@expo/code-review-cli 0.2.3 → 0.4.0

package/build/core/step-summary.js

@@ -0,0 +1,18 @@
+import { appendFile } from "node:fs/promises";
+/**
+ * Append a markdown section to the GitHub Actions step summary, so a run's
+ * output survives on the workflow-run page after the PR comment is upserted
+ * away by the next run. No-op outside Actions (GITHUB_STEP_SUMMARY unset).
+ */
+export async function appendStepSummary(markdown) {
+    const file = process.env.GITHUB_STEP_SUMMARY;
+    if (!file) {
+        return;
+    }
+    try {
+        await appendFile(file, `${markdown}\n\n`, "utf8");
+    }
+    catch {
+        // Observability must never break a review.
+    }
+}

package/build/core/suppress.js

@@ -1,6 +1,6 @@
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
-const DIRECTIVE = 'expo-code-review-ignore';
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+const DIRECTIVE = "expo-code-review-ignore";
 /**
  * Deterministic backstop for the inline `expo-code-review-ignore` directive (which
  * was previously prompt-only, i.e. honored only if the model chose to). Drops a
@@ -20,7 +20,7 @@ export async function applyInlineIgnores(findings, cwd, onProgress) {
             kept.push(finding);
             continue;
         }
-        if (finding.severity === 'critical' || finding.category === 'secrets') {
+        if (finding.severity === "critical" || finding.category === "secrets") {
             kept.push(finding);
             onProgress?.(`  inline-ignore present but NOT honored for ${finding.severity}/${finding.category} "${finding.title}"`);
         }
@@ -40,8 +40,8 @@ async function hasDirectiveNear(finding, cwd, cache) {
         return false;
     }
     const idx = finding.line - 1; // 1-based → 0-based
-    const flagged = lines[idx] ?? '';
-    const above = idx > 0 ? (lines[idx - 1] ?? '') : '';
+    const flagged = lines[idx] ?? "";
+    const above = idx > 0 ? (lines[idx - 1] ?? "") : "";
     return flagged.includes(DIRECTIVE) || above.includes(DIRECTIVE);
 }
 async function readLines(file, cwd, cache) {
@@ -50,7 +50,7 @@ async function readLines(file, cwd, cache) {
     }
     let lines;
     try {
-        lines = (await readFile(path.resolve(cwd, file), 'utf8')).split('\n');
+        lines = (await readFile(path.resolve(cwd, file), "utf8")).split("\n");
     }
     catch {
         lines = null;

package/build/core/tools.js

@@ -1,16 +1,16 @@
 /** The OpenCode tool names the reviewer toggles. Single source of truth so the
  * agent and coordinator tool maps can't drift apart. */
 export const TOOL_NAMES = [
-    'read',
-    'grep',
-    'glob',
-    'list',
-    'bash',
-    'write',
-    'edit',
-    'patch',
+    "read",
+    "grep",
+    "glob",
+    "list",
+    "bash",
+    "write",
+    "edit",
+    "patch",
 ];
 /** Build a full tool map with only the listed tools enabled. */
 export function toolMap(enabled) {
-    return Object.fromEntries(TOOL_NAMES.map(name => [name, enabled.includes(name)]));
+    return Object.fromEntries(TOOL_NAMES.map((name) => [name, enabled.includes(name)]));
 }

package/build/core/util.js

@@ -1,5 +1,5 @@
 export function sleep(ms) {
-    return new Promise(resolve => setTimeout(resolve, ms));
+    return new Promise((resolve) => setTimeout(resolve, ms));
 }
 /** Extract a human-readable message from an unknown thrown value. */
 export function errorMessage(error) {
@@ -7,5 +7,5 @@ export function errorMessage(error) {
 }
 /** Collapse whitespace + lowercase — for tolerant code matching / fingerprinting. */
 export function normalizeCode(text) {
-    return text.replace(/\s+/g, ' ').trim().toLowerCase();
+    return text.replace(/\s+/g, " ").trim().toLowerCase();
 }

package/build/core/verify.js

@@ -1,9 +1,9 @@
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
-import { parseVerdict } from './schema.js';
-import { addTokenUsage, promptAndParse, VERIFIER_AGENT } from './opencode.js';
-import { buildVerifierSystem, buildVerifierTask } from './prompts.js';
-import { errorMessage, normalizeCode } from './util.js';
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { parseVerdict } from "./schema.js";
+import { addTokenUsage, promptAndParse, VERIFIER_AGENT } from "./opencode.js";
+import { buildVerifierSystem, buildVerifierTask } from "./prompts.js";
+import { errorMessage, normalizeCode } from "./util.js";
 // Verification runs after coordination (a serial tail step); keep it short. It
 // runs criticals in parallel, so this bounds the added latency regardless of count.
 const VERIFY_TIMEOUT_MS = 3 * 60 * 1000;
@@ -18,9 +18,9 @@ const MIN_EVIDENCE_LEN = 12;
 export function evidenceFragments(evidence) {
     return evidence
         .split(/\r?\n|…|\.\.\./)
-        .map(line => line.replace(/^[+\-\s]*/, '').replace(/^(\/\/+|#+|\*+|\/\*)\s?/, ''))
+        .map((line) => line.replace(/^[+\-\s]*/, "").replace(/^(\/\/+|#+|\*+|\/\*)\s?/, ""))
         .map(normalizeCode)
-        .filter(fragment => fragment.length >= MIN_EVIDENCE_LEN);
+        .filter((fragment) => fragment.length >= MIN_EVIDENCE_LEN);
 }
 /**
  * Does the finding's `evidence` correspond to code in the file?
@@ -36,28 +36,28 @@ export function evidenceFragments(evidence) {
 export function matchEvidence(evidence, content) {
     const normEvidence = normalizeCode(evidence);
     if (normEvidence.length < MIN_EVIDENCE_LEN) {
-        return 'unknown';
+        return "unknown";
     }
     const normContent = normalizeCode(content);
     if (normContent.includes(normEvidence)) {
-        return 'present';
+        return "present";
     }
     const fragments = evidenceFragments(evidence);
     if (fragments.length === 0) {
-        return 'unknown';
+        return "unknown";
     }
-    return fragments.some(fragment => normContent.includes(fragment)) ? 'present' : 'absent';
+    return fragments.some((fragment) => normContent.includes(fragment)) ? "present" : "absent";
 }
 /** Read the cited file and grade the evidence against it (see matchEvidence). */
 async function evidencePresence(finding, cwd) {
     let content;
     try {
-        content = await readFile(path.resolve(cwd, finding.file), 'utf8');
+        content = await readFile(path.resolve(cwd, finding.file), "utf8");
     }
     catch {
-        return 'unknown';
+        return "unknown";
     }
-    return matchEvidence(finding.evidence ?? '', content);
+    return matchEvidence(finding.evidence ?? "", content);
 }
 /**
  * Guard against hallucinated findings before they're surfaced, WITHOUT silently
@@ -88,20 +88,20 @@ export async function verifyFindings(handle, findings, cwd, onProgress) {
     const verdicts = new Map();
     const toVerify = [];
     for (const { finding, presence } of checked) {
-        if (presence === 'absent' || finding.severity === 'critical') {
+        if (presence === "absent" || finding.severity === "critical") {
             toVerify.push({ finding, presence });
         }
         else {
-            verdicts.set(finding, 'keep'); // grounded (or uncheckable) non-critical
+            verdicts.set(finding, "keep"); // grounded (or uncheckable) non-critical
         }
     }
     // Phase 2 — LLM verify (parallel). Refuted → drop; verified or errored → keep.
     await Promise.all(toVerify.map(async ({ finding, presence }, index) => {
         try {
-            const { value, cost: verifyCost, tokens: verifyTokens } = await promptAndParse(handle, {
+            const { value, cost: verifyCost, tokens: verifyTokens, } = await promptAndParse(handle, {
                 agent: VERIFIER_AGENT,
                 system: buildVerifierSystem(),
-                text: buildVerifierTask(finding, { evidenceUngrounded: presence === 'absent' }),
+                text: buildVerifierTask(finding, { evidenceUngrounded: presence === "absent" }),
                 title: `verify-${index}`,
                 maxWaitMs: VERIFY_TIMEOUT_MS,
                 finalizeOnTimeout: true,
@@ -109,21 +109,21 @@ export async function verifyFindings(handle, findings, cwd, onProgress) {
             cost += verifyCost;
             addTokenUsage(tokens, verifyTokens);
             if (value.verified) {
-                verdicts.set(finding, 'keep');
+                verdicts.set(finding, "keep");
             }
             else {
-                verdicts.set(finding, 'drop');
-                dropped.push({ finding, reason: value.reason || 'refuted by verifier' });
-                onProgress?.(`  verify: dropped ${finding.severity} "${finding.title}" — ${value.reason || 'refuted by verifier'}`);
+                verdicts.set(finding, "drop");
+                dropped.push({ finding, reason: value.reason || "refuted by verifier" });
+                onProgress?.(`  verify: dropped ${finding.severity} "${finding.title}" — ${value.reason || "refuted by verifier"}`);
             }
         }
         catch (error) {
             // Fail open: keep the finding if verification itself failed.
-            verdicts.set(finding, 'keep');
+            verdicts.set(finding, "keep");
             onProgress?.(`  verify: could not verify "${finding.title}" (${errorMessage(error)}); keeping it`);
         }
     }));
     // Preserve original order.
-    const kept = findings.filter(finding => verdicts.get(finding) === 'keep');
+    const kept = findings.filter((finding) => verdicts.get(finding) === "keep");
     return { kept, dropped, cost, tokens };
 }

package/build/reporters/github.js

@@ -1,11 +1,12 @@
-import { writeFile, mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { run } from '../core/exec.js';
-import { parseUnifiedDiff } from '../core/diff.js';
-import { buildDiffLineIndex, commentMarker, parseReviewState, renderMarkdown } from '../core/render.js';
-import { fingerprintFinding } from '../core/schema.js';
-const MAINTAINER_ASSOCIATIONS = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
+import { writeFile, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { run } from "../core/exec.js";
+import { parseUnifiedDiff } from "../core/diff.js";
+import { buildDiffLineIndex, commentMarker, parseReviewState, renderAggregateMarkdown, renderMarkdown, } from "../core/render.js";
+import { fingerprintFinding, scopedFingerprint } from "../core/schema.js";
+import { appendStepSummary } from "../core/step-summary.js";
+const MAINTAINER_ASSOCIATIONS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 /**
  * Maintains exactly one PR comment, updating it in place across re-reviews (and
  * cleaning up duplicates) so the review converges instead of churning. Runs the
@@ -20,9 +21,9 @@ export class GitHubReporter {
     }
     async checkBreakGlass() {
         const comments = await this.fetchAllComments();
-        return comments.some(comment => typeof comment.body === 'string' &&
+        return comments.some((comment) => typeof comment.body === "string" &&
             comment.body.includes(this.options.breakGlassMarker) &&
-            MAINTAINER_ASSOCIATIONS.has(comment.author_association ?? ''));
+            MAINTAINER_ASSOCIATIONS.has(comment.author_association ?? ""));
     }
     async postSkipNote() {
         await this.upsertComment(`${this.marker}\n🤖 AI review skipped via \`${this.options.breakGlassMarker}\`.`);
@@ -37,6 +38,38 @@ export class GitHubReporter {
         const link = await this.linkContextAsync();
         await this.upsertComment(renderMarkdown(review, this.options.commentTag, dismissed, link));
     }
+    /** Post/update the aggregate multi-scope comment (comment:'single' mode). */
+    async reportAggregate(results, unmatchedFiles) {
+        const existing = await this.findExistingComment();
+        const dismissed = existing
+            ? (parseReviewState(existing.body, this.options.commentTag)?.dismissed ?? [])
+            : [];
+        const link = await this.linkContextAsync();
+        await this.upsertComment(renderAggregateMarkdown(results, this.options.commentTag, dismissed, link, {
+            unmatchedFiles,
+        }));
+    }
+    /**
+     * The embedded review state of the existing reviewer comment, or null when no
+     * comment (or no parseable state) exists. A partial ci run (--scopes) uses this
+     * to carry the non-rerun scopes' previous results into the new aggregate.
+     */
+    async readState() {
+        const existing = await this.findExistingComment();
+        return existing ? parseReviewState(existing.body, this.options.commentTag) : null;
+    }
+    /**
+     * Delete every comment carrying THIS reporter's full marker (stale-scope cleanup /
+     * mode switch). Only ever touches its own marker — `<!-- tag -->` is not a substring
+     * of `<!-- tag:scope -->`, so root vs scoped markers can't cross-match (the
+     * reviewdog #1911 lesson).
+     */
+    async clear() {
+        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
+        for (const comment of marked) {
+            await this.deleteComment(comment.id);
+        }
+    }
     /**
      * PR context for turning finding locations into links: the set of lines actually
      * in the diff (for in-diff findings → diff-anchor links) and the base commit SHA
@@ -44,13 +77,18 @@ export class GitHubReporter {
      * soft — a missing piece just degrades to a plain-text location, never a dead link.
      */
     async linkContextAsync() {
+        // A prebuilt context (ci fan-out, one fetch shared across scopes) wins — skip
+        // the two `gh` calls entirely.
+        if (this.options.linkContext) {
+            return this.options.linkContext;
+        }
         const link = { repo: this.options.repo, prNumber: this.options.prNumber };
-        const prArgs = [String(this.options.prNumber), '--repo', this.options.repo];
+        const prArgs = [String(this.options.prNumber), "--repo", this.options.repo];
         const cwd = this.options.cwd;
         await Promise.all([
             (async () => {
                 try {
-                    const { stdout } = await run('gh', ['pr', 'diff', ...prArgs], { cwd });
+                    const { stdout } = await run("gh", ["pr", "diff", ...prArgs], { cwd });
                     link.diffLines = buildDiffLineIndex(parseUnifiedDiff(stdout));
                 }
                 catch {
@@ -59,7 +97,9 @@ export class GitHubReporter {
             })(),
             (async () => {
                 try {
-                    const { stdout } = await run('gh', ['pr', 'view', ...prArgs, '--json', 'baseRefOid'], { cwd });
+                    const { stdout } = await run("gh", ["pr", "view", ...prArgs, "--json", "baseRefOid"], {
+                        cwd,
+                    });
                     const oid = JSON.parse(stdout).baseRefOid;
                     if (oid) {
                         link.baseSha = oid;
@@ -79,30 +119,38 @@ export class GitHubReporter {
     async applyDismissal(add, remove, by, reason) {
         const existing = await this.findExistingComment();
         if (!existing) {
-            throw new Error('No reviewer comment found on this PR yet — run a review first.');
+            throw new Error("No reviewer comment found on this PR yet — run a review first.");
         }
         const state = parseReviewState(existing.body, this.options.commentTag);
         if (!state) {
-            throw new Error('The reviewer comment has no embedded state (posted before dismissals existed); re-run a review first.');
+            throw new Error("The reviewer comment has no embedded state (posted before dismissals existed); re-run a review first.");
         }
-        const validFps = new Set(state.review.findings.map(fingerprintFinding));
-        const matched = add.filter(fp => validFps.has(fp));
-        const unmatched = add.filter(fp => !validFps.has(fp));
-        let dismissed = state.dismissed.filter(record => !remove.includes(record.fp));
+        // Scope-aware validity: on an aggregate comment the ids are scope-namespaced, so
+        // validate against every scope's scoped fingerprints; otherwise the plain ones.
+        const isAggregate = Array.isArray(state.scopes) && state.scopes.length > 0;
+        const validFps = isAggregate
+            ? new Set(state.scopes.flatMap((scope) => scope.review.findings.map((finding) => scopedFingerprint(scope.isDefault ? null : scope.scope, finding))))
+            : new Set(state.review.findings.map(fingerprintFinding));
+        const matched = add.filter((fp) => validFps.has(fp));
+        const unmatched = add.filter((fp) => !validFps.has(fp));
+        const dismissed = state.dismissed.filter((record) => !remove.includes(record.fp));
         for (const fp of matched) {
-            if (!dismissed.some(record => record.fp === fp)) {
+            if (!dismissed.some((record) => record.fp === fp)) {
                 dismissed.push({ fp, by, reason });
             }
         }
         const link = await this.linkContextAsync();
-        await this.patchComment(existing.id, renderMarkdown(state.review, this.options.commentTag, dismissed, link));
+        const body = isAggregate
+            ? renderAggregateMarkdown(state.scopes, this.options.commentTag, dismissed, link)
+            : renderMarkdown(state.review, this.options.commentTag, dismissed, link);
+        await this.patchComment(existing.id, body);
         return { dismissedCount: dismissed.length, matched, unmatched };
     }
     /** Newest reviewer-tagged comment (id + body), or null if none posted yet. */
     async findExistingComment() {
-        const marked = (await this.fetchAllComments()).filter(comment => comment.body?.includes(this.marker));
+        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
         const keep = marked[marked.length - 1];
-        return keep ? { id: keep.id, body: keep.body ?? '' } : null;
+        return keep ? { id: keep.id, body: keep.body ?? "" } : null;
     }
     // Safety cap on pagination (100/page): 30 pages = 3000 comments. Bounds a
     // pathological PR; virtually every real PR exits far earlier.
@@ -118,14 +166,14 @@ export class GitHubReporter {
     async fetchAllComments() {
         const all = [];
         for (let page = 1; page <= GitHubReporter.MAX_COMMENT_PAGES; page++) {
-            const { stdout } = await run('gh', [
-                'api',
-                '-X',
-                'GET',
+            const { stdout } = await run("gh", [
+                "api",
+                "-X",
+                "GET",
                 `repos/${this.options.repo}/issues/${this.options.prNumber}/comments`,
-                '-f',
-                'per_page=100',
-                '-f',
+                "-f",
+                "per_page=100",
+                "-f",
                 `page=${page}`,
             ], { cwd: this.options.cwd });
             let batch;
@@ -151,23 +199,27 @@ export class GitHubReporter {
      * is the newest and is the keeper.
      */
     async upsertComment(body) {
-        const marked = (await this.fetchAllComments()).filter(comment => comment.body?.includes(this.marker));
+        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
         if (marked.length === 0) {
             await this.createComment(body);
-            return;
         }
-        const keep = marked[marked.length - 1];
-        const duplicates = marked.slice(0, -1);
-        await this.patchComment(keep.id, body);
-        for (const duplicate of duplicates) {
-            await this.deleteComment(duplicate.id);
+        else {
+            const keep = marked[marked.length - 1];
+            const duplicates = marked.slice(0, -1);
+            await this.patchComment(keep.id, body);
+            for (const duplicate of duplicates) {
+                await this.deleteComment(duplicate.id);
+            }
         }
+        // Mirror the exact posted body into the Actions step summary: the PR comment
+        // is upserted in place, so this is the only per-run record of what was posted.
+        await appendStepSummary(`### 🤖 AI review — posted comment\n\n${body}`);
     }
     async withBodyFile(body, fn) {
-        const dir = await mkdtemp(path.join(tmpdir(), 'ecr-'));
-        const jsonPath = path.join(dir, 'comment.json');
+        const dir = await mkdtemp(path.join(tmpdir(), "ecr-"));
+        const jsonPath = path.join(dir, "comment.json");
         try {
-            await writeFile(jsonPath, JSON.stringify({ body }), 'utf8');
+            await writeFile(jsonPath, JSON.stringify({ body }), "utf8");
             return await fn(jsonPath);
         }
         finally {
@@ -175,26 +227,26 @@ export class GitHubReporter {
         }
     }
     async createComment(body) {
-        await this.withBodyFile(body, jsonPath => run('gh', [
-            'api',
-            '-X',
-            'POST',
+        await this.withBodyFile(body, (jsonPath) => run("gh", [
+            "api",
+            "-X",
+            "POST",
             `repos/${this.options.repo}/issues/${this.options.prNumber}/comments`,
-            '--input',
+            "--input",
             jsonPath,
         ], { cwd: this.options.cwd }));
     }
     async patchComment(commentId, body) {
-        await this.withBodyFile(body, jsonPath => run('gh', [
-            'api',
-            '-X',
-            'PATCH',
+        await this.withBodyFile(body, (jsonPath) => run("gh", [
+            "api",
+            "-X",
+            "PATCH",
             `repos/${this.options.repo}/issues/comments/${commentId}`,
-            '--input',
+            "--input",
             jsonPath,
         ], { cwd: this.options.cwd }));
     }
     async deleteComment(commentId) {
-        await run('gh', ['api', '-X', 'DELETE', `repos/${this.options.repo}/issues/comments/${commentId}`], { cwd: this.options.cwd });
+        await run("gh", ["api", "-X", "DELETE", `repos/${this.options.repo}/issues/comments/${commentId}`], { cwd: this.options.cwd });
     }
 }

package/build/reporters/terminal.js

@@ -1,6 +1,6 @@
-import { decisionExitCode, decisionLabel, groupBySeverity, sortFindings, } from '../core/render.js';
-import { SEVERITIES } from '../core/schema.js';
-const ESC = '';
+import { decisionExitCode, decisionLabel, groupBySeverity, sortFindings } from "../core/render.js";
+import { SEVERITIES } from "../core/schema.js";
+const ESC = "";
 const RESET = `${ESC}[0m`;
 const BOLD = `${ESC}[1m`;
 const DIM = `${ESC}[2m`;
@@ -10,9 +10,9 @@ const COLORS = {
     suggestion: `${ESC}[36m`,
 };
 const SEVERITY_LABEL = {
-    critical: 'CRITICAL',
-    warning: 'WARNING',
-    suggestion: 'SUGGESTION',
+    critical: "CRITICAL",
+    warning: "WARNING",
+    suggestion: "SUGGESTION",
 };
 /**
  * Prints a human-readable summary grouped by severity; honors --json; never
@@ -38,19 +38,19 @@ export class TerminalReporter {
         process.exitCode = this.options.noFail ? 0 : decisionExitCode(review.decision);
     }
     renderPretty(review) {
-        const out = [''];
+        const out = [""];
         out.push(this.paint(BOLD, `AI code review — ${decisionLabel(review.decision)}`));
-        out.push(this.tally(review.findings), '');
-        out.push(review.summary, '');
+        out.push(this.tally(review.findings), "");
+        out.push(review.summary, "");
         if (review.incomplete.length > 0) {
-            out.push(this.paint(BOLD, '⏱️  Coverage note: some passes did not finish (partial coverage):'));
+            out.push(this.paint(BOLD, "⏱️  Coverage note: some passes did not finish (partial coverage):"));
             for (const note of review.incomplete) {
                 out.push(this.paint(DIM, `  - ${note}`));
             }
-            out.push('');
+            out.push("");
         }
         if (review.findings.length === 0) {
-            out.push(this.paint(DIM, 'No findings.'), '');
+            out.push(this.paint(DIM, "No findings."), "");
         }
         else {
             const groups = groupBySeverity(sortFindings(review.findings));
@@ -59,21 +59,21 @@ export class TerminalReporter {
                 if (findings.length === 0) {
                     continue;
                 }
-                out.push(this.paint(`${BOLD}${COLORS[severity]}`, `${SEVERITY_LABEL[severity]} (${findings.length})`), '');
+                out.push(this.paint(`${BOLD}${COLORS[severity]}`, `${SEVERITY_LABEL[severity]} (${findings.length})`), "");
                 for (const finding of findings) {
                     out.push(this.renderFinding(finding));
                 }
             }
         }
-        return `${out.join('\n')}\n`;
+        return `${out.join("\n")}\n`;
     }
     /** One-line count headline, e.g. "2 critical · 5 warning". */
     tally(findings) {
-        const parts = SEVERITIES.map(severity => {
-            const n = findings.filter(finding => finding.severity === severity).length;
+        const parts = SEVERITIES.map((severity) => {
+            const n = findings.filter((finding) => finding.severity === severity).length;
             return n > 0 ? this.paint(COLORS[severity], `${n} ${severity}`) : null;
         }).filter((part) => part !== null);
-        return parts.length > 0 ? parts.join(this.paint(DIM, ' · ')) : this.paint(DIM, 'no findings');
+        return parts.length > 0 ? parts.join(this.paint(DIM, " · ")) : this.paint(DIM, "no findings");
     }
     renderFinding(finding) {
         const loc = finding.line != null ? `${finding.file}:${finding.line}` : finding.file;
@@ -83,9 +83,9 @@ export class TerminalReporter {
             `  ${finding.rationale}`,
         ];
         if (finding.suggestion) {
-            lines.push(`  ${this.paint(DIM, 'Suggestion:')} ${finding.suggestion}`);
+            lines.push(`  ${this.paint(DIM, "Suggestion:")} ${finding.suggestion}`);
         }
-        return `${lines.join('\n')}\n`;
+        return `${lines.join("\n")}\n`;
     }
     paint(codes, text) {
         return this.color ? `${codes}${text}${RESET}` : text;

package/build/sources/github-pr.js

@@ -1,8 +1,8 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { run } from '../core/exec.js';
-import { parseUnifiedDiff } from '../core/diff.js';
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { run } from "../core/exec.js";
+import { parseUnifiedDiff } from "../core/diff.js";
 /**
  * Pulls PR diff + metadata through the `gh` CLI, which is preinstalled and
  * authenticated on GitHub Actions runners via GH_TOKEN.
@@ -13,27 +13,27 @@ export class GitHubPRSource {
         this.options = options;
     }
     repoArgs() {
-        return this.options.repo ? ['--repo', this.options.repo] : [];
+        return this.options.repo ? ["--repo", this.options.repo] : [];
     }
     async getMetadata() {
-        const { stdout } = await run('gh', [
-            'pr',
-            'view',
+        const { stdout } = await run("gh", [
+            "pr",
+            "view",
             String(this.options.prNumber),
             ...this.repoArgs(),
-            '--json',
-            'title,body,baseRefName,headRefName',
+            "--json",
+            "title,body,baseRefName,headRefName",
         ], { cwd: this.options.cwd });
         const parsed = JSON.parse(stdout);
         return {
-            title: parsed.title ?? '',
-            body: parsed.body ?? '',
-            baseRef: parsed.baseRefName ?? '',
-            headRef: parsed.headRefName ?? '',
+            title: parsed.title ?? "",
+            body: parsed.body ?? "",
+            baseRef: parsed.baseRefName ?? "",
+            headRef: parsed.headRefName ?? "",
         };
     }
     async getChangedFiles() {
-        const { stdout } = await run('gh', ['pr', 'diff', String(this.options.prNumber), ...this.repoArgs()], { cwd: this.options.cwd });
+        const { stdout } = await run("gh", ["pr", "diff", String(this.options.prNumber), ...this.repoArgs()], { cwd: this.options.cwd });
         return parseUnifiedDiff(stdout);
     }
     /**
@@ -54,16 +54,16 @@ export class GitHubPRSource {
         const ref = `refs/pull/${this.options.prNumber}/head`;
         let parent;
         try {
-            await run('git', ['fetch', '--no-tags', '--depth=1', url, ref], { cwd });
-            parent = await mkdtemp(path.join(tmpdir(), 'ecr-prhead-'));
-            const dir = path.join(parent, 'head'); // must not pre-exist for `worktree add`
-            await run('git', ['worktree', 'add', '--detach', dir, 'FETCH_HEAD'], { cwd });
+            await run("git", ["fetch", "--no-tags", "--depth=1", url, ref], { cwd });
+            parent = await mkdtemp(path.join(tmpdir(), "ecr-prhead-"));
+            const dir = path.join(parent, "head"); // must not pre-exist for `worktree add`
+            await run("git", ["worktree", "add", "--detach", dir, "FETCH_HEAD"], { cwd });
             const removeParent = parent;
             return {
                 dir,
                 cleanup: async () => {
                     try {
-                        await run('git', ['worktree', 'remove', '--force', dir], { cwd });
+                        await run("git", ["worktree", "remove", "--force", dir], { cwd });
                     }
                     catch {
                         // best effort — fall through to removing the temp dir