@4da/mcp-server 6.2.3 → 6.2.5

package/dist/tools/vulnerability-scan-format.js

@@ -5,13 +5,18 @@
  * provenance. Split out of vulnerability-scan.ts, which keeps execution.
  */
 import { hostTarget } from "../live/platform.js";
-import { maxSemver } from "../live/semver-utils.js";
+import { computeSemverDistance, maxSemver } from "../live/semver-utils.js";
 import { isMaintenanceNotice } from "../live/maintenance.js";
 import { countBySeverity, presentedSeverity, scopeAdjustmentReason, SEVERITY_RANK, } from "../live/severity-scope.js";
+import { vulnerabilityCoverage } from "../live/scan-coverage.js";
 import { buildDriftView, groupDriftRows, lockfileAlsoAffected } from "./install-drift-notes.js";
-import { discoveryNote } from "../project-tree.js";
-import { targetNote } from "../live/fix-paths.js";
+import { discoveryNote, exclusionNotes, lockfileProblemNotes, splitLockfileProblems } from "../project-tree.js";
+import { rowFix, targetCheckedAll, targetNote, withheldText } from "../live/fix-paths.js";
+import { pypiScanNote } from "../live/pypi-advice.js";
+import { inEcosystemForm, maxVersion } from "../live/version-compare.js";
+import * as fs from "node:fs";
 import * as path from "node:path";
+import { compiledRequirements } from "../live/lockfile-parsers-pygo.js";
 /** The key a verified target is stored under: one installed copy of a package. */
 export function fixTargetKey(ecosystem, name, version) {
     return `${ecosystem}\0${name}\0${version}`;
@@ -21,6 +26,16 @@ function lockfileCommand(manifest) {
     const base = path.basename(manifest);
     return base === "Cargo.toml" ? "cargo generate-lockfile" : base === "package.json" ? "npm install --package-lock-only" : "your package manager's lock command";
 }
+/** A requirements file that pins only what it lists: not compiled (no `# via`, no compile header) and not hashed. */
+function isFlatRequirements(file) {
+    try {
+        const content = fs.readFileSync(file, "utf-8");
+        return compiledRequirements(content) === null && !/--hash[= ]/.test(content);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * What the scan did NOT cover, so a clean answer is never mistaken for a
  * complete one: lockfiles past the project-tree bounds, and manifests with no
@@ -30,6 +45,11 @@ export function scanCoverage(ctx, relative, detailed) {
     const discovery = ctx.discovery ?? null;
     const unresolved = ctx.unresolved ?? [];
     const notes = [];
+    const problems = ctx.problems ?? [];
+    // UNREADABLE, PARTIAL (entries skipped, audit L5) and REFUSED includes (M4), worded as in every tool.
+    notes.push(...lockfileProblemNotes(problems, relative));
+    const { unreadable, partial, refused } = splitLockfileProblems(problems);
+    notes.push(...exclusionNotes(discovery));
     const walk = discoveryNote(discovery);
     if (walk)
         notes.push(walk);
@@ -47,6 +67,11 @@ export function scanCoverage(ctx, relative, detailed) {
             ? { skipped_lockfiles: discovery.skipped.map((s) => ({ path: s.path, reason: s.reason })) }
             : {}),
         ...(discovery?.walkTruncated ? { walk_truncated: true } : {}),
+        ...(unreadable.length > 0 ? { unreadable_lockfiles: unreadable.map((p) => ({ path: relative(p.file), error: p.error })) } : {}),
+        ...(partial.length > 0 ? { partial_lockfiles: partial.map((p) => ({ path: relative(p.file), skipped_entries: p.skipped ?? 0, reason: p.error })) } : {}),
+        ...(refused.length > 0 ? { refused_includes: refused.map((p) => ({ path: relative(p.file), reason: p.error })) } : {}),
+        ...(discovery?.notCoveredCount ? { not_covered: discovery.notCovered ?? [], not_covered_count: discovery.notCoveredCount } : {}),
+        ...(discovery?.fixtures ? { not_scanned: { test_fixture_lockfiles: discovery.fixtures.count, dirs: discovery.fixtures.dirs } } : {}),
         ...(unresolved.length > 0
             ? {
                 unresolved_manifests: unresolved.map((u) => ({
@@ -58,6 +83,23 @@ export function scanCoverage(ctx, relative, detailed) {
             : {}),
     };
 }
+/**
+ * One `coverage` block for everything the scan did not cover: lockfiles past
+ * the walk's bounds, manifests with no lockfile, and dependencies OSV.dev gave
+ * no answer for. The unchecked count leads the note.
+ */
+export function mergeCoverage(walk, osv) {
+    if (!osv)
+        return walk;
+    return {
+        ...(walk ?? { lockfiles_not_scanned: 0 }),
+        complete: false,
+        note: walk ? `${osv.note} ${walk.note}` : osv.note,
+        unchecked_dependencies: osv.unchecked_dependencies,
+        checked_dependencies: osv.checked_dependencies,
+        osv_status: osv.reason,
+    };
+}
 const SEVERITY_RULE = "`severity` is the grade every 4DA surface presents: a transitive-only dependency caps critical at high, and a dev-only dependency drops one level (critical to high, high to medium, medium to low). Unknown dev scope gets no discount. `advisory_severity` is the advisory's own tier (counted in `advisory_by_severity`); `by_severity` counts the presented grade.";
 const RESOLUTION_NOTE = "Dependency versions were read from these files at resolved_at. Every call re-checks them (stat only) and re-resolves when one changes. `cached` and `osv_cached` describe the OSV advisory lookup, not dependency resolution.";
 /**
@@ -67,7 +109,11 @@ const RESOLUTION_NOTE = "Dependency versions were read from these files at resol
  * other in `aliases`. Reported separately they double the count and read as two
  * problems: `quinn-proto` showed as "2 high" for a single memory-exhaustion
  * bug. Keeps the entry with the most usable detail (a CVSS score, then a fix
- * version) and folds the rest into its alias list.
+ * version) and folds the rest into its alias list. The kept entry carries the
+ * group's MOST severe grade, naming the record it came from (`severityFrom`),
+ * as every other tool does (advisory-groups.ts gradeAliasGroups): keeping the
+ * richest record's own grade showed CVE-2026-4277 as low here and critical in
+ * dependency_check (final release audit of 6.2.5).
  */
 export function collapseAliases(vulns) {
     const kept = [];
@@ -88,8 +134,23 @@ export function collapseAliases(vulns) {
         }
         const incumbent = kept[hitIndex];
         const winner = richness(v) > richness(incumbent) ? v : incumbent;
+        const graver = SEVERITY_RANK[v.severity] > SEVERITY_RANK[incumbent.severity] ? v : incumbent;
+        const severityFrom = graver.severity === winner.severity ? winner.severityFrom : (graver.severityFrom ?? graver.vulnId);
+        // One advisory is fixed only when every record of it is: the group's fix is the highest any
+        // record names. Keeping the richer record's fix offered netmask 1.1.0 for GHSA-4c7m while its
+        // alias GHSA-pch5 is fixed only in 2.0.1 (audit 6.2.5 F-1).
+        const groupFixes = [incumbent.fixedVersion, v.fixedVersion].filter((f) => Boolean(f));
+        const fixedVersion = groupFixes.length > 0 ? maxVersion(groupFixes, v.ecosystem) ?? winner.fixedVersion : winner.fixedVersion;
         const merged = {
             ...winner,
+            fixedVersion,
+            // A notice only when every record of the advisory is one, as the planner's groups decide
+            // (advisory-groups.ts): GHSA-hhw4-xg65-fp2x reads "unsound and unmaintained" and states no
+            // class, its alias RUSTSEC-2025-0068 states `unsound`; kept as the GHSA, serde_yml
+            // 0.0.12 was listed only as a notice (audit 6.2.5 F-7).
+            maintenance: isMaintenanceNotice(incumbent) && isMaintenanceNotice(v),
+            severity: graver.severity,
+            ...(severityFrom ? { severityFrom } : {}),
             aliases: [
                 ...new Set([...incumbent.aliases, ...ids, incumbent.vulnId].filter((id) => id !== winner.vulnId)),
             ],
@@ -156,13 +217,42 @@ export function formatScanResult(result, severityFilter, ctx) {
     const maintenance = onHost.filter((v) => isMaintenanceNotice(v));
     const drift = buildDriftView(result, ctx.drift, ctx.includeDev, relative);
     const host = hostTarget();
-    const activePackages = new Set(active.map((v) => v.package)).size;
+    // Keyed by ecosystem and name, as dependency_health counts them (an npm and a PyPI package of one name are two).
+    const activePackages = new Set(active.map((v) => `${v.ecosystem}\0${v.package}`)).size;
     // Every distinct manifest directory the scan actually covered. A single
     // "project" label hides the fact that a repo root can span several
     // independently-versioned workspaces.
     const scannedProjects = [...new Set(vulns.flatMap((v) => v.sourceDirs ?? []).map(relative))].sort();
-    const coverage = scanCoverage(ctx, relative, true);
+    // Dependencies OSV gave no answer for. Their totals are not totals, so they
+    // are null, and the answer leads with what was not checked (6.2.4 reported
+    // `total_vulnerable_packages: 0` for 10,568 unchecked dependencies).
+    const osvGap = vulnerabilityCoverage(result, { enabled: true });
+    const nothingReadable = result.totalScanned === 0 && (ctx.discovery?.notCoveredCount ?? 0) > 0;
+    const merged = mergeCoverage(scanCoverage(ctx, relative, true), osvGap);
+    // The Go standard library and toolchain are not dependencies in go.mod/go.sum, so their
+    // advisories (GO-* records for package "stdlib"/"toolchain") are not checked; the app reports
+    // them from the go directive. Said, never implied clean (audit 6.2.5 F-5).
+    const goNote = result.ecosystemsScanned.includes("Go")
+        ? "Go: the standard library and toolchain (the go directive) are not checked; run govulncheck for those."
+        : null;
+    // A plain requirements file pins only what it lists: the packages those pins pull in are not
+    // pinned anywhere and were not checked. The scan said nothing, while osv-scanner (resolving the
+    // tree) found virtualenv 21.9.1 under black (audit 6.2.5 A-5). A compiled file (uv / pip-compile,
+    // `# via`) or a hashed one pins the whole tree.
+    const flat = (ctx.resolution?.sources ?? []).filter((src) => src.kind === "manifest" && /requirements[w.-]*.txt$/i.test(src.path) && isFlatRequirements(src.path));
+    const pyNote = flat.length > 0
+        ? `PyPI: ${flat.slice(0, 3).map((src) => relative(src.path)).join(", ")}${flat.length > 3 ? ", ..." : ""} pin${flat.length === 1 ? "s" : ""} only the packages listed; what they depend on is not pinned there and was not checked. Compile it (uv pip compile / pip-compile) or add a lockfile to scan the whole tree.`
+        : null;
+    const extra = [goNote, pyNote].filter((n) => n !== null).join(" ");
+    const coverage = extra
+        ? merged
+            ? { ...merged, note: `${merged.note} ${extra}` }
+            : { complete: false, note: extra, lockfiles_not_scanned: 0 }
+        : merged;
+    const bySeverity = countBySeverity(active, presentedSeverity);
+    const advisoryBySeverity = countBySeverity(active, (v) => v.severity);
     return {
+        ...(osvGap ? { summary: osvGap.note } : {}),
         scan_time: result.scannedAt,
         project: result.projectPath.split(/[/\\]/).pop() || result.projectPath,
         // Present only when the scan is partial; read it before trusting a clean result.
@@ -174,23 +264,39 @@ export function formatScanResult(result, severityFilter, ctx) {
         host_platform: `${host.os}/${host.arch}`,
         ecosystems_scanned: result.ecosystemsScanned,
         total_dependencies_scanned: result.totalScanned,
-        total_vulnerable_packages: activePackages,
+        // The population the counts range over, worded as dependency_health and upgrade_planner word it.
+        ...(ctx.devOnlyCopies !== undefined && ctx.devOnlyCopies > 0
+            ? { dev_scope: ctx.includeDev ? "dev-only copies included" : `${ctx.devOnlyCopies} dev-only cop${ctx.devOnlyCopies === 1 ? "y" : "ies"} left out (include_dev: false)` }
+            : {}),
+        // Null when any dependency went unchecked: see `coverage` and `found_in_checked_dependencies`.
+        // Null too when nothing was scanned beside manifests this server does not read: a Maven-only
+        // project read "0 vulnerable" next to NOT COVERED (audit 6.2.5 A-6).
+        total_vulnerable_packages: osvGap || nothingReadable ? null : activePackages,
         platform_inactive_packages: result.platformInactiveVulnerable,
         // Counted over the listed findings: the same rows `vulnerabilities` shows,
         // one per vulnerability (aliases collapsed). Counting every raw OSV row
         // (alias duplicates, maintenance notices, other-platform advisories) gave
         // "medium 3, low 1, unknown 9" beside three listed rows (2026-10-02 eval).
-        by_severity: countBySeverity(active, presentedSeverity),
-        advisory_by_severity: countBySeverity(active, (v) => v.severity),
-        vulnerabilities: active.map((v) => formatVuln(v, root, drift)),
+        by_severity: osvGap || nothingReadable ? null : bySeverity,
+        advisory_by_severity: osvGap || nothingReadable ? null : advisoryBySeverity,
+        ...(osvGap
+            ? {
+                found_in_checked_dependencies: {
+                    note: `Only ${osvGap.checked_dependencies} of ${osvGap.total_dependencies} dependencies were checked; these counts are a lower bound.`,
+                    vulnerable_packages: activePackages,
+                    by_severity: bySeverity,
+                },
+            }
+            : {}),
+        vulnerabilities: active.map((v) => formatVuln(v, root, drift, ctx.verifiedTargets)),
         // Advisories suppressed from the main list because the affected crate is not
         // built on this host (e.g. cfg(not(windows)) deps on Windows). Surfaced for
         // cross-platform builds, clearly labeled with the gating target.
-        platform_inactive_vulnerabilities: inactive.map((v) => formatVuln(v, root, drift)),
+        platform_inactive_vulnerabilities: inactive.map((v) => formatVuln(v, root, drift, ctx.verifiedTargets)),
         // Unmaintained-dependency notices: real information to plan around, but
         // nothing exploitable and nothing to upgrade to. Separated so they cannot
         // outnumber the advisories that need action today.
-        maintenance_notices: maintenance.map((v) => formatVuln(v, root, drift)),
+        maintenance_notices: maintenance.map((v) => formatVuln(v, root, drift, ctx.verifiedTargets)),
         // npm direct dependencies whose node_modules copy is not what the lockfile
         // pins. The lockfile is what every other tool reads; this is what runs.
         install_drift: drift.rows,
@@ -200,7 +306,8 @@ export function formatScanResult(result, severityFilter, ctx) {
         // that advisory only, and the highest of them can be affected by another
         // (openssl 0.10.79, GHSA-phqj-4mhp-q6mq).
         fix_targets: fixTargets(active, ctx.verifiedTargets),
-        clean_dependencies: result.cleanCount,
+        // Null when any dependency went unchecked: an unanswered dependency is not clean.
+        clean_dependencies: osvGap ? null : result.cleanCount,
         scan_duration_ms: result.scanDurationMs,
         _meta: {
             source: "osv.dev",
@@ -208,7 +315,9 @@ export function formatScanResult(result, severityFilter, ctx) {
             cached: result.cached,
             osv_cached: result.cached,
             offline: result.offline,
-            privacy: "Only package names and versions were sent (public manifest data)",
+            ...(result.staleAnswers ? { stale_osv_answers: result.staleAnswers } : {}),
+            ...(result.aliasSeverity ? { alias_severity: aliasSeverityMeta(result.aliasSeverity) } : {}),
+            privacy: "Only package names and versions were sent (private names included); no source code or file paths",
             // State what actually happened. This previously asserted that advisories
             // WERE platform-filtered while reporting zero inactive packages and
             // listing nine Linux-only crates on a Windows host — a claim of filtering
@@ -242,12 +351,19 @@ function fixTargets(active, verified) {
         const label = `${vulns[0].package}@${vulns[0].currentVersion}`;
         const clean = verified?.get(key);
         if (clean) {
-            const note = targetNote(clean);
-            out[label] = { target: clean.target, checked: "all_advisories", ...(note ? { note } : {}) };
+            const note = targetNote(clean, vulns[0].ecosystem);
+            // Registry facts without the advisory list (H5): a better target, still not checked against every advisory.
+            out[label] = {
+                target: inEcosystemForm(vulns[0].ecosystem, clean.target),
+                checked: targetCheckedAll(clean) ? "all_advisories" : "installed_advisories_only",
+                ...(note ? { note } : {}),
+                // Releases the registry withdrew (yanked, deprecated) that the target steps over, or, with no target, the only fixes there were.
+                ...(clean.withheld.length > 0 ? { withheld: clean.withheld, withheld_note: withheldText(clean, vulns[0].ecosystem) } : {}),
+            };
         }
         else {
             const fixes = vulns.map((v) => v.fixedVersion).filter((f) => Boolean(f));
-            out[label] = { target: fixes.length > 0 ? maxSemver(fixes) : null, checked: "installed_advisories_only" };
+            out[label] = { target: inEcosystemForm(vulns[0].ecosystem, fixes.length > 0 ? maxVersion(fixes, vulns[0].ecosystem) : null), checked: "installed_advisories_only" };
         }
     }
     return out;
@@ -290,17 +406,42 @@ function buildRecommendations(active, all, relative, verified) {
         // Checked against every advisory of the package when that could run: the
         // highest per-advisory fix can itself be affected by another advisory.
         const clean = verified?.get(fixTargetKey(highest.ecosystem, pkg, highest.currentVersion));
-        const target = clean ? clean.target : highestFix;
+        const target = inEcosystemForm(highest.ecosystem, clean ? clean.target : highestFix);
+        // Said in the line itself: an agent runs the command it reads, and a major jump breaks builds.
+        // vitest 0.25.3 -> 4.1.11 read as a plain upgrade (audit 6.2.5 A-2 target check).
+        const major = target && computeSemverDistance(highest.currentVersion, target)?.label === "major" ? " (a major version change: check upgrade_impact)" : "";
         const total = pkgVulns.length;
         const fixable = pkgVulns.filter((v) => v.fixedVersion).length;
         const where = whereOf(copies);
         let text;
-        if (target) {
-            const scope = fixable === total
-                ? `${total} CVE${total > 1 ? "s" : ""}`
-                : `${fixable} of ${total} CVEs (${total - fixable} with no published fix)`;
-            const note = clean ? targetNote(clean) : null;
-            text = `Upgrade ${pkg} ${highest.currentVersion} → ${target}${where} — resolves ${scope} [${breakdown}]${note ? ` (${note})` : ""}`;
+        if (target && clean?.noAdvisoryFix) {
+            text = `Upgrade ${pkg} ${highest.currentVersion} → ${target}${major}${where} — resolves ${total} CVE${total > 1 ? "s" : ""} [${breakdown}] (${targetNote(clean, highest.ecosystem)})`;
+        }
+        else if (!target && clean && clean.withheld.length > 0) {
+            // Every release that fixes it was withdrawn by the registry: "no installable fix", never "no fix published" (FX-H5).
+            text = `Review ${pkg} ${highest.currentVersion}${where} — ${total} known vulnerabilit${total > 1 ? "ies" : "y"} [${breakdown}]; ${withheldText(clean, highest.ecosystem)}`;
+        }
+        else if (target) {
+            // An advisory with no fixed version but only a last affected one is resolved by a target
+            // above it once the target is checked against every advisory (M2: pyjwt PYSEC-2025-183,
+            // last_affected 2.10.1, is past at 2.15.0; it read "12 of 13 CVEs (1 with no published fix)").
+            const unfixed = pkgVulns.filter((v) => !v.fixedVersion);
+            const checkedAll = clean !== undefined && targetCheckedAll(clean) && inEcosystemForm(highest.ecosystem, clean.target) === target;
+            const past = checkedAll ? unfixed.filter((v) => ![v.vulnId, ...(v.aliases ?? [])].some((id) => clean.stillAffectedBy.includes(id))) : [];
+            const resolved = fixable + past.length;
+            const pastNote = past.length > 0
+                ? `${past.map((v) => v.vulnId).join(", ")} name${past.length === 1 ? "s" : ""} no fixed version; ${target} is past ${past.length === 1 ? "its" : "their"} last affected release`
+                : null;
+            const scope = resolved === total
+                ? `${total} CVE${total > 1 ? "s" : ""}${pastNote ? ` (${pastNote})` : ""}`
+                : `${resolved} of ${total} CVEs (${total - resolved} with no published fix${pastNote ? `; ${pastNote}` : ""})`;
+            const note = clean ? targetNote(clean, highest.ecosystem) : null;
+            text = clean
+                ? `Upgrade ${pkg} ${highest.currentVersion} → ${target}${major}${where} — resolves ${scope} [${breakdown}]${note ? ` (${note})` : ""}`
+                : // The check of the target against every advisory of the package did not finish (time
+                    // budget, registry or OSV slow): the advisories' own fix can itself be affected
+                    // (netmask 1.1.0, audit 6.2.5 F-1). Never "resolves" on that.
+                    `Upgrade ${pkg} ${highest.currentVersion}${where} [${breakdown}]: its advisories name ${target}${major} as the fix, but ${target} was NOT CHECKED against every advisory of ${pkg} (the check did not finish); confirm it with dependency_check before pinning it`;
         }
         else if (clean && highestFix) {
             text = `Review ${pkg} ${highest.currentVersion}${where} — ${total} known vulnerabilit${total > 1 ? "ies" : "y"} [${breakdown}]; no published version clears every advisory (${clean.floor} is still affected by ${clean.stillAffectedBy.join(", ")})`;
@@ -308,6 +449,12 @@ function buildRecommendations(active, all, relative, verified) {
         else {
             text = `Review ${pkg} ${highest.currentVersion}${where} — ${total} known vulnerabilit${total > 1 ? "ies" : "y"} [${breakdown}], no fix version published`;
         }
+        if (highest.ecosystem === "PyPI" && target) {
+            // A compiled or fully pinned requirements file is not moved by one `==` edit (audit 6.2.5 A-4).
+            const notes = [...new Set(copies.flatMap((v) => v.sourceDirs ?? []))].map((d) => pypiScanNote(d, pkg, highest.currentVersion)).filter((n) => n !== null);
+            if (notes.length > 0)
+                text += ` — ${[...new Set(notes)].join("; ")}`;
+        }
         lines.push({ rank: rankOf(pkgVulns), text });
     }
     // Installed copies the lockfile does not pin. The lockfile already says what
@@ -341,9 +488,11 @@ function severityBreakdown(vulns) {
         .map((s) => `${counts[s]} ${s}`)
         .join(", ");
 }
-function formatVuln(v, root, drift) {
+function formatVuln(v, root, drift, verified) {
     const presented = presentedSeverity(v);
     const reason = scopeAdjustmentReason(v);
+    // The advisory's own fix as the registry still offers it: never a yanked or deprecated release (FX-H5).
+    const fix = rowFix(v.fixedVersion, verified?.get(fixTargetKey(v.ecosystem, v.package, v.currentVersion)), v.ecosystem);
     return {
         package: v.package,
         current_version: v.currentVersion,
@@ -359,14 +508,32 @@ function formatVuln(v, root, drift) {
         aliases: v.aliases,
         severity: presented,
         advisory_severity: v.severity,
+        // A malicious-package record (MAL- id or alias, CWE-506): the row says so (audit 6.2.5 D-3).
+        ...(v.malware ? { malware: true } : {}),
+        // The record rates nothing; its grade is its GHSA alias's (osv-scanner rateFromAliases).
+        ...(v.severityFrom ? { severity_from: v.severityFrom } : {}),
         ...(reason
             ? { severity_note: `Graded ${presented}: the advisory rates it ${v.severity}, and this is a ${reason}.` }
             : {}),
         cvss_score: v.cvssScore,
         summary: v.summary,
-        fixed_version: v.fixedVersion,
+        fixed_version: inEcosystemForm(v.ecosystem, fix.fixed),
+        ...(fix.withheld.length > 0 ? { withheld: fix.withheld, withheld_note: fix.note } : {}),
         published: v.published,
         references: v.references,
         ...drift.annotate(v),
     };
 }
+/** `_meta.alias_severity`: how many records were graded from a GHSA alias, and which stay unknown, with why. */
+export function aliasSeverityMeta(report) {
+    return {
+        rated_from_alias: report.rated,
+        unresolved: report.unresolved,
+        ungraded: report.ungraded,
+        ...(report.reason
+            ? {
+                note: `${report.ungraded.length > 0 ? `${report.ungraded.length} advisor${report.ungraded.length === 1 ? "y names a GHSA alias but is" : "ies name a GHSA alias but are"} still graded unknown (ungraded). ` : ""}${report.unresolved.length > 0 ? `Alias records not read (unresolved): ${report.reason}; they never lower a grade. ` : ""}Unknown is not clean.`,
+            }
+            : {}),
+    };
+}