- Add chi v5.2.5 to go.mod
- Vendor htmx v2.0.4 minified JS in pkg/web/static/
- Create go:embed directives for static/ and templates/
- Create layout.html with nav bar and Tailwind CDN
- Create overview.html with stat cards and findings table
- cmd/serve.go: starts scheduler, optionally starts Telegram bot with --telegram flag
- cmd/schedule.go: add/list/remove/run subcommands for scheduled scan job CRUD
- pkg/scheduler/: gocron v2 based scheduler with DB-backed jobs and scan execution
- pkg/storage/scheduled_jobs.go: scheduled_jobs table CRUD with tests
- Remove serve and schedule stubs from cmd/stubs.go
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add telego v1.8.0 as direct dependency for Telegram bot
- Create pkg/bot/bot.go with Bot struct, Config, New, Start, Stop
- Implement isAllowed chat authorization and per-user rate limiting
- Add command dispatch with handler stubs for all 10 commands
- Long polling lifecycle with context cancellation for graceful shutdown
- Scheduler wraps gocron with Start/Stop lifecycle
- Start loads enabled jobs from DB and registers cron schedules
- AddJob/RemoveJob persist to DB and sync with gocron
- RunJob for manual trigger with OnComplete callback
- JobResult struct for notification bridge
- Promote gocron/v2 v2.19.1 to direct dependency
- Add gocron/v2 v2.19.1 as direct dependency
- Append subscribers and scheduled_jobs CREATE TABLE to schema.sql
- Implement full subscriber CRUD (Add/Remove/List/IsSubscribed)
- Implement full scheduled job CRUD (Save/List/Get/Delete/UpdateLastRun/SetEnabled)
- Walks every commit across branches, tags, remote-tracking refs, and stash
- Deduplicates blob scans by OID (seenBlobs map) so identical content
across commits/files is scanned exactly once
- Emits chunks with source format git:<short-sha>:<path>
- Honors --since filter via GitSource.Since (commit author date)
- Resolves annotated tag objects down to their commit hash
- Skips binary blobs via go-git IsBinary plus null-byte sniff
- 8 subtests cover history walk, dedup, modified-file, multi-branch,
tag reachability, since filter, source format, missing repo
- github.com/go-git/go-git/v5 v5.17.2 (git history traversal)
- github.com/atotto/clipboard v0.1.4 (cross-platform clipboard)
- golang.org/x/exp (mmap for large file reads)
Wave 0 dependency bootstrap for Phase 4 input sources. Modules
are recorded as indirect until Wave 1 plans import them; go.sum
contains checksums. go build ./... and go vet ./... both green.
- loader.go with go:embed definitions/*.yaml for compile-time embedding
- registry.go with List(), Get(), Stats(), AC() methods
- Aho-Corasick automaton built from all provider keywords at NewRegistry()
- pkg/providers/definitions/ with 3 YAML files for embed
- All 5 provider tests pass: load, get, stats, AC, schema validation
