@iceinvein/agent-skills 0.1.24 → 0.1.26

package/skills/magpie/scripts/__tests__/file-tree.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, test } from 'bun:test'
+import {
+  buildTree,
+  collapseTree,
+  countDirFindings,
+  type DirNode,
+  findingCountsBySeverity,
+} from '../file-tree.ts'
+import type { PrFileEntry, ReviewFinding } from '../types.ts'
+
+const files: PrFileEntry[] = [
+  { path: 'src/a.ts', additions: 5, deletions: 1 },
+  { path: 'src/b.ts', additions: 2, deletions: 0 },
+  { path: 'src/deep/only.ts', additions: 1, deletions: 0 },
+  { path: 'README.md', additions: 3, deletions: 0 },
+]
+
+const findings: ReviewFinding[] = [
+  {
+    id: '1',
+    file: 'src/a.ts',
+    line: 1,
+    severity: 'blocker',
+    title: 't',
+    description: 'd',
+    risk: { impact: 'high', likelihood: 'likely', confidence: 'high', action: 'must-fix' },
+    domain: 'security',
+  },
+  {
+    id: '2',
+    file: 'src/a.ts',
+    line: 2,
+    severity: 'high',
+    title: 't',
+    description: 'd',
+    risk: { impact: 'high', likelihood: 'likely', confidence: 'high', action: 'should-fix' },
+    domain: 'bugs',
+  },
+  {
+    id: '3',
+    file: 'src/deep/only.ts',
+    line: 1,
+    severity: 'medium',
+    title: 't',
+    description: 'd',
+    risk: { impact: 'medium', likelihood: 'possible', confidence: 'medium', action: 'consider' },
+    domain: 'bugs',
+  },
+] as ReviewFinding[]
+
+describe('buildTree', () => {
+  test('groups files by directory', () => {
+    const tree = buildTree(files)
+    expect(tree.dirs.has('src')).toBe(true)
+    expect(tree.files.find((f) => f.path === 'README.md')).toBeDefined()
+  })
+
+  test('nests deep directories', () => {
+    const tree = buildTree(files)
+    const src = tree.dirs.get('src')
+    if (!src) throw new Error('expected src dir')
+    expect(src.dirs.has('deep')).toBe(true)
+    expect(src.dirs.get('deep')?.files.map((f) => f.path)).toEqual(['src/deep/only.ts'])
+  })
+})
+
+describe('collapseTree', () => {
+  test('collapses nested single-child dirs like apps/server/lib', () => {
+    const f: PrFileEntry[] = [{ path: 'apps/server/lib/x.ts', additions: 1, deletions: 0 }]
+    const tree = collapseTree(buildTree(f))
+    const first = [...tree.dirs.values()][0]
+    if (!first) throw new Error('expected one dir')
+    expect(first.name).toBe('apps/server/lib')
+  })
+})
+
+describe('findingCountsBySeverity', () => {
+  test('returns severity counts for a file in canonical order', () => {
+    const counts = findingCountsBySeverity(findings, 'src/a.ts')
+    expect(counts).toEqual([
+      { severity: 'blocker', count: 1 },
+      { severity: 'high', count: 1 },
+    ])
+  })
+
+  test('returns empty array when the file has no findings', () => {
+    expect(findingCountsBySeverity(findings, 'README.md')).toEqual([])
+  })
+})
+
+describe('countDirFindings', () => {
+  test('sums findings across all files in a subtree', () => {
+    const tree = collapseTree(buildTree(files))
+    const src = tree.dirs.get('src') as DirNode | undefined
+    if (src) expect(countDirFindings(findings, src)).toBe(3)
+  })
+})

package/skills/magpie/scripts/__tests__/gh.test.ts

@@ -26,6 +26,14 @@ test('fetchPr writes pr.json and diff.patch', async () => {
   expect(diff).toContain('export const x = 2')
 })
 
+test('fetchPr includes files in pr.json', async () => {
+  const result = await fetchPr({ ghBin: FAKE_GH, prNumber: 1234, runDir })
+  expect(result.ok).toBe(true)
+  const pr = JSON.parse(await readFile(join(runDir, 'pr.json'), 'utf8'))
+  expect(Array.isArray(pr.files)).toBe(true)
+  expect(pr.files[0]).toMatchObject({ path: 'src/a.ts', additions: 1, deletions: 0 })
+})
+
 test('fetchPr returns ok=false when gh exits non-zero', async () => {
   const result = await fetchPr({
     ghBin: '/usr/bin/false',

package/skills/magpie/scripts/__tests__/helper.test.ts

@@ -57,3 +57,66 @@ test('helper.js sends periodic heartbeats', async () => {
   expect(src).toContain("fetch('/heartbeat'")
   expect(src).toMatch(/setInterval/)
 })
+
+test('helper.js dispatches set-view and toggles body.dataset.view', async () => {
+  const src = await readFile(HELPER, 'utf8')
+  expect(src).toContain('handleSetView')
+  expect(src).toMatch(/document\.body\.dataset\.view\s*=\s*view/)
+})
+
+test('helper.js handles select-file by toggling [data-file-pane] hidden', async () => {
+  const src = await readFile(HELPER, 'utf8')
+  expect(src).toContain('handleSelectFile')
+  expect(src).toContain('data-file-pane')
+})
+
+test('helper.js handles set-diff-mode by toggling .diff-unified / .diff-split', async () => {
+  const src = await readFile(HELPER, 'utf8')
+  expect(src).toContain('handleSetDiffMode')
+  expect(src).toContain('diff-unified')
+  expect(src).toContain('diff-split')
+})
+
+test('helper.js implements per-file finding navigation', async () => {
+  const src = await readFile(HELPER, 'utf8')
+  expect(src).toContain('navigateFinding')
+  expect(src).toContain('fileFindingIdx')
+  expect(src).toContain('is-focused')
+})
+
+test('helper.js toggles suggestions visibility via body.dataset.showSuggestions', async () => {
+  const src = await readFile(HELPER, 'utf8')
+  expect(src).toContain('handleToggleSuggestions')
+  expect(src).toContain('showSuggestions')
+})
+
+test('helper.js toggles severity filter via body.hide-sev-* classes', async () => {
+  const src = await readFile(HELPER, 'utf8')
+  expect(src).toContain('handleFilterSev')
+  expect(src).toContain('hide-sev-')
+})
+
+test('helper.js wires select-sev and select-recommended', async () => {
+  const src = await readFile(HELPER, 'utf8')
+  expect(src).toContain('handleSelectSev')
+  expect(src).toContain('handleSelectRecommended')
+})
+
+test('helper.js updates selected-count via [data-role="selected-count"]', async () => {
+  const src = await readFile(HELPER, 'utf8')
+  expect(src).toContain('updateSelectedCount')
+  expect(src).toContain('selected-count')
+})
+
+test('helper.js POSTs to /api/post-review when Post Selected is wired', async () => {
+  const src = await readFile(HELPER, 'utf8')
+  expect(src).toContain('/api/post-review')
+  expect(src).toContain('handlePostSelected')
+  expect(src).toContain('handlePostRecommended')
+})
+
+test('helper.js applies review result to data-posted on matching annotations', async () => {
+  const src = await readFile(HELPER, 'utf8')
+  expect(src).toContain('applyReviewResult')
+  expect(src).toContain("setAttribute('data-posted'")
+})

package/skills/magpie/scripts/__tests__/pipeline-e2e.test.ts

@@ -77,6 +77,16 @@ test('setup -> dedupe -> render(progress) -> render(findings) -> cleanup compose
   expect(screen).toContain('progress.html')
   expect(screen).toContain('findings.html')
 
+  // Verify Pylon-style DOM markers in findings.html
+  const findingsHtml = await Bun.file(join(runDir, 'screen', 'findings.html')).text()
+  expect(findingsHtml.includes('class="pr-header"')).toBe(true)
+  expect(findingsHtml.includes('data-finding-id')).toBe(true)
+  expect(findingsHtml.includes('data-file-pane')).toBe(true)
+  expect(findingsHtml.includes('data-role="action-bar"')).toBe(true)
+  expect(findingsHtml.includes('data-action="post-recommended"')).toBe(true)
+  expect(findingsHtml.includes('class="annot-body')).toBe(true)
+  expect(findingsHtml.includes('class="issue-card')).toBe(true)
+
   expect(await runCleanup({ runDir, repoPath: repo, gitBin: 'git' })).toBe(0)
   const parent = dirname(runDir)
   const entries = await readdir(parent)

package/skills/magpie/scripts/__tests__/post-cmd.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, expect, test } from 'bun:test'
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -8,6 +8,7 @@ import {
   formatPostBody,
   formatReviewSummaryBody,
   parseRepoFromUrl,
+  postFindingsAsReview,
   runPost,
 } from '../post-cmd.ts'
 
@@ -331,3 +332,91 @@ test('runPost appends post stage events to log.jsonl', async () => {
   expect(log).toContain('"status":"start"')
   expect(log).toContain('"status":"dry-run"')
 })
+
+// ---------------------------------------------------------------------------
+// postFindingsAsReview
+// ---------------------------------------------------------------------------
+
+async function scaffoldRunDir(findings: unknown[]): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), 'magpie-post-review-'))
+  await writeFile(join(dir, 'findings.json'), JSON.stringify(findings))
+  return dir
+}
+
+const inlineFinding = (id: string, line: number) => ({
+  id,
+  file: 'src/a.ts',
+  line,
+  severity: 'high',
+  title: `Finding ${id}`,
+  description: 'd',
+  risk: { impact: 'high', likelihood: 'likely', confidence: 'high', action: 'must-fix' },
+  domain: 'security',
+})
+
+describe('postFindingsAsReview', () => {
+  test('builds a payload with N inline comments under dryRun', async () => {
+    const dir = await scaffoldRunDir([
+      inlineFinding('1', 10),
+      inlineFinding('2', 20),
+      inlineFinding('3', 30),
+    ])
+    const r = await postFindingsAsReview({
+      runDir: dir,
+      findingIds: ['1', '2', '3'],
+      prNumber: 42,
+      headSha: 'abc123',
+      dryRun: true,
+    })
+    expect(r.command?.[0]).toBe('gh')
+    expect(r.command?.[2]).toBe('repos/{owner}/{repo}/pulls/42/reviews')
+    expect(r.payload).toBeDefined()
+    const parsed = JSON.parse(r.payload as string) as {
+      comments: Array<{ path: string; line: number; side: string }>
+    }
+    expect(parsed.comments).toHaveLength(3)
+    expect(parsed.comments[0]).toMatchObject({ path: 'src/a.ts', line: 10, side: 'RIGHT' })
+    expect(parsed.comments[1]).toMatchObject({ path: 'src/a.ts', line: 20, side: 'RIGHT' })
+    expect(parsed.comments[2]).toMatchObject({ path: 'src/a.ts', line: 30, side: 'RIGHT' })
+    await rm(dir, { recursive: true, force: true })
+  })
+
+  test('routes line-less findings into the review body', async () => {
+    const dir = await scaffoldRunDir([
+      {
+        id: '1',
+        file: null,
+        line: null,
+        severity: 'high',
+        title: 'general note',
+        description: 'd',
+        risk: { impact: 'high', likelihood: 'likely', confidence: 'high', action: 'must-fix' },
+        domain: 'architecture',
+      },
+    ])
+    const r = await postFindingsAsReview({
+      runDir: dir,
+      findingIds: ['1'],
+      prNumber: 42,
+      headSha: 'abc123',
+      dryRun: true,
+    })
+    const parsed = JSON.parse(r.payload as string) as { body: string; comments: unknown[] }
+    expect(parsed.comments).toHaveLength(0)
+    expect(parsed.body).toContain('general note')
+    await rm(dir, { recursive: true, force: true })
+  })
+
+  test('returns comments for unknown ids under dryRun', async () => {
+    const dir = await scaffoldRunDir([])
+    const r = await postFindingsAsReview({
+      runDir: dir,
+      findingIds: ['missing'],
+      prNumber: 42,
+      headSha: 'abc123',
+      dryRun: true,
+    })
+    expect(r.comments.find((c) => c.id === 'missing')).toBeDefined()
+    await rm(dir, { recursive: true, force: true })
+  })
+})

package/skills/magpie/scripts/__tests__/preview-cmd.test.ts

@@ -0,0 +1,210 @@
+import { afterEach, beforeEach, expect, test } from 'bun:test'
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  DEFAULT_STAGE,
+  KNOWN_STAGE_PRESETS,
+  type PreviewResult,
+  runPreview,
+  type STAGE_PRESETS,
+} from '../preview-cmd.ts'
+
+let workDir: string
+
+beforeEach(async () => {
+  workDir = await mkdtemp(join(tmpdir(), 'magpie-preview-test-'))
+})
+
+afterEach(async () => {
+  await rm(workDir, { recursive: true, force: true })
+})
+
+// Captures any opener invocations so we can assert without spawning a real OS
+// open command in tests.
+function withCapturedOpener(): { calls: string[]; factory: () => (path: string) => Promise<void> } {
+  const calls: string[] = []
+  return {
+    calls,
+    factory: () => async (path: string) => {
+      calls.push(path)
+    },
+  }
+}
+
+test('renders both pages by default from the bundled fixture', async () => {
+  const opener = withCapturedOpener()
+  const result = await runPreview({
+    page: 'both',
+    stage: DEFAULT_STAGE,
+    outDir: workDir,
+    openerFactory: opener.factory,
+  })
+  expect(result.findingsHtml).toBe(join(workDir, 'findings.html'))
+  expect(result.progressHtml).toBe(join(workDir, 'progress.html'))
+  const findings = await readFile(result.findingsHtml as string, 'utf8')
+  const progress = await readFile(result.progressHtml as string, 'utf8')
+  expect(findings).toContain('PR #1337')
+  expect(findings).toContain('feat/session-redis-and-prompts')
+  // The fixture covers all four severities so the breakdown line should
+  // include each one.
+  expect(findings).toContain('blocker')
+  expect(findings).toContain('high')
+  expect(findings).toContain('medium')
+  expect(findings).toContain('low')
+  expect(progress).toContain('PR #1337')
+  // Default stage is report-done so the connector should fill 7/7 segments
+  // before the final post stage.
+  expect(progress).toContain('--done-count: 7')
+})
+
+test('honors --page findings: progress is not rendered', async () => {
+  const opener = withCapturedOpener()
+  const result = await runPreview({
+    page: 'findings',
+    stage: DEFAULT_STAGE,
+    outDir: workDir,
+    openerFactory: opener.factory,
+  })
+  expect(result.findingsHtml).toBeDefined()
+  expect(result.progressHtml).toBeUndefined()
+})
+
+test('honors --page progress: findings is not rendered', async () => {
+  const opener = withCapturedOpener()
+  const result = await runPreview({
+    page: 'progress',
+    stage: 'specialists-running',
+    outDir: workDir,
+    openerFactory: opener.factory,
+  })
+  expect(result.progressHtml).toBeDefined()
+  expect(result.findingsHtml).toBeUndefined()
+  const html = await readFile(result.progressHtml as string, 'utf8')
+  expect(html).toContain('class="step running"')
+})
+
+test('--no-open suppresses the browser opener', async () => {
+  const opener = withCapturedOpener()
+  await runPreview({
+    page: 'both',
+    stage: DEFAULT_STAGE,
+    outDir: workDir,
+    openInBrowser: false,
+    openerFactory: opener.factory,
+  })
+  expect(opener.calls).toEqual([])
+})
+
+test('opener is called with the findings path when both pages are rendered', async () => {
+  const opener = withCapturedOpener()
+  const result = await runPreview({
+    page: 'both',
+    stage: DEFAULT_STAGE,
+    outDir: workDir,
+    openInBrowser: true,
+    openerFactory: opener.factory,
+  })
+  expect(opener.calls).toEqual([result.findingsHtml as string])
+  expect(result.opened).toBe(result.findingsHtml)
+})
+
+test('dry-run returns the planned paths without writing files', async () => {
+  const opener = withCapturedOpener()
+  const result = await runPreview({
+    page: 'both',
+    stage: DEFAULT_STAGE,
+    outDir: workDir,
+    dryRun: true,
+    openerFactory: opener.factory,
+  })
+  expect(result.dryRun).toBe(true)
+  expect(result.findingsHtml).toBe(join(workDir, 'findings.html'))
+  expect(opener.calls).toEqual([])
+  // Nothing should have been created in workDir.
+  let createdAnyway = false
+  try {
+    await readFile(join(workDir, 'findings.html'), 'utf8')
+    createdAnyway = true
+  } catch {
+    // expected
+  }
+  expect(createdAnyway).toBe(false)
+})
+
+test('every stage preset is renderable end-to-end', async () => {
+  for (const stage of KNOWN_STAGE_PRESETS) {
+    const stageDir = join(workDir, stage)
+    const opener = withCapturedOpener()
+    const result: PreviewResult = await runPreview({
+      page: 'progress',
+      stage,
+      outDir: stageDir,
+      openInBrowser: false,
+      openerFactory: opener.factory,
+    })
+    const html = await readFile(result.progressHtml as string, 'utf8')
+    expect(html).toContain('class="pipeline"')
+  }
+})
+
+test('--done-count in the progress page reflects the chosen preset', async () => {
+  const cases: Array<{ stage: keyof typeof STAGE_PRESETS; expectedDone: number }> = [
+    { stage: 'fresh', expectedDone: 0 },
+    { stage: 'setup-done', expectedDone: 1 },
+    { stage: 'specialists-done', expectedDone: 3 },
+    { stage: 'critic-done', expectedDone: 5 },
+    { stage: 'report-done', expectedDone: 7 },
+    { stage: 'post-done', expectedDone: 8 },
+  ]
+  for (const { stage, expectedDone } of cases) {
+    const stageDir = join(workDir, stage)
+    await runPreview({
+      page: 'progress',
+      stage,
+      outDir: stageDir,
+      openInBrowser: false,
+    })
+    const html = await readFile(join(stageDir, 'progress.html'), 'utf8')
+    expect(html).toContain(`--done-count: ${expectedDone}`)
+  }
+})
+
+test('peer-review-error preset surfaces the error step in the rendered HTML', async () => {
+  await runPreview({
+    page: 'progress',
+    stage: 'peer-review-error',
+    outDir: workDir,
+    openInBrowser: false,
+  })
+  const html = await readFile(join(workDir, 'progress.html'), 'utf8')
+  expect(html).toContain('class="step error"')
+  expect(html).toContain('data-stage="peer-review"')
+})
+
+test('mixed post-status in the fixture surfaces both posted and failed badges', async () => {
+  await runPreview({
+    page: 'findings',
+    stage: DEFAULT_STAGE,
+    outDir: workDir,
+    openInBrowser: false,
+  })
+  const html = await readFile(join(workDir, 'findings.html'), 'utf8')
+  expect(html).toContain('class="status-chip posted"')
+  expect(html).toContain('class="status-chip failed"')
+  // The fixture's failed entry includes a 422 message; make sure it survives.
+  expect(html).toContain('422')
+})
+
+test('bundled fixture covers all five focus domains', async () => {
+  await runPreview({
+    page: 'findings',
+    stage: DEFAULT_STAGE,
+    outDir: workDir,
+    openInBrowser: false,
+  })
+  const html = await readFile(join(workDir, 'findings.html'), 'utf8')
+  for (const domain of ['security', 'bugs', 'performance', 'code-smells', 'architecture']) {
+    expect(html).toContain(`data-domain="${domain}"`)
+  }
+})

package/skills/magpie/scripts/__tests__/refresh.test.ts

@@ -60,8 +60,8 @@ test('refreshFindings writes findings.html and prunes any older findings*.html',
   const fresh = await readFile(join(runDir, 'screen', 'findings.html'), 'utf8')
   // The new file is rendered, not the stale OLD content.
   expect(fresh).not.toContain('OLD')
-  // Contains the new interactivity surface (filter bar, data-run-id).
-  expect(fresh).toContain('class="filter-bar"')
+  // Contains the new interactivity surface (segmented tabs, data-run-id).
+  expect(fresh).toContain('data-action="set-view"')
   expect(fresh).toMatch(/data-run-id="[^"]+"/)
   // And the rendered finding itself.
   expect(fresh).toContain('tsst')

package/skills/magpie/scripts/__tests__/render-action-bar.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, test } from 'bun:test'
+import { renderActionBar } from '../render-action-bar.ts'
+import type { ReviewFinding } from '../types.ts'
+
+const findings: ReviewFinding[] = [
+  {
+    id: '1',
+    file: 'a.ts',
+    line: 1,
+    severity: 'blocker',
+    title: 'A',
+    description: 'd',
+    risk: { impact: 'high', likelihood: 'likely', confidence: 'high', action: 'must-fix' },
+    domain: 'security',
+  },
+  {
+    id: '2',
+    file: 'b.ts',
+    line: 1,
+    severity: 'high',
+    title: 'B',
+    description: 'd',
+    risk: { impact: 'high', likelihood: 'likely', confidence: 'high', action: 'should-fix' },
+    domain: 'bugs',
+  },
+  {
+    id: '3',
+    file: 'c.ts',
+    line: 1,
+    severity: 'low',
+    title: 'C',
+    description: 'd',
+    risk: { impact: 'low', likelihood: 'unknown', confidence: 'medium', action: 'optional' },
+    domain: 'code-smells',
+  },
+] as ReviewFinding[]
+
+describe('renderActionBar', () => {
+  test('Post Recommended count excludes suggestions', () => {
+    const html = renderActionBar({ findings })
+    expect(html).toContain('Post Recommended (2)')
+  })
+
+  test('initial Post Selected reads 0', () => {
+    const html = renderActionBar({ findings })
+    expect(html).toContain('Post Selected (')
+    expect(html).toMatch(/data-role="selected-count">0</)
+  })
+
+  test('renders excluded suggestions hint when suggestions present', () => {
+    const html = renderActionBar({ findings })
+    expect(html).toContain('1 suggestion excluded')
+  })
+
+  test('renders severity selection pills with counts', () => {
+    const html = renderActionBar({ findings })
+    expect(html).toContain('data-action="select-sev"')
+    expect(html).toContain('data-sev="blocker"')
+    expect(html).toContain('data-sev="high"')
+  })
+
+  test('renders Select recommended link', () => {
+    const html = renderActionBar({ findings })
+    expect(html).toContain('data-action="select-recommended"')
+  })
+})

package/skills/magpie/scripts/__tests__/render-annotation.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, test } from 'bun:test'
+import { renderAnnotation } from '../render-annotation.ts'
+import type { ReviewFinding } from '../types.ts'
+
+const finding: ReviewFinding = {
+  id: 'f-1',
+  file: 'src/a.ts',
+  line: 42,
+  severity: 'high',
+  title: 'Race in cache.refresh()',
+  description: 'Observation: two refreshes overlap.\n\nWhy it matters: stale data.',
+  risk: { impact: 'high', likelihood: 'likely', confidence: 'high', action: 'should-fix' },
+  domain: 'bugs',
+  suggestion: { body: 'await lock.acquire()', startLine: 42, endLine: 42 },
+}
+
+describe('renderAnnotation', () => {
+  test('emits a div with data-finding-id and severity class', () => {
+    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: false })
+    expect(html).toContain(`data-finding-id="f-1"`)
+    expect(html).toContain('annot')
+    expect(html).toContain('data-severity="high"')
+  })
+
+  test('renders severity label, domain chip, and title', () => {
+    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: false })
+    expect(html).toContain('HIGH')
+    expect(html).toContain('Bugs')
+    expect(html).toContain('Race in cache.refresh()')
+  })
+
+  test('renders parsed description sections', () => {
+    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: false })
+    expect(html).toContain('Observation')
+    expect(html).toContain('two refreshes overlap')
+    expect(html).toContain('Why it matters')
+  })
+
+  test('renders the suggestion code block when present', () => {
+    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: false })
+    expect(html).toContain('<pre')
+    expect(html).toContain('await lock.acquire()')
+  })
+
+  test('renders risk dimensions footer', () => {
+    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: false })
+    expect(html).toContain('Impact: <span class="tag">high</span>')
+    expect(html).toContain('Likelihood: <span class="tag">likely</span>')
+  })
+
+  test('marks posted findings and disables checkbox', () => {
+    const html = renderAnnotation(finding, { checked: true, posted: true, asCard: false })
+    expect(html).toContain('data-posted="true"')
+    expect(html).toContain('checked disabled')
+  })
+
+  test('marks suggestion-only findings with data-suggestion="true"', () => {
+    const suggestion: ReviewFinding = { ...finding, risk: { ...finding.risk, action: 'optional' } }
+    const html = renderAnnotation(suggestion, { checked: false, posted: false, asCard: false })
+    expect(html).toContain('data-suggestion="true"')
+  })
+
+  test('asCard=true wraps in .issue-card', () => {
+    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: true })
+    expect(html).toContain('class="issue-card')
+  })
+})