Harden repository scans and add LOC comparisons

tests/app.test.js

@@ -5,6 +5,7 @@ import request from "supertest";
 import { createApp } from "../dist/app.js";
 
 const baseConfig = {
+  allowedGitHosts: ["example.com"],
   apiKey: "",
   cacheSweepIntervalMs: 300000,
   cacheTtlMs: 300000,
@@ -12,6 +13,9 @@ const baseConfig = {
   defaultSshKeyName: "loc_via_git_ed25519",
   generateSshKeyIfMissing: false,
   maxConcurrentScans: 4,
+  maxFilesPerScan: 20000,
+  maxFileSizeBytes: 5 * 1024 * 1024,
+  maxScanBytes: 100 * 1024 * 1024,
   port: 3000,
   rateLimitMax: 30,
   rateLimitWindowMs: 300000,
@@ -26,6 +30,7 @@ test("GET /loc returns count metadata", async () => {
     getPublicKey: async () => "ssh-ed25519 AAAA",
     getDefaultKeyName: () => "loc_via_git_ed25519",
     count: async (requestInput) => ({
+      commit: "abc123",
       repo: requestInput.repo,
       ref: requestInput.ref,
       sshKey: requestInput.sshKey,
@@ -82,6 +87,7 @@ test("GET /loc accepts api_key query param as an unsafe fallback", async () => {
     getPublicKey: async () => "ssh-ed25519 AAAA",
     getDefaultKeyName: () => "loc_via_git_ed25519",
     count: async (requestInput) => ({
+      commit: "abc123",
       repo: requestInput.repo,
       ref: requestInput.ref,
       sshKey: requestInput.sshKey,
@@ -99,3 +105,34 @@ test("GET /loc accepts api_key query param as an unsafe fallback", async () => {
   assert.equal(response.status, 200);
   assert.equal(response.body.lineCount, 5);
 });
+
+test("GET /loc/diff returns aggregate and language deltas", async () => {
+  const app = createApp(baseConfig, {
+    getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
+    getPublicKey: async () => "ssh-ed25519 AAAA",
+    getDefaultKeyName: () => "loc_via_git_ed25519",
+    count: async (requestInput) => ({
+      commit: requestInput.ref === "base" ? "base123" : "head456",
+      repo: requestInput.repo,
+      ref: requestInput.ref,
+      sshKey: requestInput.sshKey,
+      cached: false,
+      lineCount: requestInput.ref === "base" ? 10 : 17,
+      fileCount: requestInput.ref === "base" ? 2 : 3,
+      languages: requestInput.ref === "base"
+        ? [{ language: "TypeScript", files: 2, lines: 10 }]
+        : [{ language: "TypeScript", files: 2, lines: 12 }, { language: "Python", files: 1, lines: 5 }],
+      scannedAt: "2026-01-01T00:00:00.000Z",
+      durationMs: 10
+    })
+  });
+
+  const response = await request(app).get("/loc/diff?repo=https://example.com/repo.git&base=base&head=head");
+
+  assert.equal(response.status, 200);
+  assert.equal(response.body.delta.lineCount, 7);
+  assert.deepEqual(response.body.delta.languages, [
+    { language: "Python", files: 1, lines: 5 },
+    { language: "TypeScript", files: 0, lines: 2 }
+  ]);
+});