@bugb-technologies/bravos 0.0.0-stage → 1.0.1

package/dist/watch-frame.js

@@ -0,0 +1,593 @@
+// @comment -- "Draws bravos watch's frames: a header bar, a row of number tiles, bordered panels (setup, threat model, test next, top threats and assets, code graph, SAST, branch and team, the model's size, activity) arranged in three, two or one columns by terminal width, a scrollable body and a key bar. Pure: text in, text out. Colour is added per segment after layout, so the plain and coloured frames have the same characters, and every glyph that carries meaning (severity, bars) differs in plain text too."
+/* ------------------------------------------------------------------ segments */
+// Brand palette (bravos), plus amber for warnings and medium severity.
+const C = {
+    green: '#33d49d',
+    deep: '#1f3943',
+    ink: '#0e1b21',
+    blue: '#0360a2',
+    light: '#f0f0f0',
+    steel: '#55899e',
+    slate: '#3b6779',
+    red: '#ea1d1d',
+    amber: '#f0b429',
+    white: '#ffffff',
+    line: '#2b4f5c',
+};
+const s = (t, c, b, bg) => ({ t, c, b, bg });
+const len = (l) => l.reduce((n, x) => n + [...x.t].length, 0);
+const nf = (n) => (n === null || n === undefined ? '?' : n.toLocaleString('en-US'));
+/** Cuts a line of segments to width characters (an ellipsis on the cut) and pads it with spaces when pad is set; the padding takes padBg. */
+export function fitLine(l, width, pad = false, padBg) {
+    const out = [];
+    let left = width;
+    for (const seg of l) {
+        if (left <= 0)
+            break;
+        const chars = [...seg.t];
+        if (chars.length <= left) {
+            out.push(seg);
+            left -= chars.length;
+        }
+        else {
+            out.push({ ...seg, t: chars.slice(0, Math.max(0, left - 1)).join('') + '…' });
+            left = 0;
+        }
+    }
+    if (pad && left > 0)
+        out.push(s(' '.repeat(left), undefined, false, padBg));
+    return out;
+}
+const ESC = '\x1b[';
+const rgb = (hex) => `${parseInt(hex.slice(1, 3), 16)};${parseInt(hex.slice(3, 5), 16)};${parseInt(hex.slice(5, 7), 16)}`;
+export const renderLine = (l, color) => l
+    .map((x) => (color && (x.c || x.b || x.bg) ? `${x.b ? `${ESC}1m` : ''}${x.c ? `${ESC}38;2;${rgb(x.c)}m` : ''}${x.bg ? `${ESC}48;2;${rgb(x.bg)}m` : ''}${x.t}${ESC}0m` : x.t))
+    .join('');
+/* ------------------------------------------------------------------ small pieces */
+const SEV = ['critical', 'high', 'medium', 'low'];
+const sevColor = (sev) => (sev === 'critical' || sev === 'high' ? C.red : sev === 'medium' ? C.amber : C.steel);
+// Each severity has its own glyph so the stacked bar reads without colour.
+const sevGlyph = { critical: '█', high: '▓', medium: '▒', low: '░', unset: '·' };
+const badge = (sev) => {
+    const label = ` ${{ critical: 'CRIT', high: 'HIGH', medium: 'MED', low: 'LOW' }[sev]?.padEnd(4) ?? ' —  '} `;
+    return sev === 'critical' || sev === 'high' ? s(label, C.white, true, C.red) : sev === 'medium' ? s(label, C.ink, true, C.amber) : s(label, C.light, false, C.slate);
+};
+/** hh:mm in the local time zone; an unparseable time shows as --:--. */
+export const time = (iso) => {
+    const d = new Date(iso);
+    return Number.isNaN(d.getTime()) ? '--:--' : `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`;
+};
+/** How long ago, short: 40s, 12m, 3h, 2d. */
+export const ago = (iso, now) => {
+    const ms = new Date(now).getTime() - new Date(iso).getTime();
+    if (!Number.isFinite(ms))
+        return '?';
+    const sec = Math.max(0, Math.round(ms / 1000));
+    return sec < 60 ? `${sec}s` : sec < 3600 ? `${Math.round(sec / 60)}m` : sec < 86400 ? `${Math.round(sec / 3600)}h` : `${Math.round(sec / 86400)}d`;
+};
+const plural = (n, word) => `${nf(n)} ${word}${n === 1 ? '' : 's'}`;
+const bar = (pct, width, c) => {
+    const w = Math.max(1, width);
+    const on = Math.max(0, Math.min(w, Math.round((pct / 100) * w)));
+    return [s('█'.repeat(on), c), s('░'.repeat(w - on), C.line)];
+};
+/** One bar split by severity, worst first, each part in its own glyph and colour. */
+function sevBar(by, width) {
+    const total = SEV.reduce((n, k) => n + (by[k] ?? 0), 0);
+    if (!total)
+        return [s('░'.repeat(width), C.line)];
+    const parts = SEV.map((k) => ({ k, n: by[k] ?? 0, w: Math.floor(((by[k] ?? 0) / total) * width) }));
+    // Every non-empty severity gets at least one cell; the rest of the width goes to the largest.
+    for (const p of parts)
+        if (p.n > 0 && p.w === 0)
+            p.w = 1;
+    const used = parts.reduce((n, p) => n + p.w, 0);
+    const big = parts.reduce((a, b) => (b.n > a.n ? b : a));
+    big.w = Math.max(0, big.w + width - used);
+    return parts.filter((p) => p.w > 0).map((p) => s(sevGlyph[p.k].repeat(p.w), sevColor(p.k)));
+}
+/** A bar split into named parts, each with its glyph and colour. */
+function partsBar(parts, width) {
+    const total = parts.reduce((n, p) => n + p.n, 0);
+    if (!total)
+        return [s('░'.repeat(width), C.line)];
+    const out = [];
+    let used = 0;
+    parts.forEach((p, k) => {
+        const w = k === parts.length - 1 ? width - used : Math.round((p.n / total) * width);
+        if (w > 0)
+            out.push(s(p.glyph.repeat(w), p.c));
+        used += Math.max(0, w);
+    });
+    return out;
+}
+const SPARK = '▁▂▃▄▅▆▇█';
+/** A sparkline of values, scaled between their min and max; flat when they do not move. */
+export function sparkline(values, width) {
+    const v = values.slice(-width);
+    if (!v.length)
+        return '';
+    const lo = Math.min(...v);
+    const hi = Math.max(...v);
+    return v.map((x) => SPARK[hi === lo ? 3 : Math.round(((x - lo) / (hi - lo)) * (SPARK.length - 1))]).join('');
+}
+/** Keeps the end of a long path, where the file name is, and cuts the start. */
+export const tailPath = (p, w) => {
+    const c = [...p];
+    return c.length <= w || w < 4 ? p : '…' + c.slice(c.length - (w - 1)).join('');
+};
+/** A rounded box of exactly w columns: the title in the top edge, the body cut to fit. */
+function box(p, w) {
+    const inner = Math.max(1, w - 4);
+    const title = ` ${p.title} `;
+    const right = p.right ? ` ${p.right} ` : '';
+    let fill = w - 3 - [...title].length - [...right].length - 1;
+    const top = fill >= 1 ? [s('╭─', C.line), s(title, C.green, true), s('─'.repeat(fill), C.line), s(right, p.rightColor ?? C.steel), s('─╮', C.line)] : [];
+    if (!top.length) {
+        fill = Math.max(0, w - 3 - [...title].length);
+        top.push(...fitLine([s('╭─', C.line), s(title, C.green, true), s('─'.repeat(fill), C.line)], w - 1), s('╮', C.line));
+    }
+    const body = p.body.map((l) => [s('│ ', C.line), ...fitLine(l, inner, true), s(' │', C.line)]);
+    return [top, ...body, [s('╰' + '─'.repeat(Math.max(0, w - 2)) + '╯', C.line)]];
+}
+/** A row of number tiles, three lines high: label in the top edge, the value large-ish in the middle. */
+function tiles(items, width) {
+    const gap = 1;
+    // Wide enough for the longest label in its top edge.
+    const minW = Math.max(12, ...items.map((x) => [...x.label].length + 6));
+    const n = Math.max(1, Math.min(items.length, Math.floor((width + gap) / (minW + gap))));
+    const shown = items.slice(0, n);
+    const w = Math.floor((width - gap * (n - 1)) / n);
+    const rows = [[], [], []];
+    shown.forEach((t, k) => {
+        const label = ` ${t.label} `;
+        const lw = Math.max(0, w - 3 - [...label].length);
+        rows[0].push(...fitLine([s('╭─', C.line), s(label, C.steel), s('─'.repeat(lw), C.line)], w - 1), s('╮', C.line));
+        const val = [s(t.value, t.c, true), ...(t.sub ? [s((t.sub.startsWith('/') ? '' : ' ') + t.sub, C.steel)] : [])];
+        const lead = Math.max(0, Math.floor((w - 2 - len(val)) / 2));
+        rows[1].push(s('│', C.line), ...fitLine([s(' '.repeat(lead)), ...val], w - 2, true), s('│', C.line));
+        rows[2].push(s('╰' + '─'.repeat(Math.max(0, w - 2)) + '╯', C.line));
+        if (k < shown.length - 1)
+            rows.forEach((r) => r.push(s(' '.repeat(gap))));
+    });
+    return rows;
+}
+function setupPanel(sn, inner) {
+    const pct = sn.setup.total ? Math.round((sn.setup.done / sn.setup.total) * 100) : 0;
+    const body = [[...bar(pct, inner - 6, C.green), s(` ${String(pct).padStart(3)}%`, C.green, true)]];
+    for (const x of sn.setup.items) {
+        const isNext = sn.setup.next && x.label === sn.setup.next.label;
+        body.push(x.on ? [s('✔ ', C.green), s(x.label)] : isNext ? [s('▸ ', C.green, true), s(x.label, C.green, true)] : [s('· ', C.slate), s(x.label, C.steel)]);
+    }
+    if (sn.setup.next) {
+        body.push([], [s('next ', C.steel), s(sn.setup.next.cta, C.green, true)]);
+        if (sn.setup.next.how)
+            body.push([s(sn.setup.next.how, C.steel)]);
+    }
+    else
+        body.push([], [s('everything bravos can use here is on', C.green)]);
+    return { title: 'SETUP', right: `${sn.setup.done}/${sn.setup.total}`, rightColor: C.green, body };
+}
+function modelPanel(sn, inner, history) {
+    if (!sn.counts) {
+        return { title: 'THREAT MODEL', right: 'unknown', rightColor: C.amber, body: [[s(sn.guardlink === 'missing' ? 'guardlink not found → bravos doctor' : 'counts unknown (guardlink ci unavailable)', C.amber)]] };
+    }
+    const c = sn.counts;
+    const body = [sevBar(c.bySeverity, inner)];
+    const legend = [];
+    for (const k of SEV)
+        legend.push(s(`${sevGlyph[k]} `, sevColor(k)), s(`${c.bySeverity[k] ?? 0} ${k}`, (c.bySeverity[k] ?? 0) > 0 ? sevColor(k) : C.steel, k === 'critical' || k === 'high'), s('  '));
+    body.push(legend);
+    if (sn.ledger) {
+        const L = sn.ledger;
+        const total = L.untested + L.confirmed + L.refuted + L.retest;
+        body.push([]);
+        body.push([s('tested ', C.steel), s(`${L.confirmed + L.refuted}/${total}`, C.light, true), s(` · ${L.confirmed} confirmed · ${L.refuted} refuted · ${L.retest} retest`, C.steel)]);
+        body.push(partsBar([
+            { n: L.confirmed, glyph: '█', c: C.red },
+            { n: L.retest, glyph: '▓', c: C.amber },
+            { n: L.refuted, glyph: '▒', c: C.green },
+            { n: L.untested, glyph: '░', c: C.line },
+        ], inner));
+    }
+    if (sn.boundaries) {
+        const B = sn.boundaries;
+        body.push([s('boundaries ', C.steel), s(`${B.supported} held`, B.supported ? C.green : C.steel), s(' · '), s(`${B.contradicted} broken`, B.contradicted ? C.red : C.steel), s(` · ${B.unverified} unverified${B.retest ? ` · ${B.retest} retest` : ''}`, C.steel)]);
+    }
+    if (sn.coverage) {
+        body.push([]);
+        body.push([s('coverage ', C.steel), s(`${sn.coverage.percent}%`, C.light, true), s(` · ${nf(sn.coverage.annotated)}/${nf(sn.coverage.source)} files · ${nf(sn.coverage.source - sn.coverage.annotated)} left`, C.steel)]);
+        body.push(bar(sn.coverage.percent, inner, C.blue));
+    }
+    if (sn.claims) {
+        const k = sn.claims;
+        body.push([s(`${nf(k.annotations)} annotations · `, C.steel), s(`${c.stale} stale`, c.stale ? C.amber : C.steel), s(` · ${k.drift} drift · ${k.orphans} orphans`, C.steel), ...(k.parseErrors ? [s(` · ${k.parseErrors} parse errors`, C.red)] : [])]);
+        body.push([s(`${k.acceptances} accepted risk${k.acceptances === 1 ? '' : 's'}`, C.steel), ...(k.expiringAcceptances ? [s(` · ${k.expiringAcceptances} expiring`, C.amber)] : []), s(sn.tickets !== null ? ` · ${plural(sn.tickets, 'ticket')}` : '', C.steel)]);
+    }
+    if (history.length > 1) {
+        const w = Math.max(8, inner - 24);
+        body.push([s('open this session ', C.steel), s(sparkline(history.map((h) => h.open ?? 0), w), C.amber), s(` ${c.open}`, C.light, true)]);
+        if (history.some((h) => h.coverage !== null))
+            body.push([s('coverage          ', C.steel), s(sparkline(history.map((h) => h.coverage ?? 0), w), C.blue), s(` ${sn.coverage?.percent ?? '?'}%`, C.light, true)]);
+    }
+    return { title: 'THREAT MODEL', right: `${c.open} open`, rightColor: c.open ? C.amber : C.green, body };
+}
+function nextPanel(sn, max, inner) {
+    const body = [];
+    if (!sn.next.length)
+        body.push([s(sn.counts ? 'nothing queued' : 'unknown', C.steel)]);
+    for (const q of sn.next.slice(0, max)) {
+        body.push([badge(q.severity), s(' '), s(q.threat, C.light, true), s(` on ${q.asset}`, C.steel), s(`  ${q.state}`, q.state === 'retest' ? C.amber : C.slate)]);
+        body.push([s('       '), s(tailPath(`${q.file}:${q.line ?? '?'}`, inner - 7), C.steel)]);
+    }
+    if (sn.next.length)
+        body.push([s('prove ', C.steel), s('/bravos-prove', C.green), s(' · testable ', C.steel), s('/bravos-templatize', C.green)]);
+    return { title: 'TEST NEXT', right: 'guardlink hypothesis next', body };
+}
+function topPanel(sn, inner) {
+    const body = [];
+    const max = Math.max(1, ...sn.top.map((t) => t.count), ...sn.topAssets.map((a) => a.count));
+    const row = (sev, name, count) => {
+        const bw = Math.max(4, Math.min(14, Math.floor(inner / 4)));
+        const filled = Math.max(1, Math.round((count / max) * bw));
+        return [s(`${sevGlyph[sev] ?? '·'} `, sevColor(sev)), s(name.padEnd(Math.max(8, inner - bw - 6)).slice(0, Math.max(8, inner - bw - 6))), s(' '), s('■'.repeat(filled), sevColor(sev)), s(' '.repeat(bw - filled)), s(String(count).padStart(3), C.light, true)];
+    };
+    body.push([s('by threat', C.steel)]);
+    if (!sn.top.length)
+        body.push([s(sn.counts ? 'none open' : 'unknown', C.steel)]);
+    for (const t of sn.top)
+        body.push(row(t.severity, t.threat, t.count));
+    if (sn.topAssets.length) {
+        body.push([], [s('by asset', C.steel)]);
+        for (const a of sn.topAssets)
+            body.push(row(a.severity, a.asset, a.count));
+    }
+    return { title: 'TOP THREATS · ASSETS', body };
+}
+function graphPanel(sn, inner) {
+    const g = sn.graph;
+    const d = g.detail;
+    if (g.state === 'unavailable')
+        return { title: 'CODE GRAPH', right: 'off', body: [[s(sn.plan.licensed ? 'codegraph-mcp not installed' : 'on the Team plan', C.steel)], [s(sn.plan.licensed ? '→ bravos setup --codegraph, then bravos graph build .' : '→ bravos account activate (30-day trial)', C.steel)]] };
+    if (g.state === 'not-built') {
+        return {
+            title: 'CODE GRAPH',
+            right: 'not built',
+            rightColor: C.amber,
+            body: [[s(`no graph for this commit (${sn.sha})`, C.amber)], [s('bravos keys the graph to the commit: rebuild after you commit', C.steel)], [s('→ bravos graph build . --scip no-exec', C.green)]],
+        };
+    }
+    if (!d) {
+        const body = g.entryPoints !== null ? [[s(`${g.entryPoints} entry points`)]] : [[s('askable: bravos graph <question>', C.steel)]];
+        return { title: 'CODE GRAPH', right: 'asking…', body };
+    }
+    const body = [];
+    body.push([s(`${nf(d.files)} files`, C.light), s(` · ${nf(d.callables)} callables · ${nf(d.callEdges)} calls`, C.steel)]);
+    if (d.testFiles !== null)
+        body.push([s(`${nf(d.testFiles)} test files`, C.steel)]);
+    for (const l of d.languages) {
+        const pct = Math.round(l.ratio * 100);
+        const label = `${l.language} calls `.padEnd(10);
+        body.push([s(label, C.steel), ...bar(pct, Math.max(6, inner - label.length - 9), l.sufficient ? C.green : C.amber), s(` ${String(pct).padStart(3)}% `, l.sufficient ? C.green : C.amber, true), s(l.sufficient ? '✔' : '!', l.sufficient ? C.green : C.amber)]);
+    }
+    if (d.languages.some((l) => !l.sufficient))
+        body.push([s('low resolution: "not reached" is weak evidence', C.amber)]);
+    if (d.entry) {
+        const kinds = Object.entries(d.entry.byKind).map(([k, v]) => `${v} ${k.replace(/_/g, ' ')}`).join(', ');
+        body.push([], [s('entry points ', C.steel), s(String(d.entry.total), C.light, true), s(kinds ? `  ${kinds}` : '', C.steel), ...(d.entry.unbound ? [s(` · ${d.entry.unbound} unbound`, C.amber)] : [])]);
+    }
+    if (d.routes) {
+        const lv = d.routes.byLevel;
+        const parts = ['public', 'authenticated', 'elevated', 'unknown'].filter((k) => lv[k]).map((k) => s(`${lv[k]} ${k}  `, k === 'public' ? C.amber : k === 'unknown' ? C.steel : C.green));
+        body.push([s('routes ', C.steel), s(`${d.routes.total}  `, C.light, true), ...parts]);
+    }
+    if (d.tests) {
+        const pct = d.tests.total ? Math.round((d.tests.reached / d.tests.total) * 100) : 0;
+        body.push([s('tests reach ', C.steel), s(`${d.tests.reached}/${d.tests.total}`, C.light, true), s(' declared exposures ', C.steel), ...bar(pct, Math.max(4, inner - 34), C.blue)]);
+    }
+    if (d.acceptances)
+        body.push([s(`accepted risks ${d.acceptances.total}`, C.steel), ...(d.acceptances.expiring ? [s(` · ${d.acceptances.expiring} expiring`, C.amber)] : [])]);
+    if (d.hotspots.length) {
+        body.push([], [s('hot files with open exposures', C.steel)]);
+        for (const h of d.hotspots.slice(0, 3))
+            body.push([s('▲ ', C.amber), s(tailPath(h.file, inner - 16)), s(`  ${h.commits} commits`, C.steel)]);
+    }
+    // When the graph was asked, not built: bravos reports no build time.
+    const right = `${d.currency ?? '?'} · asked ${time(d.askedAt)}`;
+    return { title: 'CODE GRAPH', right, rightColor: d.currency === 'current' ? C.green : C.amber, body };
+}
+function sastPanel(sn) {
+    if (!sn.sast) {
+        return { title: 'SAST', right: sn.sastAvailable ? 'not run' : 'off', body: [[s(sn.sastAvailable ? 'bravos-cli ready → "run SAST" (bravos-sast)' : 'unavailable here → bravos doctor', C.steel)]] };
+    }
+    const x = sn.sast;
+    return {
+        title: 'SAST',
+        right: x.staleCommits ? `${x.staleCommits} commits behind` : 'current',
+        rightColor: x.staleCommits ? C.amber : C.green,
+        body: [
+            [s(`${x.total}`, C.light, true), s(' findings · ', C.steel), s(`${x.reachable} reachable`, x.reachable ? C.amber : C.steel), s(' · ', C.steel), s(`${x.unjoinedReachable} not in the model`, x.unjoinedReachable ? C.red : C.steel)],
+            [s('→ bravos sast candidates', C.green)],
+        ],
+    };
+}
+function teamPanel(sn, inner) {
+    const b = sn.branchWork;
+    const body = [];
+    const ab = b.ahead !== null && b.ahead !== undefined ? `  ↑${b.ahead} ↓${b.behind ?? 0}` : '';
+    body.push([s(sn.branch ?? '(detached)', C.light, true), s(sn.base ? ` → ${sn.base}` : '', C.steel), s(ab, C.steel)]);
+    if (b.uncommitted !== null) {
+        body.push([s(plural(b.uncommitted, 'uncommitted file'), b.uncommitted ? C.light : C.steel), ...(b.unannotatedChanged ? [s(` · ${b.unannotatedChanged} without annotations`, C.amber)] : [])]);
+        for (const f of (b.files ?? []).slice(0, 4))
+            body.push([s(`  ${f.status.padEnd(2)} `, f.status === 'D' ? C.red : f.status === '??' ? C.steel : C.amber), s(tailPath(f.path, inner - 6), C.steel)]);
+        if ((b.files?.length ?? 0) > 4)
+            body.push([s(`  +${(b.uncommitted ?? 0) - 4} more`, C.slate)]);
+    }
+    if (b.commits?.length) {
+        body.push([], [s('recent commits', C.steel)]);
+        for (const c of b.commits.slice(0, 3))
+            body.push([s(`${c.sha} `, C.blue), s(`${ago(c.at, sn.at).padStart(3)} `, C.steel), s(c.subject)]);
+    }
+    else if (b.lastCommit)
+        body.push([s(`last commit: ${b.lastCommit}`, C.steel)]);
+    body.push([]);
+    body.push(sn.team.prs === null ? [s('PRs unknown (gh unavailable)', C.steel)] : [s(`${sn.team.prs} open PRs`, C.light), s(` · ${nf(sn.team.files)} files in flight`, C.steel)]);
+    const hook = (id, name) => {
+        const it = sn.setup.items.find((x) => x.id === id);
+        return it ? [s(`${name} `, C.steel), s(it.on ? 'on' : 'off', it.on ? C.green : C.slate), s('  ')] : [];
+    };
+    body.push([...hook('autopilot', 'autopilot'), ...hook('prepr', 'pre-PR'), ...hook('ci', 'CI')]);
+    body.push([s('intent ', C.steel), s(sn.intent, sn.intent === 'none' ? C.amber : C.green), s(' · proving ', C.steel), s(sn.proving, sn.proving === 'not set' ? C.slate : C.green)]);
+    if (sn.review.drafted)
+        body.push([s(`intent review: ${sn.review.answers.length} answered${sn.review.answers.length ? ` (${sn.review.answers.map((a) => a.by).join(', ')})` : ''}`, C.steel)]);
+    if (sn.bravos?.repo && sn.bravos.repo !== sn.bravos.cli)
+        body.push([s(`skills here ${sn.bravos.repo}, bravos ${sn.bravos.cli} → bravos sync`, C.amber)]);
+    return { title: 'BRANCH · TEAM', body };
+}
+// @comment -- "The REPORT panel: the newest bravos-report write-up's title, kind and age, its findings by evidence level and severity, the check verdict, exported formats and how far HEAD has moved since its evidence; or how to write one."
+function reportPanel(sn, inner) {
+    const r = sn.report ?? null;
+    if (!r)
+        return { title: 'REPORT', right: 'none yet', body: [[s('no report yet → ask "write the assessment report"', C.steel)], [s('/bravos-report', C.green), s(' · bravos report data', C.steel)]] };
+    const body = [[s(r.title ?? '(report.md not written yet)', C.light, true)]];
+    body.push([s(`${r.kind} · ${ago(r.createdAt, sn.at)} ago`, C.steel), ...(r.commitsBehind ? [s(` · ${r.commitsBehind} commit${r.commitsBehind === 1 ? '' : 's'} since its evidence`, C.amber)] : [])]);
+    if (r.check) {
+        const L = r.check.byLevel;
+        const sev = ['critical', 'high', 'medium', 'low'].filter((k) => r.check.bySeverity[k]);
+        body.push([s(`${r.check.findings} finding${r.check.findings === 1 ? '' : 's'}  `, C.light, true), ...sev.flatMap((k) => [badge(k), s(` ${r.check.bySeverity[k]}  `, C.light)])]);
+        body.push([
+            s(`${L.reproduced ?? 0} reproduced`, (L.reproduced ?? 0) ? C.red : C.steel),
+            s(' · ', C.steel),
+            s(`${L.held ?? 0} held`, (L.held ?? 0) ? C.green : C.steel),
+            s(' · ', C.steel),
+            s(`${L['code-review'] ?? 0} review`, (L['code-review'] ?? 0) ? C.blue : C.steel),
+            s(' · ', C.steel),
+            s(`${L.suspected ?? 0} suspected`, C.steel),
+        ]);
+        body.push(r.check.ok ? [s('✔ check passes', C.green), ...(r.check.warnings ? [s(` · ${r.check.warnings} warning${r.check.warnings === 1 ? '' : 's'}`, C.steel)] : [])] : [s(`✘ ${r.check.errors} problem${r.check.errors === 1 ? '' : 's'}`, C.red), s(` → bravos report check ${r.id}`, C.steel)]);
+        for (const f of r.index.slice(0, Math.max(0, Math.min(4, Math.floor(inner / 20)))))
+            body.push([s(`${f.id} `, C.blue), s(tailPath(f.title, inner - 5))]);
+    }
+    else
+        body.push([s('not checked yet → bravos report check', C.steel)]);
+    body.push([s('exports ', C.steel), s(r.exports.length ? r.exports.join(' ') : 'none', r.exports.length ? C.light : C.steel), s('   p view · o open', C.slate)]);
+    return { title: 'REPORT', right: r.id, body };
+}
+// @comment -- "The SERVICES panel for a repo in a bravos workspace: one row per service (this one marked) with open, high and confirmed counts and coverage, then the cross-service edge count, the edges that touch this service, and unresolved references. Empty outside a workspace."
+function servicesPanel(sn, inner) {
+    const w = sn.workspace;
+    if (!w)
+        return null;
+    const body = [];
+    const nameW = Math.min(14, Math.max(6, ...w.members.map((m) => m.name.length)));
+    for (const m of w.members.slice(0, 8)) {
+        const c = m.counts;
+        const high = c ? (c.bySeverity.critical ?? 0) + (c.bySeverity.high ?? 0) : 0;
+        body.push([
+            s(m.name === w.member ? '▸ ' : '  ', C.green, true),
+            s(m.name.padEnd(nameW).slice(0, nameW), m.name === w.member ? C.light : C.steel, m.name === w.member),
+            ...(c
+                ? [s(`  ${String(c.open).padStart(3)} open`, c.open ? C.light : C.steel), s(`  ${high} high+`, high ? C.red : C.steel), s(`  ${c.confirmed} conf`, c.confirmed ? C.red : C.steel), s(`  ${c.coverage ?? '?'}%`, C.steel)]
+                : [s('  counts not read yet', C.slate)]),
+        ]);
+    }
+    if (w.members.length > 8)
+        body.push([s(`  +${w.members.length - 8} more · s`, C.slate)]);
+    if (!w.edges)
+        body.push([s('edges unknown → bravos workspace show', C.steel)]);
+    else {
+        body.push([s(`${w.edges.length} cross-service edge${w.edges.length === 1 ? '' : 's'}`, C.light), ...(w.unresolved.length ? [s(` · ${w.unresolved.length} unresolved`, C.amber)] : []), ...(w.clashes ? [s(` · ${w.clashes} clash${w.clashes === 1 ? '' : 'es'}`, C.amber)] : [])]);
+        const mine = w.member ? w.edges.filter((e) => e.srcMember === w.member || e.dstMember === w.member) : w.edges;
+        for (const e of mine.slice(0, 4))
+            body.push([s('  '), s(e.srcMember, e.srcMember === w.member ? C.light : C.steel), s(' → ', C.green), s(e.dstMember, e.dstMember === w.member ? C.light : C.steel), s(tailPath(`  ${e.src} → ${e.dst}`, Math.max(10, inner - e.srcMember.length - e.dstMember.length - 5)), C.slate)]);
+    }
+    body.push([s('s all services and edges', C.slate)]);
+    return { title: 'SERVICES', right: `${w.name}${w.isAppFolder ? ' · app folder' : ''}`, body };
+}
+function sizePanel(sn, inner) {
+    const m = sn.model;
+    if (!m)
+        return { title: 'MODEL', right: 'guardlink status', body: [[s('unknown', C.steel)]] };
+    const keys = ['assets', 'threats', 'controls', 'actors', 'mitigations', 'exposures', 'flows', 'boundaries', 'audits', 'assumptions', 'data handling', 'validations', 'reaches', 'effects'].filter((k) => m[k] !== undefined);
+    const cellW = 18;
+    const perRow = Math.max(1, Math.floor((inner + 1) / cellW));
+    const body = [];
+    for (let k = 0; k < keys.length; k += perRow) {
+        const row = [];
+        for (const key of keys.slice(k, k + perRow))
+            row.push(s(nf(m[key]).padStart(6), C.light, true), s(` ${key}`.padEnd(cellW - 6), C.steel));
+        body.push(row);
+    }
+    return { title: 'MODEL', right: 'guardlink status', body };
+}
+const kindIcon = {
+    autopilot: ['◆', C.green],
+    'exposure+': ['▲', C.amber],
+    'exposure-': ['▼', C.green],
+    confirmed: ['✖', C.red],
+    refuted: ['✔', C.green],
+    boundary: ['◇', C.green],
+    stale: ['⟳', C.amber],
+    coverage: ['◔', C.blue],
+    model: ['+', C.blue],
+    setup: ['✔', C.green],
+    sast: ['◈', C.green],
+    graph: ['◎', C.blue],
+    pr: ['⇅', C.steel],
+    review: ['✎', C.green],
+    commit: ['●', C.blue],
+    files: ['✎', C.steel],
+    report: ['❏', C.green],
+    workspace: ['⇄', C.blue],
+};
+function activityPanel(events, max, title = 'ACTIVITY') {
+    const body = [];
+    if (!events.length)
+        body.push([s('nothing yet — changes appear here as you and the agent work', C.steel)]);
+    for (const e of events.slice(-max).reverse()) {
+        const [icon, c] = kindIcon[e.kind] ?? ['·', C.steel];
+        body.push([s(time(e.at) + ' ', C.steel), s(icon + ' ', c), s(e.kind === 'autopilot' ? 'autopilot ' : '', C.green, true), s(e.text, e.kind === 'confirmed' ? C.red : undefined)]);
+        if (e.hint)
+            body.push([s('        → ' + e.hint, C.slate)]);
+    }
+    return { title, right: `${events.length} event${events.length === 1 ? '' : 's'}`, body };
+}
+/** Three columns from 150, two from 110, one bordered column from 80, compact below. */
+export const layoutFor = (width, compact = false) => (compact || width < 80 ? 'compact' : width >= 150 ? 'wide' : width >= 110 ? 'two' : 'pane');
+const KEYS = [
+    ['n', 'next'],
+    ['r', 'review'],
+    ['d', 'dashboard'],
+    ['g', 'graph'],
+    ['t', 'test-next'],
+    ['i', 'intent'],
+    ['p', 'report'],
+    ['s', 'services'],
+    ['o', 'open'],
+    ['u', 'update'],
+    ['j/k', 'scroll'],
+    ['?', 'guide'],
+    ['q', 'quit'],
+];
+// Keys dropped first when the bar does not fit; quit always stays.
+const DROP_ORDER = ['u', 'o', 's', 'd', '?', 'i', 'p', 't', 'r', 'g', 'j/k', 'n'];
+function keyBar(width) {
+    let keys = KEYS;
+    const chips = (ks) => ks.flatMap(([k, label]) => [s(` ${k} `, C.ink, true, C.green), s(` ${label}  `, C.steel)]);
+    for (const k of DROP_ORDER) {
+        if (len(chips(keys)) <= width)
+            break;
+        keys = keys.filter(([x]) => x !== k);
+    }
+    return chips(keys);
+}
+function header(sn, width, opts) {
+    const left = [s(' ◆ bravos watch ', C.green, true, C.deep), s(' ', undefined, false, C.deep), s(sn.repo, C.white, true, C.deep), s(`  ${sn.branch ?? '(detached)'} @ ${sn.sha}`, C.steel, false, C.deep), s(`  ${sn.plan.label}`, sn.plan.licensed ? C.green : C.amber, false, C.deep)];
+    const st = opts.stats;
+    const right = [
+        s(opts.status ?? '● live', opts.status?.startsWith('updating') ? C.amber : C.green, true, C.deep),
+        ...(st ? [s(` · #${st.refreshes}${st.lastMs !== null ? ` ${(st.lastMs / 1000).toFixed(1)}s` : ''}`, C.steel, false, C.deep)] : []),
+        s(' · 0 tokens ', C.steel, false, C.deep),
+    ];
+    const gap = width - len(left) - len(right);
+    if (gap >= 1)
+        return [...left, s(' '.repeat(gap), undefined, false, C.deep), ...right];
+    return fitLine([...left, s(' ', undefined, false, C.deep), right[0]], width, true, C.deep);
+}
+function tileItems(sn) {
+    const c = sn.counts;
+    const high = c ? (c.bySeverity.critical ?? 0) + (c.bySeverity.high ?? 0) : null;
+    const res = sn.graph.detail?.languages ?? [];
+    const worst = res.length ? res.reduce((a, b) => (b.ratio < a.ratio ? b : a)) : null;
+    const L = sn.ledger;
+    return [
+        { label: 'OPEN', value: c ? String(c.open) : '?', c: c?.open ? C.amber : C.green },
+        { label: 'HIGH+', value: high === null ? '?' : String(high), c: high ? C.red : C.green },
+        { label: 'CONFIRMED', value: c ? String(c.confirmed) : '?', c: c?.confirmed ? C.red : C.green },
+        { label: 'TESTED', value: L ? String(L.confirmed + L.refuted) : c?.tested !== null && c ? String(c.tested) : '?', c: C.light, sub: L ? `/${L.untested + L.confirmed + L.refuted + L.retest}` : undefined },
+        { label: 'COVERAGE', value: sn.coverage ? `${sn.coverage.percent}%` : '?', c: (sn.coverage?.percent ?? 0) >= 80 ? C.green : C.amber },
+        { label: 'STALE', value: c ? String(c.stale) : '?', c: c?.stale ? C.amber : C.green },
+        { label: 'SETUP', value: `${sn.setup.done}/${sn.setup.total}`, c: C.green },
+        { label: 'GRAPH', value: worst ? `${Math.round(worst.ratio * 100)}%` : sn.graph.state === 'not-built' ? 'none' : sn.graph.state === 'unavailable' ? 'off' : '—', c: worst ? (worst.sufficient ? C.green : C.amber) : C.steel, sub: worst ? worst.language : undefined },
+        { label: 'SAST', value: sn.sast ? String(sn.sast.total) : sn.sastAvailable ? 'ready' : 'off', c: sn.sast?.unjoinedReachable ? C.red : C.steel },
+    ];
+}
+/** Lays columns of lines side by side, each padded to its width. */
+function joinColumns(cols, widths, gap) {
+    const rows = Math.max(...cols.map((c) => c.length));
+    const out = [];
+    for (let r = 0; r < rows; r++) {
+        const line = [];
+        cols.forEach((c, k) => {
+            line.push(...fitLine(c[r] ?? [], widths[k], k < cols.length - 1));
+            if (k < cols.length - 1)
+                line.push(s(' '.repeat(gap)));
+        });
+        out.push(line);
+    }
+    return out;
+}
+const stack = (panels, w) => panels.flatMap((p) => box(p, w));
+const opt = (p) => (p ? [p] : []);
+// @comment -- "Draws one frame for a terminal width and height: header and tiles stay at the top, the key bar at the bottom, and the panels between scroll when they are taller than the terminal; maxScroll tells the loop how far scrolling can go."
+export function renderFrame(sn, events, opts) {
+    const width = Math.max(40, opts.width);
+    const color = opts.color ?? false;
+    const layout = layoutFor(width, opts.compact);
+    const history = opts.history ?? [];
+    const top = [header(sn, width, opts)];
+    let body;
+    if (layout === 'compact') {
+        const c = sn.counts;
+        top.push([s(`setup ${sn.setup.done}/${sn.setup.total}`, C.green, true), s(sn.setup.next ? ` · next ${sn.setup.next.cta}` : '', C.steel)], c ? [s(`open ${c.open}`, C.amber, true), s(` · high ${(c.bySeverity.critical ?? 0) + (c.bySeverity.high ?? 0)}`, C.red), s(` · confirmed ${c.confirmed} · coverage ${sn.coverage?.percent ?? '?'}%`)] : [s('counts unknown', C.amber)]);
+        const w = width;
+        body = stack([activityPanel(events, 4, 'CHANGED JUST NOW'), ...opt(servicesPanel(sn, w - 4)), nextPanel(sn, 3, w - 4), modelPanel(sn, w - 4, history), reportPanel(sn, w - 4), setupPanel(sn, w - 4), graphPanel(sn, w - 4), teamPanel(sn, w - 4), sastPanel(sn)], w);
+    }
+    else {
+        top.push(...tiles(tileItems(sn), width));
+        if (layout === 'pane') {
+            const w = width;
+            const inner = w - 4;
+            body = stack([activityPanel(events, 5, 'CHANGED JUST NOW'), ...opt(servicesPanel(sn, inner)), nextPanel(sn, 4, inner), modelPanel(sn, inner, history), reportPanel(sn, inner), setupPanel(sn, inner), graphPanel(sn, inner), teamPanel(sn, inner), topPanel(sn, inner), sastPanel(sn), sizePanel(sn, inner)], w);
+        }
+        else if (layout === 'two') {
+            const gap = 1;
+            const w = Math.floor((width - gap) / 2);
+            const w2 = width - gap - w;
+            body = joinColumns([
+                stack([activityPanel(events, 6), ...opt(servicesPanel(sn, w - 4)), nextPanel(sn, 5, w - 4), modelPanel(sn, w - 4, history), topPanel(sn, w - 4)], w),
+                stack([setupPanel(sn, w2 - 4), graphPanel(sn, w2 - 4), teamPanel(sn, w2 - 4), sastPanel(sn), reportPanel(sn, w2 - 4), sizePanel(sn, w2 - 4)], w2),
+            ], [w, w2], gap);
+        }
+        else {
+            const gap = 1;
+            const w = Math.floor((width - gap * 2) / 3);
+            const w3 = width - gap * 2 - w * 2;
+            body = joinColumns([
+                stack([setupPanel(sn, w - 4), graphPanel(sn, w - 4), sastPanel(sn), reportPanel(sn, w - 4)], w),
+                stack([modelPanel(sn, w - 4, history), nextPanel(sn, 5, w - 4), sizePanel(sn, w - 4)], w),
+                stack([activityPanel(events, 8), ...opt(servicesPanel(sn, w3 - 4)), teamPanel(sn, w3 - 4), topPanel(sn, w3 - 4)], w3),
+            ], [w, w, w3], gap);
+        }
+    }
+    const bottom = [];
+    if (opts.note)
+        bottom.push([s('› ', C.green, true), s(opts.note, C.light)]);
+    bottom.push(keyBar(width));
+    let maxScroll = 0;
+    if (opts.height) {
+        const room = Math.max(1, opts.height - top.length - bottom.length);
+        if (body.length > room) {
+            // One line of the room says where the view is.
+            const view = Math.max(1, room - 1);
+            maxScroll = body.length - view;
+            const at = Math.max(0, Math.min(opts.scroll ?? 0, maxScroll));
+            const shown = body.slice(at, at + view);
+            const pos = [s(`  ${at > 0 ? '▲' : ' '} ${at + 1}–${at + shown.length} of ${body.length} lines ${at < maxScroll ? '▼' : ' '}  j/k or ↑/↓ to scroll`, C.slate)];
+            body = [...shown, pos];
+        }
+    }
+    const lines = [...top, ...body, ...bottom].map((l) => fitLine(l, width));
+    return { text: lines.map((l) => renderLine(l, color)).join('\n'), maxScroll };
+}
+export const buildFrame = (sn, events, opts) => renderFrame(sn, events, opts).text;