Scan a project for drainer and phishing patterns
Runs the static drainer / phishing scanner over every readable source file in the project's sandbox and returns every hit with the rule that fired, the file, and the line. This is the same scanner and the same six rules the export gate uses, so `blocked: true` here means the export gate would refuse this project too. The matched text is redacted before it leaves the process; a seed phrase or private key is never returned whole. Read-only: nothing in the project is written or deleted.
Runs the static drainer / phishing scanner over every readable source file in the project's sandbox and returns every hit with the rule that fired, the file, and the line. This is the same scanner and the same six rules the export gate uses, so blocked: true here means the export gate would refuse this project too. The matched text is redacted before it leaves the process; a seed phrase or private key is never returned whole. Read-only: nothing in the project is written or deleted.
Path Parameters
The project the operation is about.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/projects/string/scan"{ "projectId": "string", "filesScanned": 0, "findings": [ { "rule": "seed_phrase", "file": "string", "line": 1, "match": "string" } ], "blocked": true}Follow a run over SSE GET
Streams the run's event log as Server-Sent Events, one event per line of output, in `seq` order. Each event carries `id: <seq>`, so a browser that reconnects automatically replays from exactly where it left off by sending its last id back in the `Last-Event-ID` header; the server replays the missed events and then resumes live, with no gap and no duplicate. The same cursor is available as a `?afterSeq=` query parameter for a client that cannot set headers. The stream ends by closing when the run reaches a terminal state, after the final `run.finished` or `run.error` event has been sent. A client that must not hold a connection open should poll the paged endpoint instead — the two share the same cursor space, so a client may switch between them without skipping or repeating an event.
Build and typecheck a project without a run POST
Runs the project's build and typecheck commands in its sandbox and returns `{ ok, errors[] }` with every failure's output verbatim, so the free layer can check a project before any credits are spent. No agent run is started, no model is called, and nothing is written to the project. The exec timeout is enforced server-side: the body may ask for less than the 300 s `exec` ceiling but not more, and each command's output is capped at 16 KB as head plus tail.