@ionivetech/mugiwara 0.6.5 → 0.7.0

package/src/continue.ts

@@ -0,0 +1,262 @@
+// src/continue.ts
+// Deterministic resume-point reader. Powers `mugiwara continue` and
+// `mugiwara status` — pure fs + JSON, zero model judgement. The prose skills
+// used to describe this scan so the host model would perform it; that cost a
+// full reasoning turn to answer "what is in flight?". This is the same answer
+// in one process spawn.
+//
+// Reads what scripts/savepoint.sh writes:
+//   .mugiwara/missions/<mission>/state.json              (solo state)
+//   .mugiwara/missions/<mission>/<member>.json           (team state)
+//   .mugiwara/missions/<mission>/continue.json           (solo resume point)
+//   .mugiwara/missions/<mission>/continue-<member>.json  (team resume point)
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+
+/** Mission/member allowlist — identical to savepoint.sh and mission.ts. */
+const SAFE = /^[A-Za-z0-9._-]+$/;
+const isSafeKey = (s: string): boolean => SAFE.test(s) && !/^\.+$/.test(s);
+
+export type ContinueEntry = {
+  mission: string;
+  member: string | null;
+  actor: string;
+  branch: string;
+  flow: number;
+  mode: string;
+  tasks_done: number;
+  tasks_total: number;
+  lane: string;
+  next_action: string;
+  next_session_prompt: string;
+  updated_at: string;
+};
+
+export type StateEntry = ContinueEntry & {
+  lane_reason: string;
+  lane_rose: boolean;
+  lane_prev: string;
+  lane_peak: string;
+  base_sha: string;
+  sensitive_paths: string[];
+  blockers_open: number;
+  heal_cycle: number;
+  heal_max_cycles: number;
+  heal_halt: boolean;
+  delegate_threshold: number;
+  delegate_due: boolean;
+  tokens_est: number;
+  budget: number;
+  budget_status: string;
+  files_touched: number;
+  evidence: string[];
+};
+
+const num = (v: unknown): number => {
+  const n = Number(v);
+  return Number.isFinite(n) ? n : 0;
+};
+const text = (v: unknown): string => (typeof v === 'string' ? v : '');
+
+/**
+ * Resolve the git actor exactly as scripts/savepoint.sh does:
+ * STATE_ACTOR → GIT_AUTHOR_NAME → "name <email>" → USER. A byte difference
+ * here silently filters every mission out of the listing.
+ */
+export function gitActor(cwd: string): string {
+  const env = (process.env.STATE_ACTOR ?? '').trim();
+  if (env) return env;
+  const author = (process.env.GIT_AUTHOR_NAME ?? '').trim();
+  if (author) return author;
+  const git = (args: string[]): string => {
+    try {
+      return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    } catch {
+      return '';
+    }
+  };
+  const name = git(['config', 'user.name']);
+  const email = git(['config', 'user.email']);
+  if (name && email) return `${name} <${email}>`;
+  // USERNAME is the Windows spelling of USER; savepoint.sh resolves the same
+  // chain, and the two must stay byte-identical or the actor filter drops rows.
+  return name || process.env.USER || process.env.USERNAME || '';
+}
+
+/**
+ * Read every mission dir under `.mugiwara/missions/<mission>/`, picking the
+ * files this reader owns: state readers take `state.json` / `<member>.json`,
+ * continue readers take `continue.json` / `continue-<member>.json`. Corrupt
+ * files are skipped.
+ */
+function scan<T>(projectDir: string, kind: 'state' | 'continue', map: (raw: Record<string, unknown>, member: string | null) => T): T[] {
+  const base = join(projectDir, '.mugiwara', 'missions');
+  if (!existsSync(base)) return [];
+  const out: T[] = [];
+  const missions = readdirSync(base, { withFileTypes: true })
+    .filter((e) => e.isDirectory() && isSafeKey(e.name))
+    .map((e) => e.name)
+    .sort();
+  for (const mission of missions) {
+    const dir = join(base, mission);
+    for (const f of readdirSync(dir).filter((n) => n.endsWith('.json')).sort()) {
+      const stem = f.slice(0, -'.json'.length);
+      // state files: `state` (solo) or `<member>`; continue files: `continue`
+      // (solo) or `continue-<member>`. Each scan ignores the other kind.
+      let member: string | null;
+      if (kind === 'state') {
+        if (stem === 'continue' || stem.startsWith('continue-')) continue;
+        member = stem === 'state' ? null : stem;
+      } else {
+        if (stem === 'continue') member = null;
+        else if (stem.startsWith('continue-')) member = stem.slice('continue-'.length);
+        else continue;
+      }
+      if (member !== null && !isSafeKey(member)) continue;
+      try {
+        const raw = JSON.parse(readFileSync(join(dir, f), 'utf8')) as Record<string, unknown>;
+        // trust the path over the file body: a mission field that disagrees
+        // with its own directory is a corrupt or hand-edited file
+        if (text(raw.mission) !== mission) continue;
+        out.push(map(raw, member));
+      } catch {
+        // corrupt savepoint — skip, never crash the listing
+      }
+    }
+  }
+  return out;
+}
+
+export function readContinue(projectDir: string): ContinueEntry[] {
+  return scan(projectDir, 'continue', (r, member) => ({
+    mission: text(r.mission),
+    member,
+    actor: text(r.actor),
+    branch: text(r.branch),
+    flow: num(r.flow ?? r.wave),
+    mode: text(r.mode) || 'guided',
+    tasks_done: num(r.tasks_done),
+    tasks_total: num(r.tasks_total),
+    lane: text(r.lane) || 'direct',
+    next_action: text(r.next_action),
+    next_session_prompt: text(r.next_session_prompt),
+    updated_at: text(r.updated_at),
+  }));
+}
+
+export function readState(projectDir: string): StateEntry[] {
+  return scan(projectDir, 'state', (r, member) => {
+    const tasks = (r.tasks ?? {}) as Record<string, unknown>;
+    return {
+      mission: text(r.mission),
+      member,
+      actor: text(r.actor),
+      branch: text(r.branch),
+      flow: num(r.flow ?? r.wave),
+      mode: text(r.mode) || 'guided',
+      tasks_done: num(tasks.done),
+      tasks_total: num(tasks.total),
+      lane: text(r.lane) || 'direct',
+      lane_reason: text(r.lane_reason),
+      lane_rose: r.lane_rose === true,
+      lane_prev: text(r.lane_prev),
+      lane_peak: text(r.lane_peak),
+      base_sha: text(r.base_sha),
+      sensitive_paths: Array.isArray(r.sensitive_paths) ? r.sensitive_paths.map(text).filter(Boolean) : [],
+      next_action: text(r.next_action),
+      next_session_prompt: text(r.next_session_prompt),
+      updated_at: text(r.updated_at),
+      blockers_open: num(r.blockers_open),
+      heal_cycle: num(r.heal_cycle),
+      heal_max_cycles: num(r.heal_max_cycles) || 3,
+      heal_halt: r.heal_halt === true,
+      delegate_threshold: num(r.delegate_threshold) || 60,
+      delegate_due: r.delegate_due === true,
+      tokens_est: num(r.tokens_est),
+      budget: num(r.budget),
+      budget_status: text(r.budget_status) || 'ok',
+      files_touched: num(r.files_touched),
+      evidence: Array.isArray(r.evidence) ? r.evidence.map(text).filter(Boolean) : [],
+    };
+  });
+}
+
+export type Resolution =
+  | { kind: 'none' }
+  | { kind: 'missions'; entries: ContinueEntry[] }
+  | { kind: 'members'; mission: string; entries: ContinueEntry[] }
+  | { kind: 'unknown-mission'; mission: string; known: string[] }
+  | { kind: 'unknown-member'; mission: string; member: string; known: string[] }
+  | { kind: 'resume'; entry: ContinueEntry };
+
+/**
+ * The three command forms, decided from disk alone:
+ *   (none)            → list every in-flight mission
+ *   <mission>         → solo resumes; team lists its members
+ *   <mission> <member>→ resume that member
+ *
+ * Solo-vs-team needs no plan-doc parse: savepoint writes `state.json` with a
+ * null member for solo and `<member>.json` per team member.
+ */
+export function resolveContinue(entries: ContinueEntry[], mission?: string, member?: string): Resolution {
+  if (!entries.length) return { kind: 'none' };
+
+  if (!mission) {
+    const missions = [...new Set(entries.map((e) => e.mission))];
+    if (missions.length === 1) return resolveContinue(entries, missions[0], member);
+    return { kind: 'missions', entries };
+  }
+
+  const inMission = entries.filter((e) => e.mission === mission);
+  if (!inMission.length) {
+    return { kind: 'unknown-mission', mission, known: [...new Set(entries.map((e) => e.mission))] };
+  }
+
+  if (member) {
+    const hit = inMission.find((e) => e.member === member);
+    if (!hit) {
+      return {
+        kind: 'unknown-member',
+        mission,
+        member,
+        known: inMission.map((e) => e.member ?? '(solo)'),
+      };
+    }
+    return { kind: 'resume', entry: hit };
+  }
+
+  const solo = inMission.find((e) => e.member === null);
+  // a solo file resumes directly; anything else needs the member picked, and
+  // is never guessed — resuming the wrong member's work is unrecoverable
+  if (solo && inMission.length === 1) return { kind: 'resume', entry: solo };
+  return { kind: 'members', mission, entries: inMission };
+}
+
+function pad(s: string, n: number): string {
+  return s.length >= n ? s : s + ' '.repeat(n - s.length);
+}
+
+/** Fixed-width table — the whole point is that the host prints this verbatim. */
+export function formatTable(entries: ContinueEntry[]): string {
+  const rows = entries.map((e) => [
+    e.mission,
+    e.member ?? '—',
+    String(e.flow),
+    `${e.tasks_done}/${e.tasks_total}`,
+    e.lane,
+    e.mode,
+  ]);
+  const head = ['MISSION', 'MEMBER', 'FLOW', 'TASKS', 'LANE', 'MODE'];
+  const widths = head.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const line = (cells: string[]): string =>
+    '  ' + cells.map((c, i) => pad(c, widths[i])).join('  ').trimEnd();
+  return [line(head), ...rows.map(line)].join('\n');
+}
+
+/** The single resume line the mugiwara-resume skill contracts for. */
+export function formatResume(e: ContinueEntry): string {
+  const scope = e.member ? ` [${e.member}]` : '';
+  const next = e.next_session_prompt || '(no next_session_prompt recorded)';
+  return `Resumed: ${e.mission}${scope}, Flow ${e.flow}, ${e.tasks_done}/${e.tasks_total} tasks — next_action: ${e.next_action} — run: ${next}`;
+}

package/src/installer.ts

@@ -44,6 +44,15 @@ export interface Target {
   transformSkillFull?(data: FrontmatterData, body: string): TransformOut | null;
   transformAgentFull?(data: FrontmatterData, body: string): TransformOut | null;
   postInstall?(opts: { scope: Scope; projectDir: string; home: string; dryRun: boolean; files: string[] }): { written: string[]; notes: string[] };
+  /**
+   * Undo anything postInstall did to a file mugiwara does not own.
+   *
+   * Files listed in the manifest are deleted wholesale on uninstall, so a
+   * shared file we merely EDITED (settings.json) must never be reported as
+   * written — deleting it destroys the user's own configuration. Such files are
+   * un-merged here instead.
+   */
+  postUninstall?(opts: { scope: Scope; projectDir: string; home: string; dryRun: boolean }): { changed: string[]; notes: string[] };
 }
 
 export const CONTENT_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'content');
@@ -151,6 +160,38 @@ export function installTo(target: Target, opts: InstallOptions): InstallResult {
     result.written.push(...post.written);
     result.notes.push(...post.notes);
   }
+
+  // A fresh install must be immediately usable — write a default
+  // .mugiwara/config so no key silently falls back. Only for project scope;
+  // global installs don't own a project config. Never overwrite an existing
+  // config.
+  if (scope === 'project') {
+    const configPath = join(projectDir, '.mugiwara', 'config');
+    // lstat, not existsSync: a pre-created symlinked config must not be
+    // followed and overwritten (TOCTOU / symlink defense-in-depth).
+    let configExists = false;
+    try { configExists = lstatSync(configPath).isFile() || lstatSync(configPath).isSymbolicLink(); } catch { configExists = false; }
+    if (!configExists) {
+      const body = [
+        'mode=guided',
+        'branch=feature/{type}-{issue}-{slug}',
+        'commit=conventional',
+        'auto_commit=on',
+        'coverage_new=90',
+        'coverage_modified=80',
+        'review_depth=full',
+        'quality_depth=full',
+        'verify_merged=off',
+        'delegate_threshold=60',
+        'heal_max_cycles=3',
+        'verbosity=normal',
+        '# context_budget_chars=150000  # optional: fail archive if trail exceeds this (measured in report Cost section)',
+      ].join('\n') + '\n';
+      if (!dryRun) { mkdirSync(dirname(configPath), { recursive: true }); writeFileSync(configPath, body); }
+      result.written.push(configPath);
+      result.notes.push(`default config written: ${configPath} (edit it to customise)`);
+    }
+  }
   return result;
 }
 
@@ -184,13 +225,14 @@ function assertNotSymlink(file: string): void {
 
 const GITIGNORE_BLOCK_START = '# >>> mugiwara >>>';
 const GITIGNORE_BLOCK_END = '# <<< mugiwara <<<';
-// legacy marker from v0.6.2 — block was undelimited, single '# mugiwara'
-// header. Kept for detection so an old install is not double-appended.
-const GITIGNORE_MARKER = '# mugiwara';
-const GITIGNORE_BLOCK = `# >>> mugiwara >>> — audit trail is the product: commit reports/, results/, logs/, spec/, plans/.
-# Ignore session state and regenerated files.
-.mugiwara/state/
-.mugiwara/continue/
+// legacy markers — pre-0.7 blocks ignored per-type dirs (.mugiwara/state/,
+// .mugiwara/continue/) instead of the mission-first layout. Kept for
+// detection so an old install is upgraded, not double-appended.
+const GITIGNORE_LEGACY = ['.mugiwara/state/', '# mugiwara'];
+const GITIGNORE_BLOCK = `# >>> mugiwara >>> — audit trail is the product: commit plan.md, flows/, review.md,
+# decisions.md, blockers.md, report.md under .mugiwara/missions/. Ignore session state.
+.mugiwara/missions/**/*.json
+.mugiwara/index.md
 .mugiwara/config
 .mugiwara/refs/
 # <<< mugiwara <<<
@@ -203,14 +245,14 @@ export function ensureProjectGitignore(projectDir: string, opts: { dryRun?: bool
   let existing = existsSync(path) ? readFileSync(path, 'utf8') : '';
   if (existing) {
     // Delimited block present with the current entries → nothing to do.
-    if (existing.includes(GITIGNORE_BLOCK_START) && existing.includes('.mugiwara/state/')) {
+    if (existing.includes(GITIGNORE_BLOCK_START) && existing.includes('.mugiwara/missions/**/*.json')) {
       return { appended: false, notes: [] };
     }
-    // Legacy (v0.6.2) or outdated delimited block → upgrade in place:
-    // strip the old mugiwara entries (both forms), then append the new block.
+    // Legacy (pre-0.7) or outdated delimited block → upgrade in place:
+    // strip the old mugiwara entries, then append the new block.
     // Without this, upgraded projects keep committing per-wave state/continue
     // JSON to git — session state must stay ignored (Robin MAJOR, Jinbe Low).
-    const hadOld = existing.includes(GITIGNORE_MARKER) || existing.includes(GITIGNORE_BLOCK_START);
+    const hadOld = GITIGNORE_LEGACY.some((m) => existing.includes(m)) || existing.includes(GITIGNORE_BLOCK_START);
     if (hadOld) {
       const clean = removeProjectGitignore(projectDir, { dryRun });
       existing = clean.removed ? (existsSync(path) ? readFileSync(path, 'utf8') : '') : existing;
@@ -242,20 +284,22 @@ export function removeProjectGitignore(projectDir: string, { dryRun = false }: {
     const end = current.indexOf(GITIGNORE_BLOCK_END);
     if (end < start) return { removed: false, notes: ['delimiter mismatch — .gitignore left untouched'] };
     cleaned = current.slice(0, start) + current.slice(end + GITIGNORE_BLOCK_END.length);
-  } else if (current.includes(GITIGNORE_MARKER)) {
-    // legacy (v0.6.2): strip the exact undelimited block — the header, the
-    // explanatory comment, and the five known lines. Prefix-matching would
+  } else if (current.includes('# mugiwara')) {
+    // legacy (pre-0.7): strip the exact undelimited block — the header, the
+    // explanatory comment, and the known lines. Prefix-matching would
     // delete user-owned lines that merely start with a mugiwara path.
     const LEGACY_LINES = new Set([
       '.mugiwara/state.json',
       '.mugiwara/state-*.json',
       '.mugiwara/config',
+      '.mugiwara/state/',
+      '.mugiwara/continue/',
       '.mugiwara/continue.md',
       '.mugiwara/refs/',
     ]);
     const lines = current.split('\n').filter(l => {
       const t = l.trim();
-      if (t.startsWith(GITIGNORE_MARKER)) return false; // header + comment
+      if (t.startsWith('# mugiwara')) return false; // header + comment
       return !LEGACY_LINES.has(t);
     });
     cleaned = lines.join('\n');

package/src/integrity.ts

@@ -0,0 +1,158 @@
+// src/integrity.ts
+// Closure integrity gate: the audit trail validates itself
+// at archive time. Deterministic checks only — a violation fails the archive
+// with an actionable message instead of shipping a broken or leaking artifact.
+//
+// Three checks:
+//   1. Paths — every relative markdown link in the trail resolves to a file
+//      (mission-relative or repo-root).
+//   2. Secrets — no trail file matches known secret shapes.
+//   3. Evidence — cited wave/evidence paths exist.
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { isAbsolute, join, relative } from 'node:path';
+
+export type IntegrityIssue = { kind: 'dangling-path' | 'secret' | 'evidence' | 'evidence-thin'; detail: string };
+
+const SECRET_PATTERNS: Array<[RegExp, string]> = [
+  [/AKIA[0-9A-Z]{16}/, 'AWS access key id'],
+  [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, 'private key block'],
+  [/gh[pousr]_[A-Za-z0-9]{20,}/, 'GitHub token'],
+  [/xox[baprs]-[A-Za-z0-9-]{10,}/, 'Slack token'],
+  [/sk-[A-Za-z0-9]{32,}/, 'API key (sk-…)'],
+  [/eyJhbGciOi[A-Za-z0-9_.-]{20,}/, 'JWT pasted verbatim'],
+  [/(api[_-]?key|secret|passwd|password)\s*[=:]\s*["'][^"'\s]{8,}["']/i, 'credential assignment'],
+];
+
+const ALLOW_SECRET = 'mugiwara:allow-secret';
+
+/** Secret shapes per line; a line carrying the allow marker is skipped — deliberate examples stay possible. */
+function findSecrets(body: string): Array<{ label: string; hit: string }> {
+  const out: Array<{ label: string; hit: string }> = [];
+  for (const line of body.split(/\r?\n/)) {
+    if (line.includes(ALLOW_SECRET)) continue;
+    for (const [re, label] of SECRET_PATTERNS) {
+      const hit = line.match(re);
+      if (hit) out.push({ label, hit: hit[0] });
+    }
+  }
+  return out;
+}
+
+const TRAIL_EXTS = new Set(['.md', '.json', '.sh']);
+
+function trailFiles(dir: string): string[] {
+  const out: string[] = [];
+  const walk = (d: string): void => {
+    for (const e of readdirSync(d, { withFileTypes: true })) {
+      const p = join(d, e.name);
+      if (e.isDirectory()) walk(p);
+      else if (TRAIL_EXTS.has(e.name.slice(e.name.lastIndexOf('.')) || '')) out.push(p);
+    }
+  };
+  walk(dir);
+  return out;
+}
+
+/** Relative markdown-link targets like `](../src/x.ts)` — skip URLs and anchors. */
+function linkedPaths(md: string): string[] {
+  const out: string[] = [];
+  for (const m of md.matchAll(/\]\(([^)\s]+)\)/g)) {
+    const t = m[1];
+    if (/^(https?:|mailto:|#|\/\/)/.test(t)) continue;
+    out.push(t.split('#')[0]);
+  }
+  return out.filter(Boolean);
+}
+
+function hasCommandOutputShape(body: string): boolean {
+  return /`[^`]+`/.test(body) || /\b(exit\s+[01]|✓|✗|\bPASS\b|\bFAIL\b|passed|failed|\d+\s+(passed|failed))\b/i.test(body);
+}
+
+function collectPassCitedPaths(missionDir: string): string[] {
+  const out: string[] = [];
+  for (const f of trailFiles(missionDir)) {
+    let body: string;
+    try { body = readFileSync(f, 'utf8'); } catch { continue; }
+    for (const line of body.split(/\r?\n/)) {
+      if (!/\bPASS\b/.test(line)) continue;
+      for (const p of linkedPaths(line)) out.push(p);
+      // also catch bare repo-path mentions like flows/04-gates.md or evidence/foo.md
+      for (const m of line.matchAll(/(?:^|[\s"'(])([a-zA-Z0-9._\/-]+\.(?:md|txt|log|json))\b/g)) {
+        const cand = m[1];
+        if (cand.includes('/')) out.push(cand);
+      }
+    }
+  }
+  return [...new Set(out)];
+}
+
+export function checkTrail(missionDir: string, projectRoot: string): IntegrityIssue[] {
+  const issues: IntegrityIssue[] = [];
+  const files = trailFiles(missionDir);
+
+  // 1 + 2: per-file link resolution and secret scan
+  for (const f of files) {
+    let body: string;
+    try { body = readFileSync(f, 'utf8'); } catch { continue; }
+    for (const target of linkedPaths(body)) {
+      if (isAbsolute(target)) continue;
+      const fromMission = join(missionDir, target);
+      const fromRoot = join(projectRoot, target);
+      if (!existsSync(fromMission) && !existsSync(fromRoot)) {
+        issues.push({
+          kind: 'dangling-path',
+          detail: `${relative(projectRoot, f)} links "${target}" — no such file (mission dir or repo root)`,
+        });
+      }
+    }
+    for (const { label, hit } of findSecrets(body)) {
+      issues.push({
+        kind: 'secret',
+        detail: `${relative(projectRoot, f)} matches ${label}: ${hit.slice(0, 12)}…`,
+      });
+    }
+  }
+
+  // 3: evidence entries recorded as repo paths must exist
+  const evidencePaths: string[] = [];
+  const evidenceFile = join(missionDir, 'state.json');
+  if (existsSync(evidenceFile)) {
+    try {
+      const s = JSON.parse(readFileSync(evidenceFile, 'utf8')) as { evidence?: unknown };
+      if (Array.isArray(s.evidence)) {
+        for (const e of s.evidence) {
+          if (typeof e !== 'string' || !e.trim()) continue;
+          evidencePaths.push(e);
+          const cand = join(projectRoot, e);
+          if (!isAbsolute(e) && !existsSync(cand) && !existsSync(join(missionDir, e))) {
+            issues.push({ kind: 'evidence', detail: `state.json evidence "${e}" does not exist` });
+          }
+        }
+      }
+    } catch { /* corrupt state — the state reader owns that error */ }
+  }
+
+  // 4: evidence-content spot check (T7): a PASS verdict that cites an evidence
+  // path must point at a file that exists AND contains command-output shape
+  // (backticked command or exit-status token). Fake-but-consistent trails
+  // defeat existence-only checks — this raises the bar cheaply.
+  const passCited = collectPassCitedPaths(missionDir);
+  for (const e of passCited) {
+    if (!e.trim() || isAbsolute(e)) continue;
+    const candMission = join(missionDir, e);
+    const candRoot = join(projectRoot, e);
+    const resolved = existsSync(candMission) ? candMission : existsSync(candRoot) ? candRoot : null;
+    if (!resolved) continue; // already reported as evidence/dangling elsewhere
+    let body: string;
+    try { body = readFileSync(resolved, 'utf8'); } catch { continue; }
+    if (!hasCommandOutputShape(body)) {
+      issues.push({ kind: 'evidence-thin', detail: `evidence "${e}" exists but lacks command output (no backticked command or exit-status token)` });
+    }
+  }
+
+  return issues;
+}
+
+export function formatIssues(issues: IntegrityIssue[]): string {
+  return issues.map((i) => `  ✗ [${i.kind}] ${i.detail}`).join('\n');
+}