex; justify-content: space-between; align-items: center; padding: 4px 0;",
                                span { style: "font-size: 0.9em;",
                                    span { style: "opacity: 0.7;", "{a.kind}: " }
                                    span { style: "font-family: monospace;", "{a.source_ref}" }
                                }
                                button {
                                    class: "btn btn-ghost btn-ghost-danger btn-sm",
                                    onclick: move |_| { edit_arts.write().remove(i); },
                                    "Remove"
                                }
                            }
                        }
                        div { style: "display: flex; gap: 8px; align-items: flex-end; margin-top: 8px;",
                            div { class: "form-group", style: "margin: 0;",
                                label { "Kind" }
                                select {
                                    value: "{e_kind}",
                                    oninput: move |e| e_kind.set(e.value()),
                                    for (v, l) in ARTIFACT_KINDS.iter().copied() {
                                        option { value: "{v}", selected: e_kind() == v, "{l}" }
                                    }
                                }
                            }
                            div { class: "form-group", style: "margin: 0; flex: 1;",
                                label { "Reference" }
                                input {
                                    r#type: "text",
                                    value: "{e_source}",
                                    oninput: move |e| e_source.set(e.value()),
                                }
                            }
                            if e_kind() == "git_repo" {
                                div { class: "form-group", style: "margin: 0;",
                                    label { "Branch" }
                                    input {
                                        r#type: "text",
                                        value: "{e_branch}",
                                        oninput: move |e| e_branch.set(e.value()),
                                    }
                                }
                            }
                            button {
                                class: "btn btn-secondary",
                                disabled: e_source().trim().is_empty() || e_source_err.is_some(),
                                onclick: move |_| {
                                    let kind = e_kind();
                                    if !e_source().trim().is_empty()
                                        && validate_artifact_ref(&kind, &e_source()).is_none()
                                    {
                                        let branch = if kind == "git_repo" { Some(e_branch()) } else { None };
                                        edit_arts.write().push(ArtifactInputDto {
                                            kind,
                                            source_ref: e_source(),
                                            branch,
                                            plc_format: None,
                                        });
                                        e_source.set(String::new());
                                    }
                                },
                                "+ Add"
                            }
                        }
                        if let Some(err) = e_source_err.clone() {
                            div { style: "color: var(--danger, #d33); font-size: 0.85em;", "{err}" }
                        }
                        div { class: "modal-actions",
                            button {
                                class: "btn btn-secondary",
                                onclick: move |_| edit_id.set(None),
                                "Cancel"
                            }
                            button {
                                class: "btn btn-primary",
                                disabled: edit_saving() || name_err.is_some(),
                                onclick: move |_| {
                                    let id = eid.clone();
                                    let nm = edit_name();
                                    let tt = edit_type();
                                    let arts = edit_arts();
                                    edit_saving.set(true);
                                    spawn(async move {
                                        match update_target(id, Some(nm), Some(tt), Some(arts)).await {
                                            Ok(_) => {
                                                toasts.push(ToastType::Success, "Target updated");
                                                targets.restart();
                                                edit_id.set(None);
                                            }
                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
                                        }
                                        edit_saving.set(false);
                                    });
                                },
                                if edit_saving() { "Saving..." } else { "Save" }
                            }
                        }
                    }
                }
            }
            }
        }
        {
        let targets_snapshot = targets.read().clone();
        match &targets_snapshot {
@@ -399,12 +223,8 @@ pub fn TargetsPage() -> Element {
                                                let id_scan = id.clone();
                                                let id_exp = id.clone();
                                                let id_del = id.clone();
                                                let id_edit = id.clone();
                                                let name_del = name.clone();
                                                let name_edit = name.clone();
                                                let ttype_raw = str_at(&t, "target_type").to_string();
                                                let artifacts_detail = artifacts.clone();
                                                let artifacts_edit = artifacts.clone();
                                                rsx! {
                                                    tr {
                                                        td { strong { "{name}" } }
@@ -433,31 +253,6 @@ pub fn TargetsPage() -> Element {
                                                                },
                                                                Icon { icon: BsInfoCircle, width: 16, height: 16 }
                                                            }
                                                            button {
                                                                class: "btn btn-ghost",
                                                                title: "Edit target",
                                                                onclick: move |_| {
                                                                    edit_name.set(name_edit.clone());
                                                                    edit_type.set(ttype_raw.clone());
                                                                    let arts: Vec<ArtifactInputDto> = artifacts_edit
                                                                        .iter()
                                                                        .map(|a| ArtifactInputDto {
                                                                            kind: str_at(a, "kind").to_string(),
                                                                            source_ref: str_at(a, "source_ref").to_string(),
                                                                            branch: a
                                                                                .get("git")
                                                                                .and_then(|g| g.get("default_branch"))
                                                                                .and_then(|b| b.as_str())
                                                                                .map(String::from),
                                                                            plc_format: None,
                                                                        })
                                                                        .collect();
                                                                    edit_arts.set(arts);
                                                                    e_source.set(String::new());
                                                                    edit_id.set(Some(id_edit.clone()));
                                                                },
                                                                Icon { icon: BsPencil, width: 16, height: 16 }
                                                            }
                                                            button {
                                                                class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
                                                                title: "Run scan",
@@ -1,19 +0,0 @@
 #!/usr/bin/env bash
 # Seed the nix store on first start, then run the agent.
 #
 # The firmware-SBOM pipeline drives a real `nix` build (tramiton NixBackend).
 # The image ships the store as a bootstrap tarball rather than baking /nix, so a
 # persistent /nix volume (mounted empty on first deploy) gets populated once and
 # then survives redeploys. Seeding is best-effort: if it fails, the agent still
 # starts and firmware SBOMs fall back to analysis-only.
 if [ ! -e /nix/store ]; then
  echo "agent-entrypoint: seeding /nix store from image bootstrap..."
  mkdir -p /nix
  if tar -C / -xzf /opt/nix-bootstrap.tar.gz; then
    echo "agent-entrypoint: /nix store seeded."
  else
    echo "agent-entrypoint: WARN nix seed failed; firmware SBOM will use analysis-only fallback."
  fi
 fi
 exec compliance-agent "$@"
@@ -20,7 +20,6 @@ export default withMermaid(defineConfig({
          { text: 'Getting Started', link: '/guide/getting-started' },
          { text: 'Adding Repositories', link: '/guide/repositories' },
          { text: 'Running Scans', link: '/guide/scanning' },
          { text: 'PLC / SPS (CODESYS)', link: '/guide/plc' },
          { text: 'Understanding Findings', link: '/guide/findings' },
          { text: 'SBOM & Licenses', link: '/guide/sbom' },
          { text: 'Issues & Tracking', link: '/guide/issues' },
@@ -1,97 +0,0 @@
 # PLC / SPS Projects (CODESYS)
 Certifai analyzes industrial control logic (IEC 61131-3) for PLC/SPS targets such
 as CODESYS projects. A single PLC/SPS target is treated as a **composite device**:
 the control application *and* the device it runs on.
 | What you provide | What Certifai does |
 | --- | --- |
 | PLC project (PLCopen XML / ST, or a `.projectarchive`) | **Control-logic SAST** — semantic security rules over ST **and** graphical FBD/LD |
 | A `.projectarchive` | **Control-app SBOM** — the referenced CODESYS libraries + the runtime version, matched against known CVEs |
 | A device firmware image | Firmware SBOM / CVE (opt-in) |
 | A reachable endpoint (WebVisu, OPC UA) | DAST / pentest (opt-in) |
 ## Two ways to deliver the project
 You can either **upload** the project when onboarding, or point Certifai at a
 **git repository** (recommended — every scan is just a `git pull`, no re-upload).
 ### Option A — Upload
 On the onboarding wizard, choose target type **PLC / SPS**, then attach a **PLC
 project** artifact and pick its format:
 - **PLCopen XML** (`.xml`) — export from CODESYS via *Project → Export PLCopenXML*.
 - **Structured Text** (`.st`) — a raw ST file.
 - **Project archive** (`.projectarchive`) — *File → Project Archive → Save/Send
  Archive…* with **"Referenced libraries"** ticked. This is the only form that
  also yields the **library + runtime SBOM**.
 ### Option B — Git repository (recommended)
 Attach a **Git repository** artifact to the PLC/SPS target. Certifai clones it and
 runs the control-logic scan over the exported source in the repo.
 ## Best-case git repository layout
 Because the binary `.project` does not diff or merge in git, commit **textual
 exports** for review-friendly SAST, and include the **`.projectarchive`** so the
 library/runtime SBOM is available too:
 ```text
 my-plc-project/
 ├── src/
 │   ├── PLC_PRG.xml          # PLCopen XML export (ST or FBD/LD) — one per POU
 │   ├── PumpController.xml
 │   ├── SafetyInterlock.xml
 │   └── GVL.xml              # global variable lists, also as PLCopen XML
 ├── PumpStation.projectarchive   # optional but recommended → library + runtime SBOM
 └── README.md
 ```
 **Guidelines**
 - **Export to PLCopen XML** (`Project → Export PLCopenXML`), one file per POU, and
  commit those. ST, **and graphical FBD/LD**, are both analyzed.
 - Alternatively commit raw `.st` / `.exp` / `.scl` files — also analyzed.
 - **Do not** commit only the binary `.project` — it cannot be parsed (and does not
  diff). If you want the library SBOM, commit the **`.projectarchive`** as well.
 - CODESYS's built-in Git integration, which stores an exported representation,
  works too — as long as the committed form is PLCopen XML / textual.
 ::: tip What unlocks what
 - **Control-logic SAST** needs textual source in the repo (PLCopen XML or `.st`).
 - **Library + runtime SBOM** needs a **`.projectarchive`** — PLCopen XML exports do
  **not** carry the referenced libraries.
 :::
 ## What the scanner finds
 The control-logic rules are CWE-mapped and include: hardcoded credentials
 (CWE-798), default/weak passwords (CWE-1393), safety interlock / watchdog bypass
 (CWE-1384), unchecked array indexing (CWE-129), division-by-zero (CWE-369,
 guard-aware), cleartext/insecure communication (CWE-319), insecure protocol ports
 (CWE-319, e.g. Modbus 502, FTP 21, Telnet 23), and unstructured jumps (CWE-691).
 The **SBOM** view lists the CODESYS libraries (`pkg:codesys/<name>@<version>`) and
 the runtime; matching runtime components (e.g. the `Cmp*` / `3SLicense` libraries)
 surface real CODESYS advisories as CVE alerts.
 ## Dynamic testing — ICS protocol probe
 Beyond the static analysis, Certifai can **probe the running device** over
 industrial protocols. Attach a **Live URL** artifact (the device host / WebVisu
 URL) to the PLC/SPS target and enable the **ICS Probe** scan.
 The probe is **read-only** — it never writes to the live process. It currently
 speaks **Modbus/TCP** (port 502): it confirms whether the device answers
 unauthenticated Modbus requests and reads its device identity (vendor / product /
 revision). Because Modbus/TCP has no authentication or encryption in the protocol,
 a reachable endpoint that answers is reported as an exposed control interface
 (CWE-306). OPC UA and EtherNet/IP probes are planned.
 ::: warning
 The ICS probe connects to the live device. It is **opt-in** (off by default) and
 should only be run against targets you are authorized to test. It performs reads
 only, never writes.
 :::
@@ -1,36 +0,0 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- Demo PLCopen project — conveyor sorter. Deliberately vulnerable. -->
 <project xmlns="http://www.plcopen.org/xml/tc6_0201">
  <types>
    <pous>
      <pou name="ConveyorCtrl" pouType="program">
        <interface>
          <localVars>
            <variable name="AdminPwd">
              <type><string/></type>
              <initialValue><simpleValue value="password"/></initialValue>
            </variable>
            <variable name="Belt">
              <type>
                <array>
                  <dimension lower="0" upper="3"/>
                  <baseType><INT/></baseType>
                </array>
              </type>
            </variable>
          </localVars>
          <inputVars>
            <variable name="Slot"><type><INT/></type></variable>
          </inputVars>
        </interface>
        <body>
          <ST>
            <xhtml xmlns="http://www.w3.org/1999/xhtml">Belt[Slot] := 1;
 Ftp_Send(HOST := '192.168.1.5', PORT := 21, ENCRYPT := FALSE);
 </xhtml>
          </ST>
        </body>
      </pou>
    </pous>
  </types>
 </project>
@@ -1,56 +0,0 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- Function Block Diagram (FBD) POU in PLCopen TC6 XML form. Demonstrates that
     the scanner analyses graphical logic, not just Structured Text: the same
     defects (cleartext Modbus master on 502, a hardcoded HMI password, a safety
     enable driven FALSE) are here wired as blocks and in/out variables. -->
 <project xmlns="http://www.plcopen.org/xml/tc6_0201">
  <types>
    <pous>
      <pou name="PumpFbdCtrl" pouType="functionBlock">
        <interface>
          <inputVars>
            <variable name="HmiPassword"><type><string/></type></variable>
            <variable name="Safety_Enable"><type><BOOL/></type></variable>
            <variable name="ServerIp"><type><string/></type></variable>
          </inputVars>
        </interface>
        <body>
          <FBD>
            <!-- Modbus/TCP master: cleartext (AUTH := FALSE) on port 502 -->
            <inVariable localId="1"><expression>'10.20.0.5'</expression><connectionPointOut/></inVariable>
            <inVariable localId="2"><expression>502</expression><connectionPointOut/></inVariable>
            <inVariable localId="3"><expression>FALSE</expression><connectionPointOut/></inVariable>
            <block localId="10" typeName="Modbus_TCP_Master">
              <inputVariables>
                <variable formalParameter="IP">
                  <connectionPointIn><connection refLocalId="1"/></connectionPointIn>
                </variable>
                <variable formalParameter="PORT">
                  <connectionPointIn><connection refLocalId="2"/></connectionPointIn>
                </variable>
                <variable formalParameter="AUTH">
                  <connectionPointIn><connection refLocalId="3"/></connectionPointIn>
                </variable>
              </inputVariables>
              <outputVariables/>
            </block>
            <!-- Hardcoded HMI password wired into an output -->
            <inVariable localId="20"><expression>'admin123'</expression><connectionPointOut/></inVariable>
            <outVariable localId="21">
              <expression>HmiPassword</expression>
              <connectionPointIn><connection refLocalId="20"/></connectionPointIn>
            </outVariable>
            <!-- Safety enable driven FALSE in logic -->
            <inVariable localId="30"><expression>FALSE</expression><connectionPointOut/></inVariable>
            <outVariable localId="31">
              <expression>Safety_Enable</expression>
              <connectionPointIn><connection refLocalId="30"/></connectionPointIn>
            </outVariable>
          </FBD>
        </body>
      </pou>
    </pous>
  </types>
 </project>
@@ -1,57 +0,0 @@
 (*
 * Demo PLC program — pump-station control (IEC 61131-3 Structured Text).
 *
 * Deliberately vulnerable, for the compliance-scanner PLC control-logic demo.
 * Each issue below is flagged by pipeline::plc::rules.
 *)
 FUNCTION_BLOCK PumpStationCtrl
 VAR_INPUT
    OperatorCmd   : INT;        (* HMI command index — untrusted *)
    FlowSetpoint  : REAL;
 END_VAR
 VAR_OUTPUT
    PumpSpeed     : REAL;
    Fault         : BOOL;
 END_VAR
 VAR
    HmiPassword     : STRING := 'admin123';        (* hardcoded + default credential *)
    ApiKey          : STRING := 'sk_live_9c1f2a';   (* hardcoded secret *)
    PumpProfiles    : ARRAY[0..7] OF REAL;
    Safety_Enable   : BOOL := TRUE;
    Watchdog_Kick   : INT := 1;
    MeasuredFlow    : REAL;
    ScaleFactor     : REAL;
    i               : INT;
 END_VAR
    (* Operator can index the profile table with an unvalidated command. *)
    PumpSpeed := PumpProfiles[OperatorCmd];
    (* Divisor is a live process value that can read zero on a stopped line. *)
    ScaleFactor := FlowSetpoint / MeasuredFlow;
    (* Safety interlock disabled straight from application logic. *)
    IF OperatorCmd = 99 THEN
        Safety_Enable := FALSE;
        Watchdog_Kick := 0;
    END_IF;
    (* Unauthenticated Modbus/TCP link on the cleartext OT port. *)
    Modbus_TCP_Connect(IP := '10.10.5.20', PORT := 502, AUTH := FALSE, PASSWORD := 'plc');
    (* Unstructured jump around the fault handler. *)
    IF MeasuredFlow > 1000.0 THEN
        JMP trip;
    END_IF;
    (* A correctly guarded division — must NOT be flagged. *)
    IF ScaleFactor <> 0.0 THEN
        PumpSpeed := PumpSpeed / ScaleFactor;
    END_IF;
    RETURN;
 trip:
    Fault := TRUE;
    PumpSpeed := 0.0;
 END_FUNCTION_BLOCK
@@ -1,92 +0,0 @@
 (*
 * Pedestrian-crossing traffic-light controller.
 *
 * Structure adapted from the classic OpenPLC "traffic light" example
 * (github.com/thiagoralves/OpenPLC_v3 examples) — a timed state machine
 * driving vehicle + pedestrian lamps, extended with a SCADA/Modbus link
 * and a maintenance override so it reads like a real deployed program.
 *
 * The control logic itself is sound; the security-relevant defects are the
 * kind that slip into field code under deadline: a hardcoded SCADA password,
 * a cleartext Modbus/TCP master, and a maintenance mode that drops the
 * pedestrian safety permit. Everything else should stay quiet.
 *)
 PROGRAM TrafficLight
 VAR
    State        : INT := 0;      (* 0 GreenVeh, 1 Amber, 2 RedVeh/WalkPed, 3 FlashPed *)
    Tmr          : TON;
    StateElapsed : TIME;
    CycleMs      : DINT := 0;
    (* Lamp outputs *)
    VehGreen     : BOOL := FALSE;
    VehAmber     : BOOL := FALSE;
    VehRed       : BOOL := FALSE;
    PedWalk      : BOOL := FALSE;
    PedStop      : BOOL := TRUE;
    (* Pedestrian safety permit — must be TRUE before the WALK phase asserts *)
    PedPermit    : BOOL := TRUE;
    PedButton    : BOOL := FALSE;
    (* SCADA / remote monitoring *)
    ScadaUser    : STRING := 'operator';
    ScadaPassword    : STRING := 'Tr@ffic2019';   (* hardcoded SCADA credential *)
    ModbusReady  : BOOL := FALSE;
    (* Maintenance override *)
    MaintMode    : BOOL := FALSE;
    LampCount    : INT := 5;
    DutyPct      : INT;
 END_VAR
 (* ---- SCADA uplink: publish state to the control room over Modbus/TCP ---- *)
 IF NOT ModbusReady THEN
    Modbus_TCP_Master(IP := '10.20.0.5', PORT := 502, AUTH := FALSE, USER := ScadaUser, PASS := ScadaPassword);
    ModbusReady := TRUE;
 END_IF;
 (* ---- Duty-cycle for the flashing pedestrian lamp (guarded division) ---- *)
 IF LampCount <> 0 THEN
    DutyPct := (CycleMs * 100) / LampCount;
 END_IF;
 (* ---- Maintenance override: flash amber, hand control to the technician ---- *)
 IF MaintMode THEN
    VehGreen := FALSE;
    VehRed   := FALSE;
    VehAmber := NOT VehAmber;
    PedPermit := FALSE;      (* drops the pedestrian safety permit in code *)
    PedWalk  := FALSE;
    PedStop  := TRUE;
 ELSE
    (* ---- Normal timed state machine ---- *)
    Tmr(IN := TRUE, PT := T#5s);
    StateElapsed := Tmr.ET;
    CASE State OF
        0:  (* vehicles go, pedestrians stop *)
            VehGreen := TRUE; VehAmber := FALSE; VehRed := FALSE;
            PedWalk := FALSE; PedStop := TRUE;
            IF PedButton AND Tmr.Q THEN
                State := 1; Tmr(IN := FALSE);
            END_IF;
        1:  (* amber transition *)
            VehGreen := FALSE; VehAmber := TRUE;
            IF Tmr.Q THEN State := 2; Tmr(IN := FALSE); END_IF;
        2:  (* vehicles stop, pedestrians walk — only if permitted *)
            VehAmber := FALSE; VehRed := TRUE;
            IF PedPermit THEN
                PedWalk := TRUE; PedStop := FALSE;
            END_IF;
            IF Tmr.Q THEN State := 3; Tmr(IN := FALSE); END_IF;
        3:  (* flashing don't-walk before returning to green *)
            PedWalk := NOT PedWalk;
            IF Tmr.Q THEN
                State := 0; PedButton := FALSE; Tmr(IN := FALSE);
            END_IF;
    ELSE
        State := 0;
    END_CASE;
 END_IF;
 END_PROGRAM